Key change notification for application authentication and key management

Abstract

A method performed by a first network node comprises transmitting a first subscription request message indicating a request to subscribe to receive notifications of changes in authentication status of a wireless device. A first notification message is received. The first notification message includes an indication of a change in the authentication status of the wireless device.

Description

Technical Field

[0001] The present disclosure relates generally to wireless communications and, more particularly, to systems and methods for key change notification for authentication and key management for applications (AKMA). Background Art

[0002] The 3rd Generation Partnership Project (3GPP) Release 16 introduced a new feature called Authentication and Key Management for Applications (AKMA) to support authentication and key management aspects of applications and 3GPP services based on 3GPP credentials in the fifth generation (5G), including Internet of Things (IoT) use cases. The latest TS is 3GPP TS 33.535 v. 0.2.0, with ongoing revisions.

[0003] It targets the use of authentication and key agreement (AKA) credentials to bootstrap security between user equipment (UE) and application function (AF), which allows the UE to exchange data securely with the application server. This can be seen as an evolution of the generic bootstrapping architecture (GBA) of 5G. In this article, the term AF can also be referred to as AKMA AF.

[0004] Figure 1 A typical network architecture of AKMA as disclosed in 3GPP TS 35.535 v. 0.2.0 is shown.

[0005] AKMA Anchor Function (AAnF) is a new logical entity introduced by AKMA. Specifically, similar to the Bootstrapping Server Function (BSF) in GBA, AAnF is an anchor function in the Home Public Land Mobile Network (HPLMN) for key material generation used between UE and AF. AAnF maintains the UE AKMA context for subsequent bootstrapping requests.

[0006] AKMA reuses the results of the 5G primary authentication process performed during UE registration to authenticate the UE. This is called implicit bootstrapping. In this process, the AUSF is responsible for generating and storing K AUSF and K AKMA Network Functions (NF) such as key materials.

[0007] Figure 2 The AKMA key hierarchy is shown to include the following keys: K AUSF , K AKMA , K AF , as disclosed in 3GPP TS 33.535 v. 0.2.0. The terms may be defined as follows:

[0008] • K AUSF: Root key as an output of the master authentication process and stored in the UE & AUSF; additionally, the AUSF can report the results and generate K as an output of the master authentication result in the unified data management (UDM) AUSF AUSF instance as defined in 3GPP TS 33.501 v. 16.0.0.

[0009] • K AKMA : Anchor key, obtained by the mobile equipment (ME) and AUSF from K AUSF is derived and is used by AAnF to generate further key material used in AKMA; K AKMA Key identifier K AKMA The key identifier is also the derived value.

[0010] • K AF : AF specific key, also known as application key, is obtained by ME and AAnF from K AKMA is derived and is used by the UE and AKMA AF to exchange data securely.

[0011] Figure 3 Figure 1 shows the establishment of a secure session between the UE and the application. As shown, the prerequisite for establishing a communication session is K AKMA Identifier (K AKMA Then, to initiate communication with the AKMA AF, the UE sends a session establishment request, which includes the derived K AKMA The AF then establishes a session by providing at least K AKMA ID and AF identifier to request application specific keys from AAnF. Further, AAnF sends a request to AUSF to obtain UE-specific K AKMA . AAnF then from K AKMA Get K AF , and responds to the AKMA AF via a key response, which includes K AF , the expiration time also known as KAF_exptime and used by AAnF to derive the new K AF Freshness parameter. AF responds to the message ( Figure 3 The KAF_exptime and freshness parameters are forwarded to the UE in the application session establishment response in the UE. Optionally, AF integrity is determined using K AF The UE receives the response and uses the freshness parameter and other parameters normally used by AAnF to derive the same K as AAnF. AF (and the same K provided to AF AF). If the response message includes a MAC, it uses the newly derived K AF To verify the integrity of the response message.

[0012] Then based on K AF Establish secure communication between UE and application.

[0013] Based on the operator’s strategy, K AKMA Implicit lifetimes should be used, and K AF Explicit lifetimes should be used.

[0014] K AKMA will be valid until the next master authentication is performed, in which case K AKMA Replaced after a successful new authentication or removed after an unsuccessful new authentication.

[0015] Although K is based on configuration parameters or operator strategies AF Specify the lifetime, but a refresh process is required to obtain the new K AKMA Before K AF Based on the same K when the lifetime is exhausted AKMA To get new K AF In the new K AKMA When K is established AF Can continue to be used until its lifetime expires. AF When the lifetime expires, based on the new K AKMA To build a new K AF .

[0016] Certain problems exist. For example, as mentioned above, AKMA uses K AKMA The implicit lifetime and K AF The explicit lifetime of K performs implicit guidance between the UE and the network. However, the AKMA AF is not aware of the K AKMA When it is no longer valid and / or has been replaced.

[0017] As another example, there may be multiple K generated during different master authentication processes and stored in different AUSF instances. AKMA However, only one AUSF instance maintains the latest K for a given UE. AKMA , and only the latest K AKMA Should be used for AKMA process.

[0018] Therefore, how can AUSF determine the K it stores? AKMA Is it the latest K AKMAAdditionally, there is a question of how the AAnF can determine whether the key material that the AAnF fetched from the AUSF is the latest key material and is still valid. Summary of the invention

[0019] Certain aspects of the present disclosure and embodiments thereof may provide solutions to these or other challenges. For example, according to certain embodiments, a notification process is provided to enable various network nodes and elements to determine K AKMA Is it still valid and / or has it been replaced.

[0020] According to certain embodiments, a method performed by a first network node comprises transmitting a first subscription request message indicating a request to subscribe to receive notifications of changes in authentication status of a wireless device. The first network node receives a first notification message including an indication of a change in authentication status of the wireless device.

[0021] According to certain embodiments, a first network node comprises a processing circuit configured to transmit a first subscription request message indicating a request to subscribe to receive notifications of changes in authentication status of a wireless device. The processing circuit is configured to receive a first notification message including an indication of a change in authentication status of the wireless device.

[0022] According to certain embodiments, another method performed by a first network node includes receiving a first subscription request message indicating a request to subscribe to receive notifications of changes in authentication status of a wireless device. The first network node transmits a first notification message including an indication of the change in authentication status of the wireless device.

[0023] According to certain embodiments, a first network node comprises a processing circuit configured to receive a first subscription request message indicating a request to subscribe to receive notifications of changes in authentication status of a wireless device. The processing circuit is configured to transmit a first notification message including an indication of a change in authentication status of the wireless device.

[0024] Certain embodiments may provide one or more of the following technical advantages. For example, one technical advantage may be that certain embodiments ensure that the UDM is updated for the latest K generated for a given wireless device. AKMA As another example, a technical advantage may be that certain embodiments can implement an appropriate notification method for AUSF and / or enable AAnF to be aware of the current authentication status and / or the latest K AKMA .

[0025] Other advantages may be readily apparent to those skilled in the art.Some embodiments may not have the advantages described or may have some or all of the advantages described. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] For a more complete understanding of the disclosed embodiments and their features and advantages, reference is now made to the following description taken in conjunction with the accompanying drawings, in which:

[0027] Figure 1 Shows a typical network architecture for application authentication and key management (AKMA);

[0028] Figure 2 shows the AKMA key hierarchy;

[0029] Figure 3 shows the secure session establishment between the UE and the application;

[0030] Figure 4 shows that K is mapped via UDM according to some embodiments AKMA Signaling diagram for stateful subscriptions;

[0031] Figure 5 shows the K via AUSF according to some embodiments AKMA Signaling diagram for subscription of key status;

[0032] Figure 6 illustrates an example wireless network according to certain embodiments;

[0033] Figure 7 illustrates an example network node according to certain embodiments;

[0034] Figure 8 illustrating an example wireless device in accordance with certain embodiments;

[0035] Fig. 9 illustrates an example user device according to certain embodiments;

[0036] Fig.10 illustrates a virtualized environment according to some embodiments, in which functions implemented by some embodiments may be virtualized;

[0037] Fig.11 shows a telecommunications network connected to a host computer via an intermediate network according to some embodiments;

[0038] Fig.12 A generalized block diagram illustrating a host computer communicating with a user device via a base station over a partially wireless connection according to some embodiments;

[0039] Fig.13 A method implemented in a communication system according to an embodiment is shown;

[0040] Fig.14 Another method implemented in a communication system according to an embodiment is shown;

[0041] Fig.15 Another method implemented in a communication system according to an embodiment is shown;

[0042] Fig.16 Another method implemented in a communication system according to an embodiment is shown;

[0043] Fig.17 illustrates an example method performed by a wireless device according to certain embodiments;

[0044] Fig.18 illustrates an exemplary virtual computing device according to certain embodiments;

[0045] Fig.19 illustrates an example method performed by a network node according to certain embodiments;

[0046] Fig. 20 illustrating another exemplary virtual computing device according to some embodiments; and

[0047] Fig.21 A process for notifying the AAnF about AKMA key status changes is shown according to certain embodiments. DETAILED DESCRIPTION

[0048] Some embodiments of the embodiments contemplated herein will now be described more fully with reference to the accompanying drawings. However, other embodiments are included within the scope of the subject matter disclosed herein, and the disclosed subject matter should not be construed as being limited to only the embodiments set forth herein; rather, these embodiments are provided as examples in order to convey the scope of the subject matter to those skilled in the art.

[0049] In general, all terms used herein are to be interpreted according to their ordinary meanings in the relevant technical field, unless a different meaning is explicitly given and / or implied by the context in which it is used. All references to "a / an / the element, device, component, part, step, etc." are open to be interpreted as representing at least one instance of an element, device, component, part, step, etc., unless otherwise explicitly stated. The steps of any method disclosed herein do not have to be performed in the exact order disclosed, unless a step is explicitly described as being after or before another step and / or it is implied that a step must be after or before another step. Any feature of any embodiment of the embodiments disclosed herein may be appropriately applied to any other embodiment. Similarly, any advantage of any embodiment of the embodiment may be applicable to any other embodiment, and vice versa. Other purposes, features and advantages of the attached embodiments will be apparent from the following description.

[0050] In some embodiments, the more general term "network node" may be used and may correspond to any type of radio network node or any network node that communicates with a UE (directly or via another node) and / or with another network node. Examples of network nodes are NodeB, master eNodeB (MeNB), eNodeB (eNB), network nodes belonging to a master cell group (MCG) or a secondary cell group (SCG), a base station (BS), a multi-standard radio (MSR) radio node (such as an MSRBS), a gNodeB (gNB), a network controller, a radio network controller (RNC), a base station controller (BSC), a repeater, a donor node controlling a repeater, a base transceiver station (BTS), an access point (AP), a transmission point, a transmission node, a remote radio unit (RRU), a remote radio head (RRH), a node in a distributed antenna system (DAS), a core network node (such as a mobile switching center (MSC), a mobility management entity (MME), etc.), operation and maintenance (O&M), an operation support system (OSS), a self-optimizing network (SON), a positioning node (such as an evolved serving mobile location center (E-SMLC)), minimization of drive tests (MDT), test equipment (physical node or software), etc.

[0051] In some embodiments, the non-limiting term "user equipment (UE)" or "wireless device" may be used and may refer to any type of wireless device that communicates with a network node and / or with another UE in a cellular or mobile communication system. Examples of UEs are target devices, device-to-device (D2D) UEs, machine-type UEs or UEs capable of machine-to-machine (M2M) communication, PDAs, tablets, mobile terminals, smart phones, laptop embedded equipment (LEE), laptop mounted equipment (LME), USB dongles, UE category M1, UE category M2, ProSe UEs, V2V UEs, V2X UEs, etc.

[0052] Additionally, terms such as base station / gNodeB and UE should be considered non-restrictive and do not particularly imply a certain hierarchical relationship between the two; generally speaking, "gNodeB" can be considered as device 1, and "UE" can be considered as device 2, and the two devices communicate with each other through a certain radio channel. And in the following, a transmitter or a receiver may be a gNB or a UE.

[0053] Certain aspects of the present disclosure and its embodiments may provide solutions to the above-mentioned problems. For example, according to certain embodiments, a notification process is provided so that AAnF can be notified of K AKMA is no longer valid and / or has been replaced. AAnF can then choose to delete K AKMA and / or notify (one or more) AKMA AFs. According to certain embodiments, methods, systems, and techniques are proposed to enable the UDM to track the AUSF ID / K generated from the primary authentication process. AKMA Once a new AUSF ID or K AKMA The ID is stored and the UDM provides notification services. In a specific embodiment, for example, the AAnF may receive the notification and determine the K obtained from the AUSF. AKMA In another specific embodiment, the AAnF may subscribe to the notification service provided by the UDM for the purpose of determining whether the AAnF is still valid. AKMA When is it refreshed or no longer valid. The disclosure herein also relates to the interaction between AAnF and AF to indicate K AKMA Status updates, such as, for example, refresh and revocation. Therefore, according to some embodiments, any K can be provided between the AAnF and the AF. AKMA State updates (such as, for example, refresh and undo).

[0054] Notifications sent directly from UDM to AAnF

[0055] According to some embodiments, during the initial AKMA key request, the AAnF must contact the UDM so that it can choose to keep the latest valid K generated for a certain user. AKMA At that time, AAnF also subscribes in UDM to be notified of K AKMA When it is refreshed or no longer valid.

[0056] Figure 4 shows that K is mapped via UDM according to some embodiments AKMA In the embodiment shown, the signaling diagram includes the following steps:

[0057] 0. The UE operates with the Home Network (HN) for primary authentication. K AKMA and K AKMA An ID is generated and stored in the UE and the AUSF.

[0058] The AUSF calls the existing service operation Nudm_UEAuthentication_ResultConfirmation to notify the UDM about the authentication result, and stores the SUPI, authentication result, AUSF ID, serving network name, authentication type and timestamp information.

[0059] Does the AUSF need to also inform the UDM about the K generated during the primary authentication? AKMA The ID will depend on the K currently defined in 3GPP AKMA The structure of the ID and whether it contains enough information about the UE or keeps the latest K generated for the UE AUSF AUSF ID. However, this is not essential to the main concept of the present disclosure.

[0060] The UDM then stores all the information together.

[0061] Note that, for example, if K AKMA If generated outside of the main authentication process, the AUSF may also call a new service to store the data described above.

[0062] 1. UE initiates the application session establishment process with AF. The request includes K AKMA ID and may include sufficient information about the UE or maintain the latest K generated for the UE AUSF / K AKMA AUSF ID (may be embedded in K AKMA ID).

[0063] 2-5. AF selects and sends the retrieval K to the appropriate AAnF AF Request.

[0064] 6. The AAnF discovers and chooses to keep the latest K generated for the user via UDM via a new service operation (such as, for example, the Nudm_UEAuthentication_Status message) AUSF / K AKMA The AUSF instance of the key.

[0065] 7. According to certain embodiments, at this point, the AAnF may subscribe from the UDM via a new service operation to be notified about changes in the user's authentication status. For example, the AAnF may send a Nudm_UEAuth_ResultStatusSubscribe message to the UDM, the message including the UE identifier (SUPI) and / or K AKMA ID as input parameter(s).

[0066] The corresponding notification (in step 16) will indicate to the AAnF the previously established K AKMA A new K that has been replaced after a successful new authentication and has the latest timestamp AKMA ID is already stored in UDM, or K AKMA The AKMA key material has been removed after an unsuccessful authentication and the UDM determines to remove it.

[0067] Note that multiple instances of AAnF may be subscribed in UDM for the same UE.

[0068] 8. AAnF retrieves K from AUSF AKMA .

[0069] 9-11. AAnF generates K AF , and respond AF.

[0070] 12-13. According to some embodiments, upon successful retrieval of K from AAnF AF Afterwards, the present disclosure proposes that the AF may then subscribe via the service operation Naanf_AFKey_StatusSubscribe (possibly via an intermediate NF, such as NEF / NF service, such as Nnef_AFKey_StatusSubscribe) to be notified of the status of the key being passed to the AF. AKMA K referenced by ID AKMA Is it no longer valid.

[0071] AAnF can check whether it has subscribed to the authentication status from UDM. If not, AAnF subscribes from UDM as described in step 7.

[0072] 14. Establish an application session between the UE and the AF.

[0073] 15. The UE performs another primary authentication with the network. Note that the AUSF running this latter primary authentication may be different from the AUSF that performed the previous primary authentication. The AUSF informs the UDM about the result of the authentication process via the Nudm_UEAuthentication_ResultConfirmation service operation.

[0074] The present disclosure proposes an extension to the existing Nudm_UEAuthentication_ResultConfirmation operation so that the AUSF can report not only successful authentication events, but also unsuccessful authentication situations. In this case, if the result of the UE's latest primary authentication is unsuccessful, the Nudm_UEAuthentication_ResultConfirmation operation includes information about the AUSF ID running the authentication and the (old) K AKMA Information about the ID.

[0075] 16. The UDM sends a Nudm_UEAuthentication_ResultStatusNotify service operation to any AAnF instances previously subscribed in the UDM as in step 7. Note that the UDM may notify as many AAnFs as subscribed for the same UE.

[0076] 17a. If the result of the latest primary authentication of the UE is successful, the Nudm_UEAuthentication_StatusNotify operation includes the (new) AUSF ID, new timestamp information and optional K AKMA ID (if also received by UDM in step 15).

[0077] In this case, AAnF interprets the notification as the user's K AKMA has been refreshed and should not be based on previously stored K AKMA To generate additional K AF The AAnF obtains the new K from the AUSF indicated in the UDM in the Nudm_UEAUthentication_StatusNotify operation received in step 16. AKMA , to replace the old K stored locally by the user AKMA , and can be based on the new K AKMA and new refresh parameters to generate new K AF .

[0078] 17b. If the result of the most recent primary authentication of the UE is unsuccessful, the Nudm_UEAuthentication_StatusNotify operation includes an error indication, timestamp information and an optional KAKMA ID (if also received by the UDM in step 15). The UDM may also provide this type of authentication status update with an indication that the UE is not authenticated in other situations (eg, administrative deregistration of the UE).

[0079] In this case, AAnF can interpret the notification as the user's K AKMA No longer valid. AAnF can delete the K stored for the user AKMA .

[0080] AAnF uses new service operations (e.g. Naanf_AFKey_StatusNotify) to notify any AF instances previously subscribed in AAnF about the status of the Key, possibly via an intermediate NF (e.g. NEF). AKMA Status. Note that AAnF can notify multiple AFs.

[0081] If the result of the UE's most recent primary authentication was successful (as in step 17a), the Naanf_AFKey_StatusNotify operation includes the (old) Key AKMA ID status, (old) K AKMA ID and optionally a new K AKMA ID information and K AF (If also received by AAnF in step 17a).

[0082] If the result of the UE's most recent primary authentication was unsuccessful (as in step 17a), the Naanf_AFKey_StatusNotify operation includes the (old) K AKMA ID status, (old) K AKMA ID;

[0083] Based on the received (old) K AKMA ID status, AF can trigger K AF Refresh process or disconnection with UE.

[0084] Notification sent to AAnF via USF

[0085] According to certain embodiments, the AAnF receives notifications related to authentication updates indirectly from the UDM via the AUSF.

[0086] Figure 5 shows the K via AUSF according to some embodiments AKMA Signaling diagram of subscription of key status 60. Newly proposed points are marked in red.

[0087] In the illustrated embodiment, the signaling diagram comprises the following steps:

[0088] 0. The UE performs master authentication with the network.AKMA and K AKMA An ID is generated and stored in the UE and the AUSF.

[0089] AUSF calls the existing service operation Nudm_UEAuthentication_ResultConfirmation to notify UDM about the authentication result and store SUPI, result, AUSF ID, serving network name, authentication type, timestamp information. Additionally, AUSF may also provide the K generated during the primary authentication. AKMA ID. UDM then stores all the information together.

[0090] Note that, for example, if K AKMA If generated outside of the main authentication process, the AUSF may also call a new service to store the data described above.

[0091] The AUSF may then use the service operation Nudm_UEAuth_ResultStatusSubscribe (including the UE identifier, K AKMA ID) to book with UDM to be notified of K AKMA K referenced by ID AKMA Is it no longer valid? For example, in K AKMA The new K that is replaced after a successful new authentication and has the latest timestamp AKMA In the case where the ID is stored in the UDM, or in the K AKMA In the event that it is removed after an unsuccessful authentication and the UDM determines to remove the AKMA key material.

[0092] Note that the AUSF may implicitly place this subscription into the message to store the data described above, for example piggybacking within the Nudm_UEAuthentication_ResultConfirmation service operation.

[0093] 1. The UE initiates the application session establishment process with the AF.

[0094] 2-5. AF selects and sends search K to AAnF AF Note that the UE identifier may also be included in the message.

[0095] 6-7. AAnF discovers and selects AUSF, and retrieves K from AUSF AKMA Note that the UE identifier may be included as an output of this process (if not received in the previous step).

[0096] 8. After successfully retrieving K from AUSF AKMAAfterwards, AAnF can subscribe to AUSF via the service operation Nausf_UEAuthAKMAKey_Status_Subscribe to be notified of the status of the AUSF through K AKMA K referenced by ID AKMA Is it no longer valid.

[0097] AUSF can check whether it is already K AKMA Status is subscribed to UDM. If not, the AUSF subscribes to UDM as described in step 0.

[0098] 9-11. AAnF generates K AF , and respond AF.

[0099] 12-13. After successfully retrieving K from AAnF AF Afterwards, the AF then subscribes via the service operation Naanf_AFKey_StatusSubscribe (possibly via an intermediate NF, such as NEF / NF service, such as Nnef_AFKey_StatusSubscribe) to be notified of the status of the key AKMA K referenced by ID AKMA Is it no longer valid.

[0100] AAnF can check whether it is already K AKMA Status is subscribed to AUSF. If not, AAnF subscribes from AUSF as described in step 8.

[0101] 14. Establish an application session between the UE and the AF.

[0102] 15. The UE performs another primary authentication with the network.

[0103] If the authentication result is successful, UDM obtains the ID with the new K from any AUSF instance via Nudm_UEAuthentication_ResultConfirmation. AKMA The UDM checks the received K AKMA K referenced by ID AKMA It is the latest K AKMA (e.g. based on timestamp comparison), and decides to notify the AUSF instance of K based on previously received subscriptions AKMA Change of state.

[0104] If the authentication result is unsuccessful, the UDM obtains a new result with result indication and timestamp information from any AUSF instance via Nudm_UEAuthentication_ResultConfirmation. The UDM determines the stored K AKMA is no longer valid and based on a previously received booking the decision to notify AUSF of K AKMA Change of state.

[0105] 16. UDM sends AUSF a message with (old) K AKMA Notification of ID status ((old)K AKMA ID is included in the message) to indicate K AKMA No longer valid.

[0106] 17. AUSF sends a request with the (old) K to the AAnF instance based on the previously received reservation. AKMA Notification of ID status ((old)K AKMA ID is included in the message) to indicate K AKMA No longer valid. Note that an AUSF may notify multiple AAnFs.

[0107] 17a. If the received (old) K AKMA Status indicator (old) K AKMA The ID is refreshed and replaced by the new K AKMA Replace, then AAnF can be repeated K AKMA The fetch process replaces the old K stored locally by the user. AKMA , and can be based on, for example, the new K as in steps 6-9 AKMA and a new freshness parameter to generate a new K AF .

[0108] Please note that if the new K AKMA ID is received via steps 16-17, then AAnF can use the new K AKMA ID is used as input to perform K AKMA Retrieval process; if the UE identifier is received from step 5 or as previously K AKMA The output of the retrieval process, AAnF can use the UE identifier as input to perform K AKMA Retrieval process;

[0109] If AAnF receives the instruction (old) K AKMA Invalid and no new K AKMA The generated (old) K AKMA ID status, AAnF can delete the K stored for the user AKMA .

[0110] 18-19. AAnF uses new service operations (e.g. Naanf_AFKey_StatusNotify) to notify any AF instances previously subscribed in AAnF about the Key status, possibly via an intermediate NF (e.g. NEF). AKMA Status. Note that AAnF can notify multiple AFs.

[0111] If the (old) KAKMA is refreshed and replaced by the new K AKMA Replace (as in step 17a), then the Naanf_AFKey_StatusNotify operation includes the (old) K AKMA ID status, (old) K AKMA ID and, optionally, a new K AKMA ID information and K AF (If also generated by AAnF in step 17a).

[0112] If (old) K AKMA Invalid and no new K AKMA is generated (as in step 17a), the Naanf_AFKey_StatusNotify operation includes the (old) K AKMA ID status, (old) K AKMA ID;

[0113] Based on the received (old) K AKMA ID status, AF can trigger K AF Refresh process or disconnection with UE.

[0114] Figure 6 1 shows a wireless network according to some embodiments. Although the subject matter described herein can be implemented in any suitable type of system using any suitable components, the embodiments disclosed herein are relative to wireless networks (such as Figure 6 For simplicity, Figure 6 The wireless network of FIG. 1 only shows network 106, network nodes 160 and 160b, and wireless devices 110, 110b, and 110c. In practice, the wireless network may further include any additional elements suitable for supporting communications between wireless devices or between a wireless device and another communication device (such as a landline phone, a service provider, or any other network node or terminal device). Of the components shown, network node 160 and wireless device 110 are shown in additional detail. The wireless network may provide communication and other types of services to one or more wireless devices to facilitate access and / or use of services provided by or via the wireless network by the wireless device.

[0115] A wireless network may include and / or interface with any type of communication, telecommunication, data, cellular and / or radio network or other similar type of system. In some embodiments, a wireless network may be configured to operate according to a particular standard or other type of predefined rules or procedures. Thus, particular embodiments of a wireless network may implement: communication standards such as Global System for Mobile Communications (GSM), Universal Mobile Telecommunications System (UMTS), Long Term Evolution (LTE), and / or other appropriate 2G, 3G, 4G, or 5G standards; wireless local area network (WLAN) standards such as IEEE 802.11 standards; and / or any other appropriate wireless communication standards such as Worldwide Interoperability for Microwave Access (WiMax), Bluetooth, Z-Wave, and / or ZigBee standards.

[0116] The network 106 may include one or more backhaul networks, core networks, IP networks, public switched telephone networks (PSTN), packet data networks, optical networks, wide area networks (WANs), local area networks (LANs), wireless local area networks (WLANs), wired networks, wireless networks, metropolitan area networks, and other networks to enable communications between devices.

[0117] The network node 160 and the wireless device 110 include various components described in more detail below. These components work together to provide network node and / or wireless device functionality, such as providing wireless connectivity in a wireless network. In various embodiments, the wireless network may include any number of wired or wireless networks, network nodes, base stations, controllers, wireless devices, relay stations, and / or any other components or systems that may facilitate or participate in the communication of data and / or signals (whether via a wired or wireless connection).

[0118] Figure 7An example network node 160 according to certain embodiments is shown. As used herein, a "network node" refers to a device that is capable, configured, arranged and / or operable to communicate directly or indirectly with a wireless device and / or with other network nodes or devices in a wireless network to enable and / or provide wireless access to the wireless device and / or perform other functions (e.g., management) in the wireless network. Examples of network nodes include, but are not limited to, access points (APs) (e.g., radio access points), base stations (BSs) (e.g., radio base stations, Node Bs, evolved Node Bs (eNBs), and new radio (NR) NodeBs (gNBs)). Base stations may be classified based on the amount of coverage they provide (or in other words, their transmit power level), and may then be referred to as femto base stations, pico base stations, micro base stations, or macro base stations. A base station may be a relay node or a relay donor node that controls a relay. A network node may also include one or more (or all) parts of a distributed radio base station, such as a centralized digital unit and / or a remote radio unit (RRU), sometimes referred to as a remote radio head (RRH). Such remote radio units may or may not be integrated with antennas as antenna-integrated radios. Parts of distributed radio base stations may also be referred to as nodes in a distributed antenna system (DAS). Still other examples of network nodes include multi-standard radio (MSR) equipment (such as MSR BS), network controllers (such as radio network controllers (RNC) or base station controllers (BSC)), base transceiver stations (BTS), transmission points, transmission nodes, multi-cell / multicast coordination entities (MCE), core network nodes (such as MSC, MME), O&M nodes, OSS nodes, SON nodes, positioning nodes (such as E-SMLC) and / or MDT. As another example, a network node may be a virtual network node as described in more detail below. But more generally, a network node may represent any suitable device (or device group) that is capable, configured, arranged and / or operable to enable and / or provide access to a wireless network for a wireless device or provide a certain service to a wireless device that has accessed a wireless network.

[0119] Figure 7 In FIG. 1 , the network node 160 includes a processing circuit 170, a device readable medium 180, an interface 190, an auxiliary device 184, a power supply 186, a power circuit 187, and an antenna 162. Figure 7The network node 160 shown in the example wireless network of the present invention may represent a device including the shown combination of hardware components, but other embodiments may include network nodes with different combinations of components. It is to be understood that the network node includes any suitable combination of hardware and / or software required to perform the tasks, features, functions, and methods disclosed herein. In addition, although the components of the network node 160 are shown as a single box located within a larger box or nested within multiple boxes, in reality, the network node may include multiple different physical components that make up a single shown component (for example, the device readable medium 180 may include multiple independent hard drives and multiple RAM modules).

[0120] Similarly, the network node 160 may be composed of multiple physically independent components (e.g., NodeB components and RNC components or BTS components and BSC components, etc.), each of which may have its own corresponding components. In some cases where the network node 160 includes multiple independent components (e.g., BTS and BSC components), one or more of the independent components may be shared between several network nodes. For example, a single RNC may control multiple NodeBs. In this case, each unique NodeB and RNC pair may be considered a single independent network node in some cases. In some embodiments, the network node 160 may be configured to support multiple radio access technologies (RATs). In such embodiments, some components may be repeated (e.g., independent device readable media 180 of different RATs), and some components may be reused (e.g., the same antenna 162 may be shared by RATs). The network node 160 may also include multiple sets of various illustrated components of different wireless technologies (such as, for example, GSM, wideband code division multiple access (WCDMA), LTE, NR, WiFi, or Bluetooth wireless technologies) integrated into the network node 160. These wireless technologies may be integrated into the same or different chips or chipsets and other components within network node 160 .

[0121] The processing circuit 170 is configured to perform any determination, calculation, or similar operation (e.g., certain obtaining operations) described herein as being provided by the network node. Such operations performed by the processing circuit 170 may include processing information obtained by the processing circuit 170 by, for example, converting the obtained information to other information, comparing the obtained information or the converted information to information stored in the network node, and / or performing one or more operations based on the obtained information or the converted information, and making determinations as a result of the processing.

[0122] The processing circuit 170 may include one or more of a combination of a microprocessor, a controller, a microcontroller, a central processing unit, a digital signal processor, an application specific integrated circuit, a field programmable gate array, or any other suitable computing device, resource, or combination of hardware, software, and / or encoded logic operable to provide network node 160 functionality, alone or in conjunction with other network node 160 components, such as device readable medium 180. For example, the processing circuit 170 may execute instructions stored in the device readable medium 180 or in a memory within the processing circuit 170. Such functionality may include any of the wireless features, functions, or benefits that provide the various wireless features, functions, or benefits discussed herein. In some embodiments, the processing circuit 170 may include a system on a chip (SOC).

[0123] In some embodiments, processing circuitry 170 may include one or more of radio frequency (RF) transceiver circuitry 172 and baseband processing circuitry 174. In some embodiments, radio frequency (RF) transceiver circuitry 172 and baseband processing circuitry 174 may be on separate chips (or chipsets), boards, or units (such as a radio unit and a digital unit). In alternative embodiments, part or all of RF transceiver circuitry 172 and baseband processing circuitry 174 may be on the same chip or chipset, board, or unit.

[0124] In certain embodiments, some or all of the functionality described herein as being provided by a network node, base station, eNB, or other such network device may be performed by processing circuit 170 executing instructions stored on device-readable medium 180 or memory within processing circuit 170. In alternative embodiments, some or all of the functionality may be provided by processing circuit 170, such as in a hardwired manner, without executing instructions stored on an independent or discrete device-readable medium. In any of those embodiments, processing circuit 170 can be configured to perform the functionality, whether or not executing instructions stored on a device-readable storage medium. The benefits provided by such functionality are not limited to individual processing circuits 170 or other components of network node 160, but are enjoyed by network node 160 as a whole and / or by end users and wireless networks in general.

[0125] Device readable medium 180 may include any form of volatile or non-volatile computer readable memory, including, without limitation, permanent storage, solid-state memory, remotely mounted memory, magnetic media, optical media, random access memory (RAM), read-only memory (ROM), mass storage media (e.g., hard disk), removable storage media (e.g., flash drive, compact disk (CD), or digital video disk (DVD)), and / or any other volatile or non-volatile non-transitory device readable and / or computer executable storage device that stores information, data, and / or instructions that can be used by processing circuit 170. Device readable medium 180 may store any suitable instructions, data, or information, including computer programs, software, applications (including one or more of logic, rules, codes, tables, etc.), and / or other instructions (which can be executed by processing circuit 170 and utilized by network node 160). Device readable medium 180 may be used to store any calculations performed by processing circuit 170 and / or any data received via interface 190. In some embodiments, processing circuit 170 and device readable medium 180 may be considered integrated.

[0126] The interface 190 is used in wired or wireless communication of signaling and / or data between the network node 160, the network 106 and / or the wireless device 110. As shown, the interface 190 includes (one or more) ports / (one or more) terminals 194 to send and receive data to and from the network 106 through a wired connection, for example. The interface 190 also includes a radio front-end circuit 192, which can be coupled to the antenna 162 or to a portion of the antenna 162 in some embodiments. The radio front-end circuit 192 includes a filter 198 and an amplifier 196. The radio front-end circuit 192 can be connected to the antenna 162 and the processing circuit 170. The radio front-end circuit can be configured to adjust the signal transmitted between the antenna 162 and the processing circuit 170. The radio front-end circuit 192 can receive digital data, which is to be sent to other network nodes or wireless devices via a wireless connection. The radio front-end circuit 192 can use a combination of filters 198 and / or amplifiers 196 to convert the digital data into a radio signal with appropriate channel and bandwidth parameters. The radio signal can then be transmitted via the antenna 162. Similarly, when receiving data, antenna 162 may collect radio signals, which are then converted to digital data by radio front end circuitry 192. The digital data may be passed to processing circuitry 170. In other embodiments, the interface may include different components and / or different combinations of components.

[0127] In certain alternative embodiments, the network node 160 may not include a separate radio front end circuit 192, and the processing circuit 170 may include the radio front end circuit and may be connected to the antenna 162 without the separate radio front end circuit 192. Similarly, in some embodiments, all or part of the RF transceiver circuit 172 may be considered to be part of the interface 190. In still other embodiments, the interface 190 may include one or more ports or terminals 194, the radio front end circuit 192, and the RF transceiver circuit 172 as part of a radio unit (not shown), and the interface 190 may communicate with the baseband processing circuit 174, which is part of the digital unit (not shown).

[0128] Antenna 162 may include one or more antennas or antenna arrays configured to send and / or receive wireless signals. Antenna 162 may be coupled to radio front-end circuit 190 and may be any type of antenna capable of wirelessly transmitting and receiving data and / or signals. In some embodiments, antenna 162 may include one or more omnidirectional, sector or flat panel antennas operable to transmit / receive, for example, radio signals between 2 GHz and 66 GHz. Omnidirectional antennas may be used to transmit / receive radio signals in any direction, sector antennas may be used to transmit / receive radio signals from devices in a specific area, and flat panel antennas may be line-of-sight antennas used to transmit / receive radio signals in a relatively straight line. In some cases, the use of more than one antenna may be referred to as MIMO. In some embodiments, antenna 162 may be separated from network node 160 and may be connectable to network node 160 via an interface or port.

[0129] Antenna 162, interface 190 and / or processing circuit 170 may be configured to perform any receiving operation and / or certain obtaining operations described herein as being performed by a network node. Any information, data and / or signal may be received from a wireless device, another network node and / or any other network equipment. Similarly, antenna 162, interface 190 and / or processing circuit 170 may be configured to perform any transmitting operation described herein as being performed by a network node. Any information, data and / or signal may be transmitted to a wireless device, another network node and / or any other network equipment.

[0130] The power circuit 187 may include or be coupled to a power management circuit and is configured to supply power to the components of the network node 160 for performing the functionality described herein. The power circuit 187 may receive power from the power supply 186. The power supply 186 and / or the power circuit 187 may be configured to provide power to the various components of the network node 160 in a form suitable for the respective components (e.g., at the voltage and current level required by each respective component). The power supply 186 may be included in the power circuit 187 and / or the network node 160 or may be external to the power circuit and / or the network node. For example, the network node 160 may be connectable to an external power source (e.g., an electrical outlet) via an input circuit or interface (such as a cable), whereby the external power source supplies power to the power circuit 187. As another example, the power supply 186 may include a power source in the form of a battery or battery pack, which is connected to or integrated in the power circuit 187. If the external power source fails, the battery may provide backup power. Other types of power sources (such as photovoltaic devices) may also be used.

[0131] Alternative embodiments of network node 160 may include Figure 7 , which may be responsible for providing certain aspects of network node functionality, including any of the functionality described herein and / or any functionality required to support the subject matter described herein. For example, network node 160 may include a user interface device to allow input of information into network node 160 and output of information from network node 160. This may allow a user to perform diagnostics, maintenance, repair, and other management functions for network node 160.

[0132] Figure 8An example wireless device 110 is shown. According to certain embodiments. As used herein, a "wireless device" refers to a device that is capable of, configured to, arranged to, and / or operable to wirelessly communicate with a network node and / or other wireless devices. Unless otherwise specified, the term "wireless device" may be used interchangeably with user equipment (UE) herein. Wireless communication may involve the use of electromagnetic waves, radio waves, infrared waves, and / or other types of signals suitable for transmitting information over the air to transmit and / or receive wireless signals. In some embodiments, the wireless device may be configured to transmit and / or receive information without direct human interaction. For example, the wireless device may be designed to transmit information to the network based on a predetermined schedule, when triggered by an internal or external event, or in response to a request from the network. Examples of wireless devices include, but are not limited to, smartphones, mobile phones, cellular phones, voice over IP (VoIP) phones, wireless local loop phones, desktop computers, personal digital assistants (PDAs), wireless cameras, game consoles or devices, music storage devices, playback devices, wearable terminal devices, wireless endpoints, mobile stations, tablets, laptops, laptop embedded devices (LEEs), laptop mounted equipment (LMEs), smart devices, wireless customer premises equipment (CPEs), vehicle-mounted wireless terminal devices, etc. The wireless device may support device-to-device (D2D) communication, for example, by implementing the 3GPP standards for sidelink communication, vehicle-to-vehicle (V2V), vehicle-to-infrastructure (V2I), and vehicle-to-everything (V2X), and in this case may be referred to as a D2D communication device. As yet another specific example, in the context of the Internet of Things (IoT), the wireless device may represent a machine or another device that performs monitoring and / or measurement and transmits the results of such monitoring and / or measurement to another wireless device and / or a network node. The wireless device in this case may be a machine-to-machine (M2M) device, which may be referred to as an MTC device in the 3GPP context. As a specific example, the wireless device may be a UE that implements the 3GPP Narrowband Internet of Things (NB-IoT) standard. Specific examples of such machines or devices are sensors, metering devices (e.g., power meters), industrial machinery, or household or personal appliances (e.g., refrigerators, televisions, etc.), personal wearables (e.g., watches, fitness trackers, etc.). In other cases, the wireless device may represent a vehicle or other equipment that is capable of monitoring and / or reporting its operating status or other functions associated with its operation. The wireless device as described above may represent an endpoint of a wireless connection, in which case the device may be referred to as a wireless terminal. In addition, the wireless device as described above may be mobile, in which case it may be referred to as a mobile device or a mobile terminal.

[0133] As shown, the wireless device 110 includes an antenna 111, an interface 114, a processing circuit 120, a device-readable medium 130, a user interface device 132, an auxiliary device 134, a power supply 136, and a power circuit 137. The wireless device 110 may include multiple sets of one or more of the components shown for different wireless technologies supported by the wireless device 110, such as, for example, GSM, WCDMA, LTE, NR, WiFi, WiMAX, or Bluetooth wireless technologies, to name a few. These wireless technologies may be integrated into the same or different chips or chipsets as other components within the wireless device 110.

[0134] Antenna 111 may include one or more antennas or antenna arrays configured to send and / or receive wireless signals and is connected to interface 114. In some alternative embodiments, antenna 111 may be separated from wireless device 110 and may be connected to wireless device 110 via an interface or port. Antenna 111, interface 114 and / or processing circuit 120 may be configured to perform any receiving or transmitting operation described herein as being performed by a wireless device. Any information, data and / or signal may be received from a network node and / or another wireless device. In some embodiments, radio front end circuitry and / or antenna 111 may be considered an interface.

[0135] As shown, the interface 114 includes a radio front-end circuit 112 and an antenna 111. The radio front-end circuit 112 includes one or more filters 118 and an amplifier 116. The radio front-end circuit 114 is connected to the antenna 111 and the processing circuit 120, and is configured to adjust the signal transmitted between the antenna 111 and the processing circuit 120. The radio front-end circuit 112 may be coupled to the antenna 111 or may be a part of the antenna 111. In some embodiments, the wireless device 110 may not include an independent radio front-end circuit 112, and the processing circuit 120 may include the radio front-end circuit and may be connected to the antenna 111. Similarly, in some embodiments, part or all of the RF transceiver circuit 122 may be considered as part of the interface 114. The radio front-end circuit 112 may receive digital data, which is to be sent to other network nodes or wireless devices via a wireless connection. The radio front-end circuit 112 may use a combination of filters 118 and / or amplifiers 116 to convert the digital data into a radio signal with appropriate channel and bandwidth parameters. The radio signal may then be transmitted via the antenna 111. Similarly, when receiving data, antenna 111 may collect radio signals, which are then converted to digital data by radio front end circuit 112. The digital data may be passed to processing circuit 120. In other embodiments, the interface may include different components and / or different combinations of components.

[0136] The processing circuit 120 may include one or more combinations of a microprocessor, a controller, a microcontroller, a central processing unit, a digital signal processor, an application specific integrated circuit, a field programmable gate array, or any other suitable computing device, resource, or combination of hardware, software, and / or encoded logic operable to provide wireless device 110 functionality, either alone or in conjunction with other wireless device 110 components, such as device readable medium 130. Such functionality may include any of the wireless features or benefits that provide the various wireless features or benefits described herein. For example, the processing circuit 120 may execute instructions stored in the device readable medium 130 or in a memory within the processing circuit 120 to provide the functionality disclosed herein.

[0137] As shown, the processing circuit 120 includes one or more of an RF transceiver circuit 122, a baseband processing circuit 124, and an application processing circuit 126. In other embodiments, the processing circuit may include different components and / or different combinations of components. In certain embodiments, the processing circuit 120 of the wireless device 110 may include a SOC. In some embodiments, the RF transceiver circuit 122, the baseband processing circuit 124, and the application processing circuit 126 may be on a separate chip or a chip set. In an alternative embodiment, part or all of the baseband processing circuit 124 and the application processing circuit 126 may be combined into one chip or a chip set, and the RF transceiver circuit 122 may be on a separate chip or a chip set. In still other alternative embodiments, part or all of the RF transceiver circuit 122 and the baseband processing circuit 124 may be on the same chip or a chip set, and the application processing circuit 126 may be on a separate chip or a chip set. In still other alternative embodiments, part or all of RF transceiver circuit 122, baseband processing circuit 124, and application processing circuit 126 may be combined in the same chip or chip set. In some embodiments, RF transceiver circuit 122 may be part of interface 114. RF transceiver circuit 122 may condition RF signals for processing circuit 120.

[0138] In some embodiments, some or all of the functionality described herein as being performed by the wireless device may be provided by the processing circuit 120 executing instructions stored on a device-readable medium 130, which in some embodiments may be a computer-readable storage medium. In alternative embodiments, some or all of the functionality may be provided by the processing circuit 120, such as in a hardwired manner, without executing instructions stored on an independent or discrete device-readable storage medium. In any of those specific embodiments, the processing circuit 120 can be configured to perform the functionality, whether or not executing instructions stored on a device-readable storage medium. The benefits provided by such functionality are not limited to the processing circuit 120 alone or other components of the wireless device 110, but are enjoyed by the wireless device 110 as a whole and / or by end users and wireless networks in general.

[0139] The processing circuit 120 may be configured to perform any determination, calculation, or similar operation (e.g., certain obtaining operations) described herein as being performed by the wireless device. Such operations as performed by the processing circuit 120 may include processing information obtained by the processing circuit 120 by, for example, converting the obtained information to other information, comparing the obtained information or the converted information to information stored by the wireless device 110, and / or performing one or more operations based on the obtained information or the converted information, and making determinations as a result of the processing.

[0140] Device readable medium 130 may be operable to store computer programs, software, applications (including one or more of logic, rules, code, tables, etc.), and / or other instructions (which are executable by processing circuit 120). Device readable medium 130 may include computer memory (e.g., random access memory (RAM) or read-only memory (ROM)), mass storage media (e.g., hard disk), removable storage media (e.g., compact disk (CD) or digital video disk (DVD)), and / or any other volatile or non-volatile non-transitory device readable and / or computer executable memory device (which stores information, data, and / or instructions that can be used by processing circuit 120). In some embodiments, processing circuit 120 and device readable medium 130 may be considered integrated.

[0141] The user interface device 132 may provide a component that allows a human user to interact with the wireless device 110. This interaction may have many forms, such as visual, auditory, tactile, etc. The user interface device 132 may be operable to generate output to the user and allow the user to provide input to the wireless device 110. The type of interaction may vary depending on the type of user interface device 132 installed in the wireless device 110. For example, if the wireless device 110 is a smart phone, the interaction may be performed via a touch screen; if the wireless device 110 is a smart meter, the interaction may be performed through a screen that provides usage (e.g., the number of gallons used) or a speaker that provides an audible alarm (e.g., smoke is detected). The user interface device 132 may include input interfaces, devices, and circuits and output interfaces, devices, and circuits. The user interface device 132 is configured to allow input of information into the wireless device 110 and is connected to the processing circuit 120 to allow the processing circuit 120 to process the input information. The user interface device 132 may include, for example, a microphone, a proximity or another sensor, a key / button, a touch display, one or more cameras, a USB port, or other input circuits. The user interface device 132 is also configured to allow output of information from the wireless device 110, and to allow the processing circuit 120 to output information from the wireless device 110. The user interface device 132 may include, for example, a speaker, a display, a vibration circuit, a USB port, a headphone interface, or other output circuits. Using one or more input and output interfaces, devices, and circuits of the user interface device 132, the wireless device 110 can communicate with an end user and / or a wireless network, and allow them to benefit from the functionality described herein.

[0142] The auxiliary device 134 is operable to provide more specific functionality that may not generally be performed by wireless devices. This may include specialized sensors for taking measurements for various purposes, interfaces for additional types of communications (such as wired communications, etc.). The inclusion and types of components of the auxiliary device 134 may vary depending on the embodiment and / or situation.

[0143] The power source 136 may take the form of a battery or battery pack in some embodiments. Other types of power sources such as an external power source (e.g., an electrical outlet), a photovoltaic device, or a power battery may also be used. The wireless device 110 may further include a power circuit 137 for delivering power from the power source 136 to various components of the wireless device 110 that require power from the power source 136 to perform any functionality described or shown herein. The power circuit 137 may include a power management circuit in some embodiments. In addition or alternatively, the power circuit 137 may be operable to receive power from an external power source; in this case, the wireless device 110 may be connectable to an external power source (such as an electrical outlet) via an input circuit or interface (such as a power cable). The power circuit 137 may also be operable to deliver power from the external power source to the power source 136 in some embodiments. This may be used, for example, for charging the power source 136. The power circuit 137 may perform any formatting, conversion, or other modification of the power from the power source 136 to make the power suitable for the corresponding components of the wireless device 110 to which the power is supplied.

[0144] Fig. 9 An embodiment of a UE according to the various aspects described herein is shown. As used herein, a "user equipment" or "UE" may not necessarily have a user in the sense of a human user who owns and / or operates the associated device. Instead, a UE may represent a device that is intended to be sold to or operated by a human user, but may not be, or may not initially be, associated with a specific human user (e.g., a smart sprinkler controller). Alternatively, a UE may represent a device that is not intended to be sold to or operated by an end user, but may be associated with a user or operated for the benefit of a user (e.g., a smart power meter). UE 200 may be any UE confirmed by the 3rd Generation Partnership Project (3GPP), including a NB-IoT UE, a Machine Type Communication (MTC) UE, and / or an enhanced MTC (eMTC) UE. As Fig. 9 As shown in , UE 200 is an example of a wireless device configured to communicate according to one or more communication standards promulgated by the Third Generation Partnership Project (3GPP), such as 3GPP's GSM, UMTS, LTE and / or 5G standards. As previously mentioned, the terms "wireless device" and "UE" may be used interchangeably. Accordingly, although Fig. 9 Although it is a UE, the components described herein are also applicable to a wireless device, and vice versa.

[0145] Fig. 9In the embodiment, UE 200 includes: processing circuit 201, operatively coupled to input / output interface 205; radio frequency (RF) interface 209; network connection interface 211; memory 215, including random access memory (RAM) 217, read-only memory (ROM) 219 and storage medium 221 or the like; communication subsystem 231; power supply 233; and / or any other components or any combination thereof. Storage medium 221 includes operating system 223, application 225 and data 227. In other embodiments, storage medium 221 may include other similar types of information. Some UEs may utilize Fig. 9 All of the components shown may be used, or only a subset of the components may be used. The level of integration between components may vary from UE to UE. In addition, some UEs may include multiple instances of components, such as multiple processors, memories, transceivers, transmitters, receivers, etc.

[0146] Fig. 9 In the embodiment of the present invention, the processing circuit 201 can be configured to process computer instructions and data. The processing circuit 201 can be configured to implement: any sequential state machine, operable to execute machine instructions stored in a memory as a machine-readable computer program, such as one or more hardware-implemented state machines (e.g., in discrete logic, FPGA, ASIC, etc.); programmable logic together with appropriate firmware; one or more general-purpose processors such as microprocessors or digital signal processors (DSPs) that store programs together with appropriate software; or any combination of the above. For example, the processing circuit 201 may include two central processing units (CPUs). The data may be information in a form suitable for use by a computer.

[0147] In the illustrated embodiment, the input / output interface 205 may be configured to provide a communication interface to an input device, an output device, or an input and output device. The UE 200 may be configured to use an output device via the input / output interface 205. The output device may use the same type of interface port as the input device. For example, a USB port may be used to provide input to the UE 200 and output from the UE 200. The output device may be a speaker, a sound card, a video card, a display, a monitor, a printer, an actuator, a transmitter, a smart card, another output device, or any combination thereof. The UE 200 may be configured to use an input device via the input / output interface 205 to allow a user to capture information entering the UE 200. The input device may include a touch or presence sensitive display, a camera (e.g., a digital camera, a digital video camera, a web camera, etc.), a microphone, a sensor, a mouse, a trackball, a directional pad, a trackpad, a scroll wheel, a smart card, and the like. The presence sensitive display may include a capacitive or resistive touch sensor to sense input from the user. The sensor can be, for example, an accelerometer, a gyroscope, a tilt sensor, a force sensor, a magnetometer, an optical sensor, a proximity sensor, another similar sensor, or any combination thereof. For example, the input device can be an accelerometer, a magnetometer, a digital camera, a microphone, and an optical sensor.

[0148] Fig. 9 In the embodiment of the present invention, the RF interface 209 can be configured to provide a communication interface to RF components (such as transmitters, receivers, and antennas). The network connection interface 211 can be configured to provide a communication interface to the network 243a. The network 243a can include a wired and / or wireless network, such as a local area network (LAN), a wide area network (WAN), a computer network, a wireless network, a telecommunications network, another similar network, or any combination thereof. For example, the network 243a can include a Wi-Fi network. The network connection interface 211 can be configured to include a receiver and a transmitter interface, which is used to communicate with one or more other devices through a communication network according to one or more communication protocols (such as Ethernet, TCP / IP, SONET, ATM, or the like). The network connection interface 211 can implement receiver and transmitter functionality suitable for communication network links (e.g., optical, electrical, and the like). The transmitter and receiver functions can share circuit components, software, or firmware, or alternatively can be implemented separately.

[0149] RAM 217 may be configured to interface with processing circuit 201 via bus 202 to provide storage or caching of data or computer instructions during execution of software programs (such as operating systems, applications, and device drivers). ROM 219 may be configured to provide computer instructions or data to processing circuit 201. For example, ROM 219 may be configured to store unchanged low-level system code or data for basic system functions, such as basic input and output (I / O), booting, or receiving keystrokes from a keyboard, which are stored in non-volatile memory. Storage medium 221 may be configured to include memory, such as RAM, ROM, programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), magnetic disk, optical disk, floppy disk, hard disk, removable cassette, or flash drive. In one example, storage medium 221 may be configured to include operating system 223, application 225 (such as a web browser application, a widget or gadget engine, or another application), and data file 227. Storage medium 221 may store any of a wide variety of operating systems or combinations of operating systems for use by UE 200 .

[0150] The storage medium 221 may be configured to include a plurality of physical drive units, such as a redundant array of independent disks (RAID), a floppy disk drive, a flash memory, a USB flash drive, an external hard drive, a thumb drive, a pen drive, a key drive, a high-density digital versatile disk (HD-DVD) optical drive, an internal hard drive, a Blu-ray optical drive, a holographic digital data storage (HDDS) optical drive, an external small-scale dual in-line memory module (DIMM), a synchronous dynamic random access memory (SDRAM), an external micro DIMM SDRAM, a smart card memory (such as a subscriber identity module or a removable user identity (SIM / RUIM) module, other memory, or any combination thereof. The storage medium 221 may allow the UE 200 to access computer executable instructions, applications, or the like stored on a transient or non-transitory memory medium to offload data or upload data. An article of manufacture (such as an article of manufacture using a communication system) may be tangibly implemented in the storage medium 221, which may include a device-readable medium.

[0151] Fig. 9In the embodiment, the processing circuit 201 may be configured to communicate with the network 243b using the communication subsystem 231. The network 243a and the network 243b may be one or more identical networks or one or more different networks. The communication subsystem 231 may be configured to include one or more transceivers for communicating with the network 243b. For example, the communication subsystem 231 may be configured to include one or more transceivers for communicating with one or more remote transceivers of another device (such as another wireless device, UE or base station of a radio access network (RAN)) capable of wireless communication according to one or more communication protocols (such as IEEE 802.2, CDMA, WCDMA, GSM, LTE, Universal Terrestrial Radio Access Network (UTRAN), WiMax or the like). Each transceiver may include a transmitter 233 and / or a receiver 235 to respectively implement the transmitter or receiver functionality (such as frequency allocation and the like) suitable for the RAN link. Further, the transmitter 233 and the receiver 235 of each transceiver may share circuit components, software or firmware, or alternatively may be implemented separately.

[0152] In the illustrated embodiment, the communication functions of the communication subsystem 231 may include data communication, voice communication, multimedia communication, short-range communication (such as Bluetooth, near field communication), location-based communication (such as using a global positioning system (GPS) to determine location), another similar communication function, or any combination thereof. For example, the communication subsystem 231 may include cellular communication, Wi-Fi communication, Bluetooth communication, and GPS communication. The network 243b may include a wired and / or wireless network, such as a local area network (LAN), a wide area network (WAN), a computer network, a wireless network, a telecommunications network, another similar network, or any combination thereof. For example, the network 243b may be a cellular network, a Wi-Fi network, and / or a near field network. The power supply 213 may be configured to provide alternating current (AC) or direct current (DC) power to the components of the UE 200.

[0153] The features, benefits and / or functions described herein may be implemented in one of the components of the UE 200, or may be divided across multiple components of the UE 200. In addition, the features, benefits and / or functions described herein may be implemented in any combination of hardware, software or firmware. In one example, the communication subsystem 231 may be configured to include any of the components described herein. In addition, the processing circuit 201 may be configured to communicate with any of such components via the bus 202. In another example, any of such components may be represented by program instructions stored in a memory, which perform corresponding functions described herein when executed by the processing circuit 201. In another example, the functionality of any of such components may be divided between the processing circuit 201 and the communication subsystem 231. In another example, the non-computationally intensive functions of any of such components may be implemented in software or firmware, while the computationally intensive functions may be implemented in hardware.

[0154] Fig.10 300 is a schematic block diagram showing a virtualized environment, wherein the functions implemented by some embodiments may be virtualized. In this context, virtualization means creating a virtual version of a device or apparatus, which may include virtualized hardware platforms, storage devices, and networking resources. As used herein, "virtualization" can be applied to a node (e.g., a virtualized base station or a virtualized radio access node) or to an apparatus (e.g., a UE, a wireless device, or any other type of communication device) or a component thereof, and relates to an implementation in which at least a portion of the functionality is implemented as one or more virtual components (e.g., via one or more applications, components, functions, virtual machines, or containers executed on one or more physical processing nodes in one or more networks).

[0155] In some embodiments, some or all of the functionality described herein may be implemented as virtual components executed by one or more virtual machines implemented in one or more virtual environments 300 hosted by one or more hardware nodes of hardware nodes 330. Furthermore, in embodiments where the virtual nodes are not radio access nodes or do not require radio connectivity (e.g., core network nodes), the network nodes may be fully virtualized.

[0156] Functionality may be implemented by one or more applications 320 (which may alternatively be referred to as software instances, virtual appliances, network functions, virtual nodes, virtual network functions, etc.) that are operable to implement some of the features, functions, and / or benefits of some of the embodiments disclosed herein. Applications 320 run in a virtualized environment 300 that provides hardware 330 including processing circuitry 360 and memory 390. Memory 390 contains instructions 395 executable by processing circuitry 360, whereby applications 320 are operable to provide one or more of the features, benefits, and / or functionality disclosed herein.

[0157] The virtualized environment 300 includes a general or special purpose network hardware device 330, which includes a collection of one or more processors or processing circuits 360, which may be commercial off-the-shelf (COTS) processors, dedicated application-specific integrated circuits (ASICs), or any other type of processing circuit (including digital or analog hardware components or special purpose processors). Each hardware device may include a memory 390-1, which may be a non-persistent memory for temporarily storing instructions 395 or software executed by the processing circuit 360. Each hardware device may include one or more network interface controllers (NICs) 370 (also known as network interface cards), which include a physical network interface 380. Each hardware device may also include a non-transitory, permanent machine-readable storage medium 390-2, in which the software 395 and / or instructions executable by the processing circuit 360 are stored. The software 395 may include any type of software, including software for instantiating one or more virtualization layers 350 (also known as hypervisors), software for executing the virtual machine 340, and software that allows it to perform the functions, features, and / or benefits described with respect to some embodiments described herein.

[0158] The virtual machine 340 includes virtual processing, virtual memory, virtual networking or interfaces, and virtual storage devices, and can be run by a corresponding virtualization layer 350 or hypervisor. Different embodiments of instances of the virtual appliance 320 can be implemented on one or more of the virtual machines 340, and the implementation can be performed in different ways.

[0159] During operation, processing circuitry 360 executes software 395 to instantiate a hypervisor or virtualization layer 350, which may sometimes be referred to as a virtual machine monitor (VMM). Virtualization layer 350 may provide a virtual operating platform that appears to virtual machines 340 as networked hardware.

[0160] like Fig.10As shown, hardware 330 may be an independent network node with common or specific components. Hardware 330 may include antenna 3225, and some functions may be implemented via virtualization. Alternatively, hardware 330 may be part of a larger cluster of hardware (e.g., such as in a data center or customer premises equipment (CPE)), where many hardware nodes work together and are managed via management and orchestration (MANO) 3100, which also oversees the lifecycle management of application 320.

[0161] Virtualization of hardware is referred to in some contexts as network function virtualization (NFV). NFV can be used to consolidate many network equipment types onto industry-standard high-volume server hardware, physical switches, and physical storage devices, which can be located in data centers and customer premises equipment.

[0162] In the context of NFV, virtual machines 340 may be software implementations of physical machines that run programs as if they were executed on a physical, non-virtualized machine. Each of virtual machines 340 and the portion of hardware 330 that executes that virtual machine (if it is hardware dedicated to that virtual machine and / or hardware shared by that virtual machine and other virtual machines of virtual machines 340) form an independent virtual network element (VNE).

[0163] Still in the context of NFV, a virtual network function (VNF) is responsible for handling specific network functions running in one or more virtual machines 340 on top of the hardware networking infrastructure 330 and corresponds to Fig.10 Application 320.

[0164] In some embodiments, one or more radio units 3200, each including one or more transmitters 3220 and one or more receivers 3210, may be coupled to one or more antennas 3225. The radio units 3200 may communicate directly with the hardware nodes 330 via one or more appropriate network interfaces, and may be used in conjunction with virtual components to provide radio capabilities for virtual nodes (such as radio access nodes or base stations).

[0165] In some embodiments, some signaling can be accomplished by using a control system 3230 , which may alternatively be used for communications between the hardware node 330 and the radio unit 3200 .

[0166] Fig.11 A telecommunications network is shown connected to a host computer via an intermediary network in accordance with some embodiments.

[0167] Reference Fig.11According to an embodiment, a communication system includes a telecommunication network 410 (such as a 3GPP type cellular network), which includes an access network 411 (such as a radio access network) and a core network 414. The access network 411 includes a plurality of base stations 412a, 412b, 412c, such as NBs, eNBs, gNBs or other types of wireless access points, each of which defines a corresponding coverage area 413a, 413b, 413c. Each base station 412a, 412b, 412c is connectable to the core network 414 via a wired or wireless connection 415. A first UE 491 located in the coverage area 413c is configured to be wirelessly connected to the corresponding base station 412c or to be paged by the base station 412c. A second UE 492 in the coverage area 413a is wirelessly connectable to the corresponding base station 412a. Although multiple UEs 491, 492 are shown in this example, the disclosed embodiments are equally applicable to situations where a single UE is located in the coverage area or where a single UE is connected to the corresponding base station 412.

[0168] The telecommunications network 410 itself is connected to a host computer 430, which may be implemented in hardware and / or software of a standalone server, a cloud-implemented server, a distributed server, or as a processing resource in a server farm. The host computer 430 may be under the ownership or control of a service provider, or may be operated by or on behalf of a service provider. Connections 421 and 422 between the telecommunications network 410 and the host computer 430 may extend directly from the core network 414 to the host computer 430, or may be made via an optional intermediate network 420. The intermediate network 420 may be one of a public, private, or managed network, or a combination of more than one; the intermediate network 420 (if any) may be a backbone network or the Internet; in particular, the intermediate network 420 may include two or more sub-networks (not shown).

[0169] Fig.11The communication system as a whole enables connectivity between the connected UEs 491, 492 and the host computer 430. The connectivity may be described as an over-the-top (OTT) connection 450. The host computer 430 and the connected UEs 491, 492 are configured to communicate data and / or signaling via the OTT connection 450 using the access network 411, the core network 414, any intermediate networks 420, and other possible infrastructure (not shown) as intermediaries. The OTT connection 450 may be transparent in the sense that the OTT connection 450 is not aware of the routing of uplink and downlink communications through the participating communication devices therein. For example, the base station 412 may not or need not be informed of the past routing of incoming downlink communications with data originating from the host computer 430 to be forwarded (e.g., switched) to the connected UE 491. Similarly, the base station 412 does not need to know the future routing of outgoing uplink communications originating from the UE 491 to the host computer 430.

[0170] Fig.12 A host computer is shown communicating with a user device via a base station over a partially wireless connection according to some embodiments.

[0171] Now refer to Fig.12 5. The example implementation of the UE, base station and host computer described in the above paragraphs according to one embodiment is described. In the communication system 500, the host computer 510 includes hardware 515, the hardware including a communication interface 516, the communication interface configured to establish and maintain a wired or wireless connection with the interface of different communication devices of the communication system 500. The host computer 510 further includes a processing circuit 518, which may have storage and / or processing capabilities. In particular, the processing circuit 518 may include one or more programmable processors, application-specific integrated circuits, field programmable gate arrays, or a combination of these devices (not shown) suitable for executing instructions. The host computer 510 further includes software 511, which is stored in the host computer 510 or accessible to the host computer 510 and executable by the processing circuit 518. The software 511 includes a host application 512. The host application 512 may be operable to provide services to remote users (such as UE 530 connected via an OTT connection 550 terminated at the UE 530 and the host computer 510). In providing services to remote users, the host application 512 may provide user data transmitted using the OTT connection 550 .

[0172] The communication system 500 further comprises a base station 520, which is provided in the telecommunication system and comprises hardware 525 enabling it to communicate with the host computer 510 and with the UE 530. The hardware 525 may comprise: a communication interface 526 for establishing and maintaining a wired or wireless connection to the interface of different communication devices of the communication system 500; and a radio interface 527 for establishing and maintaining at least a wireless connection 570 with the UE 530, which is located in the coverage area ( Fig.12 The communication interface 526 may be configured to facilitate a connection 560 to the host computer 510. The connection 560 may be direct, or it may pass through a core network ( Fig.12 520) and / or through one or more intermediate networks external to the telecommunications system. In the illustrated embodiment, the hardware 525 of the base station 520 further includes a processing circuit 528, which may include one or more programmable processors, application specific integrated circuits, field programmable gate arrays, or a combination of these devices (not shown) suitable for executing instructions. The base station 520 further has software 521, which is stored internally or accessible via an external connection.

[0173] The communication system 500 further includes the UE 530 already mentioned. Its hardware 535 may include a radio interface 537, which is configured to establish and maintain a wireless connection 570 with a base station serving the coverage area where the UE 530 is currently located. The hardware 535 of the UE 530 further includes a processing circuit 538, which may include one or more programmable processors, application-specific integrated circuits, field programmable gate arrays, or a combination of these devices (not shown) suitable for executing instructions. The UE 530 further includes software 531, which is stored in the UE 530 or is accessible to the UE 530 and is executable by the processing circuit 538. The software 531 includes a client application 532. The client application 532 may be operable to provide services to human or non-human users via the UE 530 through the support of the host computer 510. In the host computer 510, the execution of the host application 512 can communicate with the execution of the client application 532 via the OTT connection 550 terminated between the UE 530 and the host computer 510. When providing services to users, client application 532 may receive request data from host application 512 and provide user data in response to the request data. OTT connection 550 may communicate the request data and the user data. Client application 532 may interact with the user to generate the user data it provides.

[0174] Please note, Fig.12 The host computer 510, base station 520 and UE 530 shown can be respectively Fig.11 The host computer 430, one of the base stations 412a, 412b and 412c, and one of the UEs 491 and 492 may be similar or identical. That is, the internal workings of these entities may be similar to Fig.12 As shown in , and independently, the surrounding network topology can be Fig.11 topology.

[0175] Fig.12 , an OTT connection 550 is abstractly drawn to illustrate communications between a host computer 510 and a UE 530 via a base station 520, without explicit reference to any intermediate devices and the exact routing of messages via these devices. The network infrastructure may determine the routing, which it configures to be hidden from the UE 530 or from the service provider operating the host computer 510, or from both. While the OTT connection 550 is active, the network infrastructure may further make decisions by which it dynamically changes the routing (e.g., based on load balancing considerations or reconfiguration of the network).

[0176] The wireless connection 570 between the UE 530 and the base station 520 is consistent with the teachings of the embodiments described throughout the present disclosure. One or more embodiments of the various embodiments use the OTT connection 550 to improve the performance of the OTT service provided to the UE 530, wherein the wireless connection 570 forms the last segment. More specifically, the teachings of these embodiments can improve data rates, latency, and / or power consumption, and thereby provide benefits such as reduced user waiting time, relaxed restrictions on file size, better responsiveness, and / or extended battery life.

[0177] For the purpose of monitoring data rate, latency, and other factors where one or more embodiments are improved, a measurement process may be provided. There may further be an optional network functionality for reconfiguring the OTT connection 550 between the host computer 510 and the UE 530 in response to changes in the measurement results. The measurement process and / or the network functionality for reconfiguring the OTT connection 550 may be implemented in the software 511 and hardware 515 of the host computer 510 or in the software 531 and hardware 535 of the UE 530 or in both. In an embodiment, a sensor (not shown) may be deployed in or associated with a communication device through which the OTT connection 550 passes; the sensor may participate in the measurement process by providing the values ​​of the monitored quantities exemplified above or providing the values ​​of other physical quantities from which the software 511, 531 can calculate or estimate the monitored quantities. The reconfiguration of the OTT connection 550 may include message formats, retransmission settings, preferred routing selection, etc.; the reconfiguration need not affect the base station 520, and it may be unknown or imperceptible to the base station 520. Such processes and functionality may be known and practiced in the art. In certain embodiments, the measurements may involve proprietary UE signaling that facilitates host computer 510 measurements of throughput, propagation time, latency, and the like. The measurements may be achieved because software 511 and 531 causes messages to be transmitted, particularly null or 'dummy' messages, using OTT connection 550 while it monitors propagation time, errors, etc.

[0178] Fig.13 is a flow chart showing a method implemented in a communication system according to an embodiment. The communication system includes a host computer, a base station and a UE, which can be reference Fig.11 and Fig.12 For the sake of brevity of this disclosure, this section will only include Fig.13 Reference to the accompanying drawings of . In step 610, the host computer provides user data. In sub-step 611 of step 610 (which may be optional), the host computer provides the user data by executing a host application. In step 620, the host computer initiates a transmission to the UE carrying the user data. According to the teachings of the embodiments described throughout the present disclosure, in step 630 (which may be optional), the base station transmits the user data to the UE, the user data being carried in the transmission initiated by the host computer. In step 640 (which may also be optional), the UE executes a client application associated with the host application executed by the host computer.

[0179] Fig.14 is a flow chart showing a method implemented in a communication system according to an embodiment. The communication system includes a host computer, a base station and a UE, which can be reference Fig.11 and Fig.12For the sake of brevity of this disclosure, this section will only include Fig.14 In step 710 of the method, the host computer provides user data. In an optional sub-step (not shown), the host computer provides the user data by executing a host application. In step 720, the host computer initiates a transmission to the UE carrying the user data. According to the teachings of the embodiments described throughout the present disclosure, the transmission may be delivered via a base station. In step 730 (which may be optional), the UE receives the user data carried in the transmission.

[0180] Fig.15 is a flow chart showing a method implemented in a communication system according to an embodiment. The communication system includes a host computer, a base station and a UE, which can be reference Fig.11 and Fig.12 For the sake of brevity of this disclosure, this section will only include Fig.15 Reference to the accompanying drawings of . In step 810 (which may be optional), the UE receives input data provided by the host computer. In addition or alternatively, in step 820, the UE provides user data. In sub-step 821 of step 820 (which may be optional), the UE provides user data by executing a client application. In sub-step 811 of step 810 (which may be optional), the UE executes a client application, which reacts to the received input data provided by the host computer and provides user data. In providing user data, the executed client application may further consider user input received from the user. Regardless of the specific manner of providing user data, the UE provides transmission of user data to the host computer in sub-step 830 (which may be optional). According to the teachings of the embodiments described throughout the present disclosure, in step 840 of the method, the host computer receives user data transmitted from the UE.

[0181] Fig.16 is a flow chart showing a method implemented in a communication system according to an embodiment. The communication system includes a host computer, a base station and a UE, which can be reference Fig.11 and Fig.12 For the sake of brevity of this disclosure, this section will only include Fig.16In step 910 (which may be optional), according to the teachings of the embodiments described throughout this disclosure, the base station receives user data from the UE. In step 920 (which may be optional), the base station initiates transmission of the received user data to the host computer. In step 930 (which may be optional), the host computer receives the user data carried in the transmission initiated by the base station.

[0182] Fig.17 A method 1000 performed by a first network node 160 according to some embodiments is shown. At step 1002, the first network node 160 transmits a first subscription request message indicating a request to subscribe to receive notifications of changes in the authentication state of a wireless device. At step 1004, the first network node 160 receives a first notification message including an indication of a change in the authentication state of the wireless device.

[0183] In a particular embodiment, the first network node 160 is operating as an AAnF, and the first subscription request message is transmitted to a second network node operating as a UDM.

[0184] In a specific embodiment, the first notification message is received from the UDM or the AUSF.

[0185] In a particular embodiment, the first network node 160 is operating as an AAnF, and the first subscription request message is transmitted to the second network node 160 operating as an AUSF.

[0186] In a further specific embodiment, the first notification message is received from the second network node 160 operating as an AUSF.

[0187] In a further specific embodiment, the first notification message is received via the AUSF from the third network node 160 operating as a UDM.

[0188] In a further specific embodiment, the first network node 160 initiates the K based on the first notification message. AF Refresh process.

[0189] In a specific embodiment, the first network node 160 is operating as an AKMA AF, and the subscription request message is transmitted to the second network node 160 operating as an AAnF.

[0190] In a particular embodiment, the first network node 160 is operating as an AUSF, and the first subscription request message is transmitted to the second network node 160 operating as a UDM.

[0191] In a further specific embodiment, the first notification message is received from a second network node operating as a UDM.

[0192] In a specific embodiment, the first subscription request message includes a Nudm_UEAuth_ResultStatusSubscribe message, wherein the Nudm_UEAuth_ResultStatusSubscribe message includes the UE identifier.

[0193] In a specific embodiment, the first notification message indicates the anchor key K generated during the first primary authentication between the wireless device and the network. AKMA The new K that has been generated during the second primary authentication of the wireless device with the network AKMA replace.

[0194] In a further specific embodiment, the first notification message includes the new K AKMA ID, the K AKMA The ID is associated with the new K generated during the second primary authentication of the wireless device with the network. AKMA .

[0195] In a further specific embodiment, the first notification message includes a user equipment UE authentication timestamp associated with a primary authentication of the wireless device with the network.

[0196] In a further specific embodiment, the first network node 160 transmits a request for the new K to the AUSF indicated in the notification message. AKMA Request.

[0197] In a further specific embodiment, the first network node 160 receives a request for a new K from the AUSF. AKMA The response to the request will be the new K AKMA ID and New K AKMA association.

[0198] In a further specific embodiment, the first notification message indicates the K generated during the first primary authentication between the wireless device and the network. AKMA No longer valid.

[0199] In a further specific embodiment, K AKMA No longer valid due to an unsuccessful second primary authentication of the wireless device with the network, and attempting a second primary authentication after performance of the first primary authentication.

[0200] In a further specific embodiment, the first notification message includes information associated with the AUSF ID that ran the second primary authentication, and / or when the second primary authentication is successful, with K AKMA The information associated with the ID is associated with the K generated during the first primary authentication of the wireless device with the home network.AKMA .

[0201] In a further specific embodiment, the first network node 160 deletes the K generated during the first primary authentication of the wireless device with the home network. AKMA .

[0202] In a particular embodiment, the first network node 160 receives a second subscription request message from the third network node 160. The second subscription request message indicates a request for the third network node 160 to subscribe to receive notifications of changes in the authentication state of the wireless device 110.

[0203] In a further specific embodiment, the first network node 160 is operating as an AAnF and the third network node 160 is operating as an AF, and the second subscription request indicates a request for the AF to receive notifications of changes in the authentication state of the wireless device 110 .

[0204] In a further specific embodiment, the first notification message and the second notification message are transmitted via the NEF.

[0205] In a further specific embodiment, a second subscription request message is received from the third network node 160 before transmitting the first subscription request message, and the first subscription request message is transmitted in response to receiving the second subscription request message.

[0206] In a further specific embodiment, the first network node 160 obtains information indicating a change in the authentication state of the wireless device and transmits a second notification message indicating the change in the authentication state of the wireless device 110 to the third network node 160 .

[0207] In a further specific embodiment, the second notification message indicates the K generated during the first primary authentication between the wireless device and the network. AF The new K that has been generated during the second primary authentication of the wireless device with the network AF replace.

[0208] In a further specific embodiment, the second notification message includes the new K generated during the second primary authentication between the wireless device and the network. AF and K AF ID.

[0209] In a further specific embodiment, the second notification message includes a timestamp associated with the new K generated during the second primary authentication of the wireless device with the network. AF And the new K AF At least one of the IDs, the new K AF The ID is associated with a new K generated during the second primary authentication of the wireless device with the network.AF .

[0210] In a further specific embodiment, the second notification message indicates the K generated during the first primary authentication between the wireless device and the network. AF No longer valid.

[0211] In a further specific embodiment, K AF No longer valid due to an unsuccessful second primary authentication of the wireless device with the network, and attempting a second primary authentication after performance of the first primary authentication.

[0212] In a further specific embodiment, the second notification message includes AF ID associated information, the K AF The ID is associated with the K generated during the first primary authentication of the wireless device 110 with the home network. AF .

[0213] In a further specific embodiment, the connection with the wireless device is torn down by the AF based on the second notification.

[0214] Fig.18 Show wireless networks (such as Figure 6 Schematic block diagram of a virtual device 1100 in a wireless network (such as a wireless network). The device can be used in a wireless device or a network node (such as Figure 6 The apparatus 1100 is implemented in a wireless device 110 or a network node 160 as shown in FIG. 1100 is operable to perform the reference Fig.17 The example methods described and any other possible processes or methods disclosed herein. It is also understood that Fig.17 The method is not necessarily performed only by the device 1100. At least some operations of the method can be performed by one or more other entities.

[0215] The virtual device 1100 may include a processing circuit, which may include one or more microprocessors or microcontrollers and may include a digital signal processor (DSP), dedicated digital logic, and other digital hardware such as the like. The processing circuit may be configured to execute program codes stored in a memory, which may include one or more types of memory, such as a read-only memory (ROM), a random access memory, a cache memory, a flash memory device, an optical storage device, etc. In several embodiments, the program code stored in the memory includes program instructions for executing one or more telecommunications and / or data communication protocols and instructions for executing one or more techniques of the techniques described herein. In some implementations, the processing circuit may be used to cause the transmission module 1110, the receiving module 1120, and any other appropriate unit of the device 1100 to perform corresponding functions according to one or more embodiments of the present disclosure.

[0216] According to some embodiments, the transmission module 1110 may perform some of the transmission functions of the apparatus 1100. For example, the transmission module 1110 may transmit a first subscription request message indicating a request to subscribe to receive notifications of changes in the authentication state of the wireless device 110.

[0217] According to some embodiments, the receiving module 1120 may perform some of the receiving functions of the apparatus 1100. For example, the receiving module 1120 may receive a first notification message including an indication of a change in the authentication state of the wireless device 110.

[0218] The term "unit" may have the conventional meaning in the field of electronic devices, electrical apparatuses and / or electronic devices, and may include, for example, electrical and / or electronic circuits, devices, modules, processors, memories, logical solid-state and / or discrete devices, computer programs or instructions for performing corresponding tasks, processes, calculations, output and / or display functions, etc., such as those described herein.

[0219] Fig.19 A method 1200 is shown as being performed by a first network node 160 according to certain embodiments. At step 1202, the first network node 160 receives a first subscription request message indicating a request to subscribe to receive notifications of changes in the authentication state of the wireless device 110. At step 1204, the first network node 160 transmits a first notification message including an indication of the change in the authentication state of the wireless device 110.

[0220] In a particular embodiment, the first network node 160 is operating as a UDM, and the first subscription request message is received from the second network node 160 operating as an AAnF.

[0221] In a particular embodiment, the first notification message is transmitted to the Authentication Server Function AUSF or AAnF.

[0222] In a particular embodiment, the first network node 160 is operating as an AUSF and the first subscription request message is received from the second network node 160 operating as an AAnF.

[0223] In a further specific embodiment, the first notification message is transmitted to the second network node operating as an AAnF.

[0224] In a specific embodiment, the first network node 160 is operating as a UDM, and the first notification message is transmitted to the AAnF via the third network node 160 operating as an AUSF.

[0225] In a specific embodiment, KAF The refresh process is initiated by AAnF.

[0226] In a particular embodiment, the first network node 160 is operating as an AAnF and the subscription request message is received from the second network node 160 operating as an AKMA AF.

[0227] In a particular embodiment, the first network node 160 is operating as a UDM, and the first subscription request message is received from the second network node 160 operating as an AUSF.

[0228] In a further specific embodiment, the first notification message is transmitted to the second network node 160 operating as an AUSF.

[0229] In a specific embodiment, the first subscription request message includes a Nudm_UEAuth_ResultStatusSubscribe message, wherein the Nudm_UEAuth_ResultStatusSubscribe message includes a UE identifier and an anchor key identifier K AKMA ID.

[0230] In a further specific embodiment, the first notification message indicates the K generated during the first primary authentication between the wireless device 110 and the network. AKMA The new K that was generated during the second primary authentication of the wireless device 110 with the network AKMA replace.

[0231] In a further specific embodiment, the first notification message includes the new K AKMA ID, the K AKMA The ID is associated with the new K generated during the second primary authentication of the wireless device 110 with the network. AKMA .

[0232] In a further specific embodiment, the first notification message includes a UE authentication timestamp associated with a primary authentication of the wireless device 110 with the network.

[0233] In a further specific embodiment, the first network node 160 receives a request for the new K from the AUSF indicated in the notification message. AKMA Request.

[0234] In a further specific embodiment, the first network node 160 transmits a request for a new K from the AUSF. AKMA The response to the request will be the new K AKMA ID and New K AKMA association.

[0235] In a further specific embodiment, the first notification message indicates the K generated during the first primary authentication between the wireless device 110 and the network. AKMA No longer valid.

[0236] In a further specific embodiment, K AKMA No longer valid due to an unsuccessful second primary authentication of the wireless device 110 with the network, and attempting a second primary authentication after performance of the first primary authentication.

[0237] In a specific embodiment, the first notification message includes information associated with the AUSF ID that ran the second primary authentication, and / or when the second primary authentication is successful, with K AKMA The information associated with the ID is associated with the K generated during the first primary authentication of the wireless device 110 with the home network. AKMA .

[0238] In a further specific embodiment, the first network node 160 deletes the K generated during the first primary authentication between the wireless device 110 and the home network. AKMA .

[0239] Fig. 20 Show wireless networks (such as Figure 6 Schematic block diagram of a virtual device 1300 in a wireless network (such as a wireless network shown in FIG. 1 ). The device may be in a wireless device or a network node (such as Figure 6 The apparatus 1300 is implemented in the wireless device 110 or the network node 160 shown in FIG. Fig.19 The example methods described and any other possible processes or methods disclosed herein. It is also understood that Fig.19 The method is not necessarily performed only by the device 1300. At least some operations of the method can be performed by one or more other entities.

[0240] The virtual device 1300 may include a processing circuit, which may include one or more microprocessors or microcontrollers and may include a digital signal processor (DSP), dedicated digital logic, and other digital hardware such as the like. The processing circuit may be configured to execute program codes stored in a memory, which may include one or more types of memory, such as a read-only memory (ROM), a random access memory, a cache memory, a flash memory device, an optical storage device, etc. In several embodiments, the program code stored in the memory includes program instructions for executing one or more telecommunications and / or data communication protocols and instructions for executing one or more techniques of the techniques described herein. In some implementations, the processing circuit may be used to cause the receiving module 1310, the transmitting module 1320, and any other appropriate unit of the device 1300 to perform corresponding functions according to one or more embodiments of the present disclosure.

[0241] According to some embodiments, the receiving module 1310 may perform some receiving functions of the receiving functions of the apparatus 1300. For example, the receiving module 1310 may receive a first subscription request message indicating a request to subscribe to receive notifications of changes in authentication status of a wireless device.

[0242] According to certain embodiments, the transmission module 1320 may perform certain transmission functions of the transmission functions of the apparatus 1300. For example, the transmission module 1320 may transmit a first notification message including an indication of a change in the authentication state of the wireless device.

[0243] The term "unit" may have the conventional meaning in the field of electronic devices, electrical apparatuses and / or electronic devices, and may include, for example, electrical and / or electronic circuits, devices, modules, processors, memories, logical solid-state and / or discrete devices, computer programs or instructions for performing corresponding tasks, processes, calculations, output and / or display functions, etc., such as those described herein.

[0244] Example embodiments 1. A method performed by a first network node, the method comprising: transmitting a first subscription request message indicating a request to subscribe to receive notifications of changes in an authentication state of a wireless device; and receiving a first notification message including an indication of a change in the authentication state of the wireless device.

[0245] Example Embodiment 2. The method of Example Embodiment 1, wherein the first network node is operating as an AAnF, and the first subscription request message is transmitted to a second network node operating as a UDM.

[0246] Example Embodiment 3. The method of any one of Example Embodiments 1 to 2, wherein the first notification message is received from a UDM or an AUSF.

[0247] Example Embodiment 4. The method of Example Embodiment 1, wherein the first network node is operating as an AAnF, and the first subscription request message is transmitted to a second network node operating as an AUSF.

[0248] Example Embodiment 5. The method of Example Embodiment 4, wherein the first notification message is received from the second network node operating as the AUSF.

[0249] Example Embodiment 6. The method of Example Embodiment 4, wherein the first notification message is received via the AUSF from a third network node operating as a UDM.

[0250] Example embodiment 7. The method of any one of example embodiments 4 to 6 further comprises initiating K based on the first notification message. AF Refresh process.

[0251] Example Embodiment 8. The method of Example Embodiment 1, wherein the first network node is operating as an AKMA AF, and the subscription request message is transmitted to the second network node operating as an AAnF.

[0252] Example Embodiment 9. The method of Example Embodiment 1, wherein the first network node is operating as an AUSF, and the first subscription request message is transmitted to a second network node operating as a UDM.

[0253] Example Embodiment 10. The method of Example Embodiment 9, wherein the first notification message is received from the second network node operating as the UDM.

[0254] Example Embodiment 11. The method of any one of Example Embodiments 1 to 4 and 9 to 10, wherein the first subscription request message comprises a Nudm_UEAuth_ResultStatusSubscribe message, the Nudm_UEAuth_ResultStatusSubscribe comprising a UE identifier.

[0255] Example Embodiment 12. The method of any one of Example Embodiments 1 to 11, wherein the first notification message indicates a K generated during a first primary authentication between the wireless device and the network. AKMA has been replaced with the new K generated during the second primary authentication of the wireless device with the network AKMA .

[0256] Example embodiment 13. The method of example embodiment 12, wherein the first notification message includes a new K AKMA ID, the K AKMA The ID is associated with the new K generated during the second primary authentication of the wireless device with the network. AKMA .

[0257] Example Embodiment 14. The method of any one of Example Embodiments 12 to 13, wherein the first notification message includes a UE authentication timestamp associated with a primary authentication of the wireless device with the network.

[0258] Example Embodiment 15. The method of any one of Example Embodiments 12 to 14, further comprising transmitting a request for the new K to the AUSF indicated in the notification message. AKMA Request.

[0259] Example Embodiment 16. The method of Example Embodiment 15 further comprises receiving from the AUSF a request for the new K AKMA The response to the request will be the new K AKMA ID and the new K AKMA association.

[0260] Example Embodiment 17. The method of any one of Example Embodiments 12 to 16, wherein the first notification message indicates a K generated during a first primary authentication of the wireless device with a network. AKMA No longer valid.

[0261] Example 18. The method of Example 17, wherein the K AKMA No longer valid due to an unsuccessful second primary authentication of the wireless device with the network, the second primary authentication being attempted subsequent to performance of the first primary authentication.

[0262] Example embodiment 19. The method of any one of example embodiments 12 to 16, wherein the first notification message includes information associated with the AUSF ID running the second primary authentication, and / or when the second primary authentication is successful, with K AKMA The ID-associated information is associated with the K generated during the first primary authentication of the wireless device with the home network. AKMA .

[0263] Example Embodiment 20. The method of any one of Example Embodiments 12 to 19, further comprising deleting the K generated during the first primary authentication of the wireless device with the home network. AKMA .

[0264] Example Embodiment 21. The method of Example Embodiments 1 to 20, further comprising receiving a second subscription request message from a third network node, the second subscription request message indicating a request for the third network node to subscribe to receive notifications of changes in authentication status of a wireless device.

[0265] Example Embodiment 22. The method of Example Embodiment 21, wherein the first network node is operating as an AAnF and the third network node is operating as an AF, and wherein the second subscription request indicates a request for the AF to receive notifications of changes in the authentication state of the wireless device.

[0266] Example Embodiment 23. The method of Example Embodiment 22, wherein the first notification message and the second notification message are transmitted via a NEF.

[0267] Example Embodiment 24. The method of Example Embodiment 21, wherein the first network node is operating as an AAnF and the third network node is operating as an AF, and wherein the second subscription request indicates a request for the AF to receive notifications of changes in authentication status of the wireless device.

[0268] Example Embodiment 25. The method of any one of Example Embodiments 21 to 24, wherein the second subscription request message is received from the third network node before transmitting the first subscription request message, and wherein the first subscription request message is transmitted in response to receiving the second subscription request message.

[0269] Example embodiment 26. The method of any one of example embodiments 21 to 25, further comprising: obtaining information indicating a change in the authentication state of the wireless device; and transmitting a second notification message to a third network node, the second notification message indicating the change in the authentication state of the wireless device.

[0270] Example Embodiment 27. The method of Example Embodiment 26, wherein the second notification message indicates a K generated during a first primary authentication between the wireless device and the network. AF The key has been replaced with a new K generated during the second primary authentication of the wireless device with the network. AF .

[0271] Example Embodiment 28. The method of Example Embodiment 27, wherein the second notification message includes the new K generated during the second primary authentication of the wireless device with the network. AF and K AF ID.

[0272] Example Embodiment 29. The method of any one of Example Embodiments 27 to 28, wherein the second notification message includes a timestamp associated with the new K generated during the second primary authentication of the wireless device with the network. AF And the new K AF At least one of the IDs, the new K AF The ID is associated with the new K generated during the second primary authentication of the wireless device with the network. AF .

[0273] Example Embodiment 30. The method of Example Embodiment 26, wherein the second notification message indicates a K generated during a first primary authentication between the wireless device and the network. AF No longer valid.

[0274] Example embodiment 31. The method of example embodiment 30, wherein the K AFNo longer valid due to an unsuccessful second primary authentication of the wireless device with the network, the second primary authentication being attempted subsequent to performance of the first primary authentication.

[0275] Example embodiment 32. The method of any one of example embodiments 30 to 31, wherein the second notification message includes a message related to K AF ID associated information, the K AF The ID is associated with the K generated during the first primary authentication of the wireless device with the home network. AF .

[0276] Example Embodiment 33. The method of any one of Example Embodiments 26 to 32, wherein the connection with the wireless device is torn down by the AF based on a second notification.

[0277] Example embodiment 34. A computer program comprising instructions for performing any of the methods of example embodiments 1 to 33 when the instructions are executed on a computer.

[0278] Example embodiment 35. A computer program product comprising a computer program, the computer program comprising instructions for performing any of the methods of example embodiments 1 to 33 when the instructions are executed on a computer.

[0279] Example Embodiment 36. A non-transitory computer readable medium storing instructions that, when executed by a computer, perform any of the methods of Example Embodiments 1 to 33.

[0280] Example embodiment 37. A first network node comprising a processing circuit configured to perform any one of example embodiments 1 to 33.

[0281] Example embodiment 38. A method performed by a first network node, the method comprising: receiving a first subscription request message, the first subscription request message indicating a request to subscribe to receive notifications of changes in the authentication state of a wireless device; and transmitting a first notification message, the first notification message including an indication of the change in the authentication state of the wireless device.

[0282] Example Embodiment 39. The method of Example Embodiment 36, wherein the first network node is operating as a UDM and the first subscription request message is received from the second network node operating as an AAnF.

[0283] Example Embodiment 40. The method of any one of Example Embodiments 38 to 39, wherein the first notification message is transmitted to an AUSF or an AAnF.

[0284] Example Embodiment 41. The method of Example Embodiment 38, wherein the first network node is operating as an AUSF and the first subscription request message is received from a second network node operating as an AAnF.

[0285] Example Embodiment 42. The method of Example Embodiment 41, wherein the first notification message is transmitted to the second network node operating as the AAnF.

[0286] Example Embodiment 43. The method of Example Embodiment 38, wherein the first network node is a UDM, and the first notification message is transmitted to the AAnF via a third network node operating as an AUSF.

[0287] Example embodiment 44. The method of any one of example embodiments 41 to 43, wherein K AF The refresh process is initiated by the AAnF.

[0288] Example Embodiment 45. The method of Example Embodiment 38, wherein the first network node is operating as an AAnF and receiving a subscription request message from a second network node operating as an AF.

[0289] Example Embodiment 46. The method of Example Embodiment 38, wherein the first network node is operating as a UDM and the first subscription request message is received from a second network node operating as an AUSF.

[0290] Example Embodiment 47. The method of Example Embodiment 46, wherein the first notification message is transmitted to the second network node operating as an AUSF.

[0291] Example Embodiment 48. The method of any one of Example Embodiments 38 to 41 and 46 to 47, wherein the first subscription request message includes a Nudm_UEAuth_ResultStatusSubscribe message, the Nudm_UEAuth_ResultStatusSubscribe message including a UE identifier and a K AKMA ID.

[0292] Example Embodiment 49. The method of any one of Example Embodiments 38 to 48, wherein the first notification message indicates a K generated during a second primary authentication of the wireless device with the network. AKMA has been replaced with the new K generated during the second primary authentication of the wireless device with the network AKMA .

[0293] Example embodiment 50. The method of example embodiment 49, wherein the first notification message includes a new KAKMA ID, the K AKMA The ID is associated with the new K generated during the second primary authentication of the wireless device with the network. AKMA .

[0294] Example Embodiment 51. The method of any one of Example Embodiments 49 to 50, wherein the first notification message includes a UE authentication timestamp associated with a primary authentication of the wireless device with the network.

[0295] Example Embodiment 52. The method of any one of Example Embodiments 49 to 51, further comprising receiving a request for the new K from the AUSF indicated in the notification message. AKMA Request.

[0296] Example Embodiment 53. The method of Example Embodiment 52 further comprises transmitting the new K from the AUSF AKMA The response to the request will be the new K AKMA ID and the new K AKMA association.

[0297] Example Embodiment 54. The method of any one of Example Embodiments 49 to 53, wherein the first notification message indicates a K generated during a first primary authentication of the wireless device with a network. AKMA No longer valid.

[0298] Example embodiment 55. The method of example embodiment 54, wherein the K AKMA No longer valid due to an unsuccessful second primary authentication of the wireless device with the network, the second primary authentication being attempted subsequent to performance of the first primary authentication.

[0299] Example Embodiment 56. The method of any one of Example Embodiments 49 to 53, wherein the first notification message includes information associated with the AUSF ID running the second primary authentication, and / or when the second primary authentication is successful, with K AKMA The ID-associated information is associated with the K generated during the first primary authentication of the wireless device with the home network. AKMA .

[0300] Example Embodiment 57. The method of any one of Example Embodiments 49 to 56, further comprising deleting the K generated during the first primary authentication of the wireless device with the home network. AKMA .

[0301] Example embodiment 58. A computer program comprising instructions for performing any of the methods of example embodiments 38 to 57 when the instructions are executed on a computer.

[0302] Example embodiment 59. A computer program product comprising a computer program, the computer program comprising instructions for performing any of the methods of example embodiments 38 to 57 when the instructions are executed on a computer.

[0303] Example Embodiment 60. A non-transitory computer readable medium storing instructions that, when executed by a computer, perform any of the methods of Example Embodiments 38 to 57.

[0304] Example embodiment 61. A first network node comprising a processing circuit configured to perform any one of example embodiments 38 to 57.

[0305] Example Embodiment 62. A network node comprising: a processing circuit configured to perform any of the steps of any of Example Embodiments 1 to 61; a power supply circuit configured to supply power to a wireless device.

[0306] Example embodiment 63. A communication system includes a host computer, the host computer including: a processing circuit configured to provide user data; and a communication interface configured to forward the user data to a cellular network for transmission to a wireless device, wherein the cellular network includes a network node having a radio interface and a processing circuit, the processing circuit of the network node is configured to perform any of the steps of any of the example embodiments of example embodiments 1 to 61.

[0307] Example Embodiment 64. The communication system of the previous embodiment, further comprising the network node.

[0308] Example embodiment 65. The communication system of the two preceding embodiments, further comprising the wireless device, wherein the wireless device is configured to communicate with the network node.

[0309] Example embodiment 66. The communication system of the first three embodiments, wherein: the processing circuit of the host computer is configured to execute a host application, thereby providing the user data; and the wireless device includes a processing circuit, the processing circuit is configured to execute a client application associated with the host application.

[0310] Example embodiment 67. A method implemented in a communication system, the communication system comprising a host computer, a network node and a wireless device, the method comprising: providing user data at the host computer; and initiating at the host computer a transmission carrying the user data to the wireless device via a cellular network including the network node, wherein the network node performs any of the steps of any of example embodiments 1 to 61.

[0311] Example Embodiment 68. The method of the preceding embodiment, further comprising transmitting the user data at the network node.

[0312] Example Embodiment 69. The method of the preceding two embodiments, wherein the user data is provided at the host computer by executing a host application, the method further comprising executing a client application associated with the host application at the wireless device.

[0313] Example embodiment 70. A wireless device configured to communicate with a network node, the wireless device comprising a radio interface and a processing circuit configured to perform the method of the preceding three embodiments.

[0314] Example embodiment 71. A communication system comprising a host computer, the host computer comprising a communication interface, the communication interface configured to receive user data originating from a transmission from a wireless device to a network node, wherein the network node comprises a radio interface and a processing circuit, the processing circuit of the network node configured to perform any of the steps of any of example embodiments 1 to 61.

[0315] Example Embodiment 72. The communication system of the previous embodiment, further comprising the network node.

[0316] Example embodiment 73. The communication system of the two preceding embodiments, further comprising the wireless device, wherein the wireless device is configured to communicate with the network node.

[0317] Example embodiment 74. The communication system of the preceding 3 embodiments, wherein: the processing circuitry of the host computer is configured to execute a host application; and the wireless device is configured to execute a client application associated with the host application, thereby providing the user data for receipt by the host computer.

[0318] Example Embodiment 75. The method of any of the preceding embodiments, wherein the network node comprises a base station.

[0319] Example Embodiment 76. The method of any of the preceding embodiments, wherein the wireless device comprises a user equipment (UE).

[0320] Without departing from the scope of the present disclosure, the systems and devices described herein may be modified, added, or omitted. The components of the systems and devices may be integrated or separated. In addition, the operations of the systems and devices may be performed by more, less, or other components. Additionally, the operations of the systems and devices may be performed using any appropriate logic (including software, hardware, and / or another logic). As used in this document, "each" means each member of a set or each member of a subset of a set.

[0321] Without departing from the scope of the present disclosure, modifications, additions or omissions may be made to the methods described herein. The methods may include more, fewer or other steps. Additionally, the steps may be performed in any appropriate order.

[0322] Although the present disclosure has been described according to certain embodiments, the changes and substitutions of the embodiments will be apparent to those skilled in the art. Accordingly, the above description of the embodiments does not limit the present disclosure. Other changes, substitutions and modifications are possible without departing from the spirit and scope of the present disclosure.

Claims

1. A method (1000) performed by a first network node (160), wherein the first network node is operating as an application authentication and key management anchor function AAnF, the method comprising: Transmitting a first subscription request message to a second network node (160), the first subscription request message indicating a request to subscribe to receive notifications of changes in the authentication state of a wireless device (110), wherein the authentication state refers to an anchor key K for the wireless device AKMA and wherein the second network node (160) is operating as a unified data management (UDM) or an authentication server function (AUSF) or an application function (AF); as well as A first notification message is received, the first notification message including an indication of a change in the authentication status of the wireless device.

2. The method of claim 1, wherein: The first notification message is received from the UDM or the AUSF.

3. The method of claim 1, wherein: The first notification message is received from a third network node operating as a UDM via the AUSF.

4. The method according to any one of claims 1 to 3, further comprising initiating an application function key K based on the first notification message AF Refresh process.

5. The method of claim 1, wherein: The first network node is operating as an Application Authentication and Key Management Application Function, AKMA AF, and the subscription request message is transmitted to a second network node operating as an AAnF.

6. The method of claim 1, wherein: The first network node is operating as an AUSF and the first subscription request message is transmitted to a second network node operating as a UDM.

7. The method of claim 6, wherein: The first notification message is received from the second network node operating as the UDM.

8. The method of claim 1, wherein: The first subscription request message includes a Nudm_UEAuth_ResultStatusSubscribe message, and the Nudm_UEAuth_ResultStatusSubscribe includes a UE identifier.

9. The method of claim 1, wherein: The first notification message indicates an anchor key K generated during a first primary authentication between the wireless device and the network. AKMA has been replaced with the new K generated during the second primary authentication of the wireless device with the network AKMA .

10. The method of claim 9, wherein: The first notification message includes a new anchor key identifier K AKMA ID, the K AKMA The ID is associated with the new K generated during the second primary authentication of the wireless device with the network. AKMA .

11. The method of claim 9, wherein: The first notification message includes a user equipment (UE) authentication timestamp associated with a primary authentication of the wireless device with the network.

12. The method of claim 9, further comprising transmitting a request for the new K to the AUSF indicated in the notification message. AKMA Request.

13. The method of claim 12, further comprising receiving from the AUSF a request for the new K AKMA The response to the request will be the new K AKMA ID and the new K AKMA association.

14. The method of claim 9, wherein: The first notification message indicates a K generated during a first primary authentication between the wireless device and the network. AKMA No longer valid.

15. The method of claim 14, wherein: The K AKMA No longer valid due to an unsuccessful second primary authentication of the wireless device with the network, the second primary authentication being attempted subsequent to performance of the first primary authentication.

16. The method of claim 9, wherein: The first notification message includes information associated with the AUSF identifier AUSF ID that ran the second primary authentication, and / or when the second primary authentication is successful, with K AKMA The ID-associated information is associated with the K generated during the first primary authentication of the wireless device with the home network. AKMA .

17. The method of claim 16, further comprising deleting the K generated during the first primary authentication of the wireless device with the home network. AKMA .

18. The method of claim 1, further comprising receiving a second subscription request message from a third network node, the second subscription request message indicating a request for the third network node to subscribe to receive notifications of changes in authentication status of a wireless device.

19. The method of claim 18, wherein: The first network node is operating as an AAnF and the third network node is operating as an AF, and wherein the second subscription request indicates the request for the AF to receive notifications of changes in the authentication state of the wireless device.

20. The method of claim 19, wherein: The first notification message is transmitted via a network opening function NEF.

21. The method of claim 18, wherein: The second subscription request message is received from the third network node prior to transmitting the first subscription request message, and wherein the first subscription request message is transmitted in response to receiving the second subscription request message.

22. The method of claim 19, further comprising: obtaining information indicative of the change in the authentication status of the wireless device; as well as A second notification message is transmitted to the third network node, the second notification message indicating the change in the authentication status of the wireless device.

23. The method of claim 22, wherein: The second notification message indicates the K generated during the first primary authentication between the wireless device and the network. AF has been replaced with the new K generated during the second primary authentication of the wireless device with the network AF .

24. The method of claim 23, wherein: The second notification message includes the new K generated during the second primary authentication of the wireless device with the network AF and K AF ID.

25. The method of claim 23, wherein: The second notification message includes a timestamp associated with the new K generated during the second primary authentication of the wireless device with the network. AF And the new K AF At least one of the IDs, the new K AF The ID is associated with the new K generated during the second primary authentication of the wireless device with the network. AF .

26. The method of claim 22, wherein: The second notification message indicates the K generated during the first primary authentication between the wireless device and the network. AF No longer valid.

27. The method of claim 26, wherein: The K AF No longer valid due to an unsuccessful second primary authentication of the wireless device with the network, the second primary authentication being attempted subsequent to performance of the first primary authentication.

28. The method of claim 26, wherein: The second notification message includes K AF ID associated information, the K AF The ID is associated with the K generated during the first primary authentication of the wireless device with the home network. AF .

29. The method of claim 22, wherein: The connection with the wireless device is released by the AF based on the second notification message.

30. A first network node (160) comprising a processing circuit (170) configured to perform any of claims 1 to 29.

31. A method (1200) performed by a first network node (160), wherein the first network node is operating as a unified data management (UDM) or an authentication server function (AUSF) or an application function (AF), the method comprising: receiving a first subscription request message from a second network node, the first subscription request message indicating a request to subscribe to receive notifications of changes in an authentication state of a wireless device (110), wherein the authentication state refers to an anchor key K for the wireless device AKMA and wherein the second network node is operating as an application authentication and key management anchor function AAnF; as well as A first notification message is transmitted, the first notification message including an indication of a change in the authentication status of the wireless device.

32. The method of claim 31, wherein: The first notification message is transmitted to the AUSF or the AAnF.

33. The method of claim 31, wherein: The first network node is operating as a UDM, and the first notification message is transmitted to the AAnF via a third network node operating as an AUSF.

34. The method of any one of claims 31 to 33, wherein: Application function key K AF The refresh process is initiated by the AAnF.

35. The method of claim 31, wherein: The first network node is operating as an AAnF and receives the subscription request message from a second network node operating as an Application Authentication and Key Management Application Function AKMA AF.

36. The method of claim 31, wherein: The first network node is operating as a UDM and receives the first subscription request message from a second network node operating as an AUSF.

37. The method of claim 36, wherein: The first notification message is transmitted to the second network node operating as an AUSF.

38. The method of claim 31, wherein: The first subscription request message includes a Nudm_UEAuth_ResultStatusSubscribe message, wherein the Nudm_UEAuth_ResultStatusSubscribe message includes a UE identifier and an anchor key identifier K AKMA ID.

39. The method of claim 31, wherein: The first notification message indicates an anchor key K generated during a first primary authentication between the wireless device and the network. AKMA has been replaced with the new K generated during the second primary authentication of the wireless device with the network AKMA .

40. The method of claim 39, wherein: The first notification message includes a new K AKMA ID, the K AKMA The ID is associated with the new K generated during the second primary authentication of the wireless device with the network. AKMA .

41. The method of claim 39, wherein: The first notification message includes a user equipment (UE) authentication timestamp associated with a primary authentication of the wireless device with the network.

42. The method of claim 39, further comprising receiving a request for the new K from the AUSF indicated in the notification message. AKMA Request.

43. The method of claim 42, further comprising transmitting a AKMA The response to the request will be the new K AKMA ID and the new K AKMA association.

44. The method of claim 39, wherein: The first notification message indicates a K generated during a first primary authentication between the wireless device and the network. AKMA No longer valid.

45. The method of claim 44, wherein: The K AKMA No longer valid due to an unsuccessful second primary authentication of the wireless device with the network, the second primary authentication being attempted subsequent to performance of the first primary authentication.

46. ​​The method of claim 39, wherein: The first notification message includes at least one of the following: information associated with the AUSF identifier AUSF ID of the AUSF running the second primary authentication, and When the second master authentication succeeds, AKMA The ID-associated information is associated with the K generated during the first primary authentication of the wireless device with the home network. AKMA .

47. The method of claim 39, further comprising deleting the K generated during the first primary authentication of the wireless device with a home network. AKMA .

48. A first network node (110) comprising a processing circuit (120) configured to perform any of claims 31 to 47.

Images