Method, device, apparatus and storage medium for notifying authentication and authorization results

Abstract

Embodiments of the present disclosure relate to notifying a device of a result of authentication and authorization of another device. A first device receives a notification from a second device. The notification indicates the result of authentication and authorization involving the second device and a third device. The first device also updates a policy for communication between the third device and a data network or a fourth device based on the result of authentication and authorization.

Description

Technical Field

[0001] Embodiments of the present disclosure generally relate to the field of telecommunications, and more particularly, to methods, devices, apparatuses, and computer-readable media for notifying a network of results of authentication and authorization of a terminal device. Background Art

[0002] The 3rd Generation Partnership Project (3GPP) is working on enhancements to the control of terminal devices, especially for Unmanned Aerial Vehicles (UAVs). Enhancements may include identification, authentication, authorization, and tracking of terminal devices. In control, the following requirements should be met: tracking of terminal devices, for example, being able to report to the UAV domain; allowing a terminal device to announce itself or send data to other terminal devices in a certain area through the 3GPP network; and allowing authentication and authorization with the help of Unmanned Aerial System (UAS) Traffic Management (UTM) or UAS Service Provider (USS) as part of UTM.

[0003] One major issue is the authentication and authorization of terminal devices via the 5G system (5GS). Although it has been proposed that authentication and authorization can be performed via the 5GS user plane or the 5GS control plane, it should also be studied how to notify the network of the results of the authentication and authorization of the terminal device. Summary of the invention

[0004] Generally speaking, example embodiments of the present disclosure provide a scheme for notifying a device about the results of authentication and authorization of another device.

[0005] In a first aspect, a first device is provided. The first device includes at least one processor; and at least one memory including computer program code; the at least one memory and the computer program code are configured to, together with the at least one processor, cause the first device to: receive a notification from a second device indicating a result of authentication and authorization performed by the second device on a third device; and update a policy for communication between the third device and a data network based on the result of the authentication and authorization.

[0006] In a second aspect, a second device is provided. The second device includes at least one processor; and at least one memory including computer program code; the at least one memory and the computer program code are configured to, together with the at least one processor, enable the second device to: authenticate and authorize a third device; and send a notification to the first device, the notification indicating the result of the authentication and authorization.

[0007] In a third aspect, a method implemented at a first device is provided. The method includes: receiving a notification at the first device from a second device, the notification indicating a result of authentication and authorization performed by the second device on a third device; and updating a policy for communication between the third device and a data network based on the result of the authentication and authorization.

[0008] In a fourth aspect, a method implemented at a second device is provided. The method includes: performing authentication and authorization of a third device at the second device; and sending a notification to a first device, the notification indicating the result of the authentication and authorization.

[0009] In a fifth aspect, an apparatus is provided, comprising: a component for receiving a notification from a second device at a first device, the notification indicating a result of authentication and authorization performed by the second device on a third device; and a component for updating a policy for communication between the third device and a data network based on the result of the authentication and authorization.

[0010] In a sixth aspect, an apparatus is provided, comprising: a component for performing authentication and authorization of a third device at a second device; and a component for sending a notification to a first device, the notification indicating a result of the authentication and authorization.

[0011] In a seventh aspect, there is provided a computer readable medium comprising a computer program for causing an apparatus to at least perform the method according to the third or fourth aspect.

[0012] It should be understood that the invention summary is not intended to identify the key or essential features of the embodiments of the present disclosure, nor is it intended to be used to limit the scope of the present disclosure. Other features of the present disclosure will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Some example embodiments will now be described with reference to the accompanying drawings, in which:

[0014] Figure 1 shows an example communication network in which embodiments of the present disclosure may be implemented;

[0015] Figure 2 A signaling diagram illustrating an authentication and authorization process of a terminal device according to a conventional scheme is shown;

[0016] Figure 3 A signaling diagram illustrating a process for notifying a device about a result of authentication and authorization of another device according to some example embodiments of the present disclosure is shown;

[0017] Figure 4 A signaling diagram illustrating a process for notifying a device about a result of authentication and authorization of another device according to other example embodiments of the present disclosure is shown;

[0018] Figure 5 A signaling diagram illustrating a process for notifying a device about a result of authentication and authorization of another device according to other example embodiments of the present disclosure is shown;

[0019] Figure 6 A flow chart illustrating a method for notifying a device of a result of authentication and authorization of another device according to some embodiments of the present disclosure is shown;

[0020] Figure 7 A flowchart showing a method for notifying a device of a result of authentication and authorization of another device according to other embodiments of the present disclosure is shown;

[0021] Figure 8 shows a simplified block diagram of an apparatus suitable for implementing some other embodiments of the present disclosure; and

[0022] Fig. 9 A block diagram of an example computer-readable medium is shown according to some example embodiments of the present disclosure.

[0023] Throughout the drawings, the same or similar reference numerals refer to the same or similar elements. DETAILED DESCRIPTION

[0024] The principles of the present disclosure will now be described with reference to some example embodiments. It should be understood that these embodiments are described for illustrative purposes only and to help those skilled in the art understand and implement the present disclosure without implying any limitation on the scope of the present disclosure. The disclosure described herein can be implemented in various ways different from the ways described below.

[0025] In the following description and claims, unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs.

[0026] References in this disclosure to "one embodiment," "an embodiment," "an example embodiment," etc., indicate that the described embodiment may include a particular feature, structure, or characteristic, but not every embodiment necessarily includes the particular feature, structure, or characteristic. Furthermore, these phrases do not necessarily refer to the same embodiment. Furthermore, when a particular feature, structure, or characteristic is described in conjunction with an exemplary embodiment, it is considered to be within the knowledge of those skilled in the art to affect such feature, structure, or characteristic in conjunction with other embodiments (whether or not explicitly described).

[0027] It should be understood that although the terms "first" and "second", etc. may be used herein to describe various elements, these elements should not be limited by these terms. These terms are only used to distinguish one element from another element. For example, a first element may be referred to as a second element, and similarly, a second element may be referred to as a first element, and similarly, a second element may be referred to as a first element. As used herein, the term "and / or" includes any and all combinations of one or more of the listed terms.

[0028] The terms used herein are for the purpose of describing particular embodiments only and are not intended to limit the example embodiments. As used herein, the singular forms "a", "an", and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will also be understood that the terms "include", "comprise", "have", "have", "include" and / or "comprising" when used herein specify the presence of stated features, elements and / or components, etc., but do not exclude the presence or addition of one or more other features, elements, components and / or combinations thereof.

[0029] As used in this application, the term "circuitry" may refer to one, more than one, or all of the following:

[0030] (a) only hardware circuit implementation (e.g., only implementation in analog and / or digital circuits) and

[0031] (b) a combination of hardware circuitry and software, such as (where applicable):

[0032] (i) a combination of analog and / or digital hardware circuitry and software / firmware, and

[0033] (ii) a hardware processor (including a digital signal processor) with software, software and any portion of memory that work together to enable a device such as a mobile phone or server to perform various functions) and

[0034] (c) Hardware circuits and / or processors (e.g., a microprocessor or a portion of a microprocessor) that require software (e.g., firmware) to operate, but where software is not required to operate, the software may not be present.

[0035] This definition of circuitry applies to all uses of this term in this application, including in any claims. As another example, as used in this application, the term circuitry also covers an implementation of only a hardware circuit or processor (or multiple processors) or a portion of a hardware circuit or processor and its (or its) accompanying software and / or firmware. The term circuitry also covers (for example and if applicable to a particular claim element) a baseband integrated circuit or processor integrated circuit for a mobile device or a similar integrated circuit in a server, a cellular network device or other computing or network device.

[0036] As used herein, the term "communication network" refers to a network that follows any suitable communication standard, such as a fifth generation (5G) system, long term evolution (LTE), advanced LTE (LTE-A), wideband code division multiple access (WCDMA), high speed packet access (HSPA), narrowband Internet of Things (NB-IoT), etc. In addition, the communication between the terminal device and the network device in the communication network can be performed according to any suitable generation of communication protocols, including but not limited to the first generation (1G), the second generation (2G), 2.5G, 2.75G, the third generation (3G), the fourth generation (4G), 4.5G, the future fifth generation (5G) new radio (NR) communication protocol, and / or any other protocol currently known or to be developed in the future. The embodiments of the present disclosure can be applied to various communication systems. In view of the rapid development of communication, there are of course future types of communication technologies and systems, using which the present disclosure can be implemented. It should not be regarded as limiting the scope of the present invention to the above-mentioned systems.

[0037] As used herein, the term "network device" refers to a node in a communication network via which a terminal device accesses the network and receives services from it. Depending on the terminology and technology applied, a network device may refer to a base station (BS) or an access point (AP), such as a Node B (Node B or NB), an evolved Node B (eNodeB or eNB), a NR next-generation Node B (gNB), a remote radio unit (RRU), a radio head (RH), a remote radio head (RRH), a relay, a low-power node such as a femto base station, a pico base station, etc. The RAN split architecture includes a gNB-CU (centralized unit, controlling RRC, SDAP and PDCP) that controls multiple gNB-DUs (distributed units, controlling RLC, MAC and PHY). In addition, the term "network equipment" may also refer to network functions such as access and mobility management function (AMF), session management function (SMF), user plane function (UPF), unified data management (UDM), policy control function (PCF), network exposure function (NEF), network slice selection function (NSSF), network slice specific authentication and authorization function (NSSAAF), network repository function (NRF), unstructured data storage function (UDSF) or unified data repository (UDR).

[0038] The term "terminal device" refers to any terminal device capable of wireless communication. By way of example and not limitation, a terminal device may also be referred to as a communication device, user equipment (UE), unmanned aerial vehicle (UAV), UAV controller (UAVC), subscriber station (SS), portable subscriber station, mobile station (MS) or access terminal (AT). The terminal device may include, but is not limited to, a mobile phone, a cellular phone, a smart phone, a voice over IP (VoIP) phone, a wireless local loop phone, a tablet computer, a wearable terminal device, a personal digital assistant (PDA), a portable computer, a desktop computer, an image capture terminal device such as a digital camera, a game terminal device, a music storage and playback device, a vehicle-mounted wireless terminal device, a wireless endpoint, a mobile station, a laptop embedded device (LEE), a laptop mounted device (LME), a USB dongle, a smart device, a wireless client device (CPE), an Internet of Things (IoT) device, a watch or other wearable device, a head mounted display (HMD), a vehicle, a target, medical equipment and applications (e.g., remote surgery), industrial equipment and applications (e.g., robots and / or other wireless devices operating in an industrial and / or automated process chain environment, consumer electronic devices, devices operating on a commercial and / or industrial wireless network, etc. In the following description, the terms "terminal device", "communication device", "terminal", "UE" and "UAV" or "UAV controller" may be used interchangeably.

[0039] Although the functions described herein may be performed in fixed and / or wireless network nodes in various example embodiments, in other example embodiments, the functions may be implemented in a user equipment device (such as a cellular phone or a tablet computer or a laptop computer or a desktop computer or a mobile device or a fixed device). The user equipment device may, for example, be appropriately equipped with the corresponding capabilities described in conjunction with the fixed and / or wireless network nodes. The user equipment device may be a user device and / or a control device, such as a chipset or a processor, which is configured to control the user device when installed therein. Examples of such functions include a bootstrap server function and / or a home user server, which may be implemented in a user equipment device by providing the user equipment device with software configured to cause the user equipment device to execute from the perspective of these functions / nodes.

[0040] Figure 1An example communication network 100 in which embodiments of the present disclosure may be implemented is shown. The network 100 includes a network slice specific authentication and authorization function (NSSAAF) 101, a network slice selection function (NSSF) 102, an authentication server function (AUSF) 103, a unified data management (UDM) 104, an access and mobility management function (AMF) 105, a session management function (SMF) 106, a policy control function (PCF) 107, an application function (AF) 108, a terminal device 109, a radio access network (RAN) 110, a user plane function (UPF) 111, and a data network (DN) 112.

[0041] The UDM 104 (also referred to as the UDM device 104) may include support for the following functions: generation of 3GPP authentication certificates, user identity handling (e.g., storage and management of SUPI for each subscriber in the 5G system), support for de-hiding of the privacy-preserving subscription identifier (SUCI), access authorization based on subscription data (e.g., roaming restrictions), UE's serving NF registration management (e.g., storing the service AMF for the UE and storing the PDU session service SMF for the UE), support for service / session continuity (e.g., assigning ongoing sessions by maintaining the SMF / Data Network Name (DNN)), MT-SMS delivery support, lawful interception functionality (especially in outbound roaming scenarios where the UDM is the only contact point for the LI), subscription management, SMS management, 5G LAN group management handling, support for external parameter provisioning (expected UE behavior parameters or network configuration parameters).

[0042] AMF 105 (also referred to as AMF device 105) may include the following functions. Some or all of the AMF 105 functions may be supported in a single instance of AMF: termination of RAN control plane interface (N2), termination of NAS (N1), NAS encryption and integrity protection, registration management, connection management, reachability management, mobility management, lawful interception (for AMF events and interface to LI system), providing for the transmission of SM messages between UE and SMF, transparent proxy for routing SM messages, access authentication, access authorization, providing for the transmission of SMS messages between UE and SMSF, security anchor function (SEAF), location service management for management services, providing for the transmission of location service messages between UE and LMF and between RAN and LMF, EPS bearer ID allocation for interworking with EPS, UE mobility event notification, support for control plane CIoT 5GS optimization, support for user plane CIoT 5GS optimization, provision of external parameters (expected UE behavior parameters or network configuration parameters), and support for network slice specific authentication and authorization.

[0043] SMF 106 (also referred to as SMF device 106) may include the following functionality. Some or all of the functions of SMF 106 may be supported in a single instance of SMF: session management, such as session establishment, modification, and release, including tunnels maintained between UPF and AN nodes; UE IP address allocation and management (including optional authorization), the UE IP address may be received from the UPF or from an external data network; DHCPv4 (server and client) and DHCPv6 (server and client) functions; the function of responding to Address Resolution Protocol (ARP) requests and / or IPv6 neighbor requests based on local cache information of Ethernet PDUs, the SMF responds to ARP and / or IPv6 neighbor requests by providing the MAC address corresponding to the IP address sent in the request; selection and control of UP functions, including controlling the UPF to proxy ARP or IPv6 neighbor discovery, or forwarding all ARP / IPv6 neighbor request services to the SMF for Ethernet PDU sessions; configuring traffic steering at the UPF to route traffic to the appropriate destination, 5G Virtual Network (VN) group management, such as maintaining the topology of the PDU Session Anchor (PSA) UPFs involved, establishing and releasing PSA N19 tunnel between UPFs, configure traffic forwarding at UPF to apply local switching, N6-based forwarding or N19-based forwarding; terminate interfaces towards policy control functions, lawful interception (for SM events and LI system interfaces); support for charging data collection and charging interfaces, control and coordination of UPF charging data collection; termination of the SM part of NAS messages; downlink data notification; initiator of AN-specific SM information, sent to AN via AMF on N2; determine the SSC mode of the session; support control plane CIoT 5GS optimization, support header compression; act as ISMF in deployments where ISMF can be inserted, removed and relocated; provide external parameters (expected UE behavior parameters or network configuration parameters); support PCSCF discovery of IMS services; roaming functions; handle local implementation of application QoS SLA (VPLMN); charging data collection and charging interface (VPLMN); lawful interception (in VPLMN, SM event and LI system interface); support interaction with external DN to transmit signaling of PDU session authentication / authorization through external DN; and instruct UPF and NGRAN to perform redundant transmission on N3 / N9 interface.

[0044] PCF 107 (also referred to as PCF device 107) may include the following functions: supporting a unified policy framework to govern network behavior; providing policy rules to control plane functions to implement them; accessing subscription information related to policy decisions in a unified data repository (UDR).

[0045] The AF 108 may support interaction with the 3GPP core network to provide services, such as influencing data routing decisions, policy control functions, or providing third-party services to the network.

[0046] UPF 111 (also referred to as UPF device 111) may include the following functions. Some or all of the functions of UPF 111 may be supported in a single instance of UPF: Anchor point for Intra / InterRAT mobility (when applicable); Allocate UE IP address / prefix in response to SMF request (if supported); External PDU session interconnection point to data network; Packet routing and forwarding (for example, support uplink classifier to route traffic flow to instance of data network, support branch point to support multi-host PDU session, support traffic forwarding within 5GN group (UPF local switching, via N6, via N19)); Packet inspection (such as: application detection based on business data flow template and optional PFD received from SMF in addition); User plane portion for policy rule implementation, such as gating, redirection, traffic steering); lawful interception (UP collection); traffic usage reporting; QoS processing for the user plane, such as UL / DL rate implementation, reflective QoS marking in DL; uplink traffic verification (SDF to QoS traffic mapping); transport level packet marking in uplink and downlink; downlink packet buffering and downlink data notification triggering; sending and forwarding one or more "end markers" to the source NGRAN node; the function of responding to address resolution protocol (ARP) requests and / or IPv6 neighbor requests based on local cache information of Ethernet PDU, UPF 111 responds to ARP and / or IPv6 neighbor requests by providing the MAC address corresponding to the IP address sent in the request; packet duplication in the downlink direction and elimination in the uplink direction in the GTPU layer; TSN translator (NWTT) function; high latency communication; and ASSS control function for controlling MAPDU session services.

[0047] In addition, UPF 111 may be responsible for forwarding and receiving user data in terminal device 109. UPF 111 may receive user data from DN 112 and send it to terminal device 109 via RAN 110. UPF 111 may also receive user data from terminal device 109 via RAN 110 and forward it to DN 112. The transmission resources and scheduling functions in UPF 111 serving terminal device 109 are managed and controlled by SMF 106.

[0048] It should be understood that the number of network elements and terminal devices in network 100 is for illustration purposes only and does not imply any limitation. Network 100 may include any suitable number of network elements and terminal devices suitable for implementing embodiments of the present disclosure.

[0049] The communication in the communication network 100 may be implemented according to any appropriate communication protocol, including but not limited to cellular communication protocols of the first generation (1G), second generation (2G), third generation (3G), fourth generation (4G) and fifth generation (5G), wireless local area network communication protocols such as Institute of Electrical and Electronics Engineers (IEEE) 802.11, and / or any other protocol currently known or developed in the future. In addition, the communication may utilize any appropriate wireless communication technology, including but not limited to: code division multiple access (CDMA), frequency division multiple access (FDMA), time division multiple access (TDMA), frequency division duplex (FDD), time division duplex (TDD), multiple input multiple output (MIMO), orthogonal frequency division multiplexing (OFDM), discrete Fourier transform spread OFDM (DFT-s-OFDM) and / or any other technology currently known or to be developed in the future.

[0050] As mentioned above, a major issue is the authentication and authorization of terminal devices via 5GS. Figure 2 A signaling diagram of a process 200 for authentication and authorization of a terminal device 109 according to a conventional scheme is shown. In the process 200, authentication and authorization are performed via a 5GS user plane, and the terminal device 109 may include a UAV or a UAVC.

[0051] The terminal device 109 performs registration to the network (201). The terminal device 109 requests (202) a PDU session establishment, or the PCF 107 provides the UPF 111 with PCC rules for the terminal device 109 via the SMF 106.

[0052] The application on the terminal device 109 starts (203). The terminal device 109 sends (204-1) an authentication and authorization request to the UASAF 113 via the user interface. Accordingly, the UASAF 113 receives (204-2) the request. The UASAF 113 requests (205) subscription information specific to the terminal device 109 from the UDM 104 and / or PCF / BSF 107.

[0053] The UASAF 113 checks whether the terminal device 109 has a valid over-the-air subscription based on the subscription information received from the UDM 104. If the check is successful, the UASAF 113 determines the UTM / USS 114 serving the terminal device 109 based on the subscription information and triggers (206-1) an authentication and authorization (also known as A&A) request to the UTM / USS 114. Accordingly, the UTM / USS 114 receives (206-2) the request. The request may contain an indication of the mobile operator used and the 3GPP identity of the terminal device 109. If the check is unsuccessful, a response is sent to the terminal device 109 rejecting the request.

[0054] UTM / USS 114 uses the combined information from terminal device 109 and from the mobile network operator of terminal device 109 to check ( 207 ) the request from UASAF 113 for an operation of terminal device 109 .

[0055] If the check that the terminal device 109 has a valid over-the-air subscription is successful, the UTM / USS 114 sends (208-1) an acceptance response to the UASAF 113. Accordingly, the UASAF 113 receives (208-2) the acceptance response. The response may include information specific to the application on the terminal device 109. For example, the information may include a token to be included in subsequent application content interactions for authentication reasons. If the check is unsuccessful, a response is sent to the UASAF to reject the request.

[0056] The UASAF 113 forwards (209-1) the response from the UTM / USS 114 to the terminal device 109 as a response to the authentication and authorization request. Accordingly, the terminal device 109 receives (209-2) the response.

[0057] For example, the terminal device 109 triggers establishment of a secure connection to the UTM / USS 114 using the token received in the response.

[0058] Operations of the terminal device 109 may be handled via a secure connection between the terminal device 109 and the UTM / USS 114 (211).

[0059] like Figure 2 As shown, the terminal device 109 performs normal 5G registration, establishes a PDU connection, and then sends an authentication and authorization request to the UASAF 113. The request is then forwarded to the UTM / USS 114. The 5G core network is not directly involved in the authentication and authorization process. Accordingly, the 5G core network is not aware of the results of the authentication and authorization.

[0060] However, in order to support UAS regarding connectivity, identification and tracking, the network (e.g. AMF, gNB) should know whether the terminal device 109 is authorized in the target domain. That is, the results of authentication and authorization from UTM / USS114 need to be provided to the 3GPP system that provides connectivity.

[0061] In order to at least partially solve the above and other potential problems, an exemplary embodiment of the present disclosure provides a scheme for notifying a device (e.g., a network device) about the results of authentication and authorization of another device (e.g., a terminal device). In this scheme, a first device receives a notification from a second device. The notification indicates the result of authentication and authorization performed by the second device on a third device. The first device then updates the policy for communication between the third device and the data network based on the result. The scheme allows 5GS to set policies and control the exchange of messages between UAVs (e.g., advertisements sent from a UAV to all other nearby UAVs) or between UAVCs and UAVs via a 5G network.

[0062] The following will refer to Figures 3 to 5 The principles and implementations of the present disclosure are described in detail. Figure 3 A signaling diagram illustrating a process 300 for notifying a device about the results of authentication and authorization of another device according to some example embodiments of the present disclosure is shown.

[0063] The second device 302 performs ( 310 ) authentication and authorization on the third device.

[0064] After completing the authentication and authorization, the second device 302 sends (320) a notification to the first device 301. Accordingly, the first device 301 receives (330) a notification from the second device 302. The notification indicates the result of the authentication and authorization.

[0065] The first device 301 updates (340) a policy for communication between the third device and the DN based on the result.

[0066] In some example embodiments, the notification includes an identification of the third device. In order to receive the result of the authentication and authorization, the first device 301 may send a subscription request for the result to the second device 302. The subscription request includes the identification of the third device.

[0067] In some example embodiments, the first device 301 may determine whether the result indicates success of authentication and authorization. If the result indicates success of authentication and authorization, the first device 301 may obtain a first policy for mobility management of the third device and update the above-mentioned policy for communication using the first policy. In some example embodiments, the first device 301 may locally install the first policy in order to update the above-mentioned policy for communication.

[0068] In some example embodiments, the notification further indicates an association between the third device and the fourth device. The third device is controlled by the fourth device, or the fourth device is controlled by the third device. In some example embodiments, the third device includes Figure 1In some example embodiments, the third device comprises a UAV and the fourth device comprises a UAVC. Alternatively, the third device comprises a UAVC and the fourth device comprises a UAV.

[0069] In some example embodiments, if the result indicates success of authentication and authorization, the first device 301 establishes a packet data unit (PDU) session for communication between the third device and the fourth device based on the association between the third device and the fourth device.

[0070] In some example embodiments, if the result indicates success of authentication and authorization, the first device 301 configures the UPF device 111 based on the association between the third device and the fourth device to route traffic between the second device 302 and the third device.

[0071] In some example embodiments, if the result indicates a failure of authentication and authorization, the first device 301 terminates the PDU session for communication between the third device and the DN.

[0072] In some example embodiments, if the result indicates a failure of authentication and authorization, the first device 301 modifies the policy in the UPF device 111 to enable the third device to communicate only with the second device 302 .

[0073] In some example embodiments, the first device 301 may receive the notification via a network open function (NEF) device, which will be referred to below. Figure 4 and 5 Give a description.

[0074] In some example embodiments, the first device 301 may receive the notification via a service capability exposure function (SCEF) device or a machine type communication interworking function (MTC-IWF) device.

[0075] In some example embodiments, the first device 301 includes the AMF device 105. Upon receiving the notification, the first device 301 forwards the notification to at least one of the following: Figure 4 Describe the UDM device 104, the SMF device 105 or the policy control function device.

[0076] Figure 4 A signaling diagram illustrating a process 400 for notifying a device of the results of authentication and authorization of another device according to other example embodiments of the present disclosure is shown. Figure 4 As shown, process 400 may involve implementing Figure 3 The first device 301 in Figure 1 AMF 105 in Implementation Figure 3 The UTM / USS 114 of the second device 302 in the embodiment of the present invention, and the UTM / USS 114 of the third device Figure 1 In addition, the process 400 may also include: Figure 1 For the purpose of this discussion, reference will be made to UDM 104, SMF 106, and NEF 115. Figure 1 A communication process 400 is described.

[0077] The terminal device 109 sends (401-1) a registration request message to the AMF 105. Accordingly, the AMF 105 receives (401-2) the registration request.

[0078] In some example embodiments, the registration request may optionally include an indication of the type of terminal device 109. For example, in the case where the terminal device 109 is a UAV, the message may include an indication that the terminal device 109 is a UAV. In the case where the terminal device 109 is a UAVC, the message may include an indication that the terminal device 109 is a UAVC.

[0079] In some example embodiments, the indication of the type of terminal device 109 may be provided by the terminal device 109 using, for example, NAS signalling or stored in the UDM 104 .

[0080] The AMF 105 obtains (402) subscriber data from the UDM 104 and the AMF 105 performs an IMEI check. In some example embodiments, the subscriber data may include an indication of the type of the terminal device 109. In some example embodiments, the subscriber data may include an identification of the UAS to which the terminal device 109 belongs.

[0081] The AMF 105 sends (403-1) a Registration Accept message to the terminal device 109. The message may optionally include an indication of the type of the terminal device 109. Accordingly, the type of the terminal device 109 indicates receipt (403-2) of the Registration Accept message.

[0082] The AMF 105 optionally sends (404-1) a subscription request to the UTM / USS 114 and / or the UAS / AF (not shown) to be notified of the results of the authentication and authorization of the terminal device 109. The AMF 105 may send the subscription request directly to the UTM / USS 114 and / or the UAS / AF. Alternatively, the AMF 105 may send the subscription request to the UTM / USS 114 and / or the UAS / AF via the NEF 115. Accordingly, the UTM / USS 114 receives (404-2) the subscription request.

[0083] In some example embodiments, NEF 115 may support the opening of capabilities and events. For example, NF capabilities and events may be securely opened by NEF 115 for use by, for example, third parties, application functions, edge computing. NEF 115 stores / retrieves information as structured data using a standardized interface (Nudr) to a unified data repository (UDR).

[0084] NEF 115 can support the secure provision of information from external applications to the 3GPP network. For example, NEF 115 provides means for application functions to securely provide information to the 3GPP network, such as expected UE behavior, 5G LAN group information, and service-specific information. In this case, NEF 115 can authenticate, authorize, and help suppress application functions.

[0085] NEF 115 may support conversion of internal-external information. For example, NEF 115 converts between information exchanged with AF and information exchanged with internal network functions. For example, NEF 115 converts between AF service identifiers and internal 5G core information such as DNN, S-NSSAI. Specifically, NEF 115 handles shielding of network and user sensitive information of external AF according to network policies.

[0086] NEF 115 can receive information from other network functions (based on the open capabilities of other network functions). NEF 115 can store the received information as structured data using a standardized interface to a unified data repository (UDR). The stored information can be accessed by NEF 115 and "reopened" to other network functions and application functions and used for other purposes such as analysis.

[0087] NEF 115 may also support a PFD function. The PFD function in NEF 115 may store and retrieve PFDs in UDRs and shall provide PFDs to SMFs upon request of SMF (pull mode) or upon request of NEF's PFD management (push mode).

[0088] NEF 115 may also support a 5GLAN group management function. The 5GLAN group management function in NEF may store the 5GLAN group information in the UDR through the UDM.

[0089] NEF 115 may also support the opening of analytics. NWDAF analytics may be securely opened by the NEF to external parties.

[0090] NEF 115 may also support NWDAF in acquiring data from external parties. For the purpose of analysis generation, NWDAF may collect data provided by external parties through NEF 115. NEF 115 processes and forwards requests and notifications between NWDAF and AF.

[0091] NEF 115 may also support non-IP data delivery. NEF 115 provides means for managing NIDD configuration and delivering MO / MT unstructured data by exposing NIDD API over N33 / Nnef reference point.

[0092] In some example embodiments, the subscription request message may include an identification of the terminal device 109 .

[0093] In some example embodiments, the identity of the terminal device 109 includes one of the following: an identity of the UAS to which the terminal device 109 belongs, a general public user identity (GPSI) of the terminal device 109, or a user permanent identity (SUPI) of the terminal device 109.

[0094] The terminal device 109 requests (405) PDU session establishment to the AMF 105, SMF 106 and UPF 111. The PCF 107 provides the PCC rules for the terminal device 109 to the UPF 111 through the SMF 106.

[0095] Authentication and authorization processes 406 for the terminal device 109 are exchanged between the terminal device 109 and the UAS / AF and / or UTM / USS 114. Control of access to the UTM / USS 114 may be achieved by using special data network names (DNNs) and / or using special slices or predefined policies in the UPF 111.

[0096] The UAS / AF and / or UTM / USS 114 sends (407-1) a notification to the NEF 115. The network address of the UAS / AF and / or UTM / USS 114 may be stored in the UDM 104 or locally in the NEF 115 per UE. The network address of the NEF 115 may be pre-configured. Alternatively, the UTM / USS 114 may use other techniques (e.g., DNS resolution) to receive the network address of the NEF 115. The notification indicates the result of the authentication and authorization of the terminal device 109. Accordingly, the NEF 115 receives (407-2) the notification.

[0097] In some example embodiments, the network addresses of AMF 105, SMF 106, and PCF 107 may be stored in UDM 104. Thus, NEF 115 may look up UDM 104 to obtain the network addresses of AMF 105, SMF 106, and PCF 107, and forward the notification to one or more of these network functions. In process 400, NEF 115 forwards (408-1) the notification to AMF 105. Accordingly, AMF 105 receives (408-2) the notification.

[0098] AMF 105 forwards (409-1) the notification to UDM 104. Accordingly, UDM 104 receives (409-2) the notification.

[0099] AMF 105 forwards (410-1) the notification to SMF 106. Accordingly, SMF 106 receives (410-2) the notification.

[0100] In some example embodiments, the notification includes an identification of the terminal device 109 .

[0101] In some example embodiments, the notification includes additional data related to the terminal device 109. In some example embodiments, the additional data may include at least one of: an allowed flight path associated with an identification of a cell serving the third device, a tracking area associated with the terminal device 109, an allowed flight altitude of the terminal device 109, an allowed flight speed of the terminal device 109, an allowed mobility behavior of the terminal device 109, or a capability of the terminal device 109.

[0102] In some example embodiments, the notification also indicates an association between the terminal device 109 and a fourth device that controls the terminal device 109. For example, the notification may indicate an association between the UAV 109 and the UAVC.

[0103] Upon receiving the notification, AMF 105, SMF 106, and PCF 107 may store the result locally as part of the context of terminal device 109. Alternatively, AMF 105, SMF 106, and PCF 107 may store the result in an Unstructured Data Storage Function (UDSF).

[0104] Furthermore, upon receiving the notification, AMF 105, SMF 106 and PCF 107 may take appropriate actions based on the result.

[0105] In some example embodiments, the actions may be pre-configured in the network, or the AF or UTM / USS 114 may indicate the actions to be taken to the AMF 105, SMF 106, and PCF 107 via the NEF 115 as part of the notification or in an additional message.

[0106] In some example embodiments, if the result indicates success of authentication and authorization, the AMF 105 may obtain a first policy for mobility management of the terminal device 109 from the PCF 111. The AMF 105 may utilize the first policy to update the policy for communication between the terminal device 109 and the fourth device controlling the terminal device 109. In some example embodiments, the first device 301 may install the first policy locally to update the policy for the above communication. This allows the 5GS to set policies and control message exchanges between UAVs (e.g., advertisements sent from a UAV to all other nearby UAVs) or between UAVVCs and UAVs via the 5G network.

[0107] In some example embodiments, the first policy may include a paging policy for the terminal device 109 or a fourth device controlling the terminal device 109. For example, the paging policy may define paging in certain areas only, or step-by-step paging.

[0108] In some example embodiments, if the result indicates success of authentication and authorization, AMF 105 or SMF 106 may determine to establish or modify a PDU session for communication between the terminal device 109 and the UTM / USS 114 based on the association between the terminal device 109 and the fourth device.

[0109] In some example embodiments, if the result indicates a failure of authentication and authorization, the AMF 105 or SMF 106 may configure the UPF 111 based on the association to route traffic between the UTM / USS 114 and the terminal device 109. In this way, routing for command and control communications may be optimized.

[0110] In some example embodiments, if the result indicates a failure of authentication and authorization, the AMF 105 may terminate the PDU session used for communication between the terminal device 109 and the DN 112.

[0111] In some example embodiments, if the result indicates a failure of authentication and authorization, SMF 106 may modify the policy in UPF 111 so that terminal device 109 communicates only with UTM / USS 114 or other servers.

[0112] In some example embodiments, if the result indicates a failure of authentication and authorization, SMF 106 may install (411) one or more policies for terminal device 109 in UPF 111. For example, SMF 106 may install one or more policies with the help of PCF 107.

[0113] In some example embodiments, the network address of the AF or UTM / USS 114 may be stored per UE in the UDM 104 or locally in the NEF 115. The network address of the NEF 115 may be obtained from the UDM 104 by looking up the Network Repository Function (NRF) or locally configured in the AMF 105, SMF 106, or PCF 107.

[0114] It should be understood that the communication process 400 is also applicable to other communication scenarios. For example, the communication process 400 can be equally applied to an evolved UMTS terrestrial radio access network (E-UTRAN) or an evolved packet core (EPC). Applicability to E-UTRAN or EPC can be achieved by replacing UDM 104 with a home subscriber server (HSS), replacing AMF 105 or SMF 106 with a mobility management entity (MME), replacing NEF 115 with a service capability exposure function (SCEF) and / or MTC-IWF, replacing UPF 111 with a packet data network gateway (PGW), and replacing PCF 107 with a policy control and charging rules function (PCRF).

[0115] Figure 5 2 is a signaling diagram illustrating a process 500 for notifying a device of the results of authentication and authorization of another device according to other example embodiments of the present disclosure. Figure 5 As shown, process 500 may involve implementing Figure 3 The first device 301 in Figure 1 UDM 104, implementation Figure 3 The UTM / USS 114 of the second device 302 in the embodiment of the present invention, and the UTM / USS 114 of the third device Figure 1 In addition, the process 500 may also include: Figure 1 For the purpose of this discussion, reference will be made to AMF 105, SMF 106 and NEF 115. Figure 1 A communication process 500 is described.

[0116] In summary, process 500 is similar to process 400. However, process 500 differs from process 400 in that, in process 500, UTM / USS 114 sends a notification to UDM 104 via NEF 115. UDM 104 forwards the notification to AMF 105, which then forwards the notification to SMF 106. Specifically, NEF 115 receives (407-2) the notification from UTM / USS 114. NEF 115 forwards (503-1) the notification to UDM 104. Accordingly, UDM 104 receives (503-2) the notification. UDM 104 forwards (504-1) the notification to AMF 105. Accordingly, AMF 105 receives (504-2) the notification.

[0117] Process 500 also differs from process 400 in that, in process 500, in order to be notified about the results of authentication and authorization, AMF 105 sends (501-1) a subscription request to UTM / USS 114 and / or UAS / AF (including the address of UDM 104) on behalf of UDM 104. Accordingly, UTM / USS 114 receives (501-2) the subscription request. Alternatively, UDM 104 directly sends (502-1) a subscription request to UTM / USS 114 and / or UAS / AF. Accordingly, UTM / USS 114 receives (502-2) the subscription request.

[0118] Figure 6 A flow chart of a method 600 for notifying a device of a result of authentication and authorization of another device according to some embodiments of the present disclosure is shown. The method 600 may be implemented at a first device.

[0119] At block 610, the first device receives a notification from the second device. The notification indicates a result of authentication and authorization performed by the second device on the third device.

[0120] At block 620 , the first device updates a policy for communication between the third device and the data network based on the results of the authentication and authorization.

[0121] In some example embodiments, the method 600 further comprises sending a subscription request for the result from the first device to the second device. The subscription request comprises an identification of the third device.

[0122] In some example embodiments, the identifier of the third device includes one of the following: an identifier of an unmanned aerial system to which the third device belongs, a universal public user identifier of the third device, or a user permanent identifier of the third device.

[0123] In some example embodiments, the first device updates the policy for communication by obtaining a first policy for mobility management of the third device if the result indicates success of authentication and authorization, and updating the policy for communication using the first policy.

[0124] In some example embodiments, the notification further indicates an association between the third device and the fourth device, the third device being controlled by the fourth device, or the fourth device being controlled by the third device.

[0125] In some example embodiments, the method 600 further includes establishing a first packet data unit session for communication between the third device and the second device and a second packet data unit session for communication between the fourth device and the second device based on the association if the result indicates success of authentication and authorization.

[0126] In some example embodiments, the method 600 further comprises configuring a user plane functional device based on the association to route traffic between the second device and the third device.

[0127] In some example embodiments, the method 600 further includes terminating a packet data unit session for communications between the third device and the data network if it is determined that the result indicates a failure of authentication and authorization.

[0128] In some example embodiments, the method 600 further includes: if it is determined that the result indicates a failure of authentication and authorization, modifying a policy in the user plane functional device to enable the third device to communicate only with the second device.

[0129] In some example embodiments, the first device receives the notification by receiving the notification via one of: a network open function device, a service capability open function device, or a machine type communication interworking function device.

[0130] In some example embodiments, the first device comprises an access and mobility management function device, and the method 600 further comprises forwarding the notification to at least one of: a unified data management device, a session management function device, or a policy control function device.

[0131] In some example embodiments, the first device includes a unified data management device, and the method 600 also includes forwarding the notification to at least one of: an access and mobility management function device, via the access and mobility management function device to a session management function device, or via the access and mobility management function device to a policy control function device.

[0132] In some example embodiments, the second device comprises an unmanned aerial system traffic management device and the third device comprises a drone or a drone controller.

[0133] In some example embodiments, the notification also includes at least one of: an allowed flight path associated with an identification of a cell serving the third device, a tracking area associated with the third device, an allowed flight altitude of the third device, an allowed flight speed of the third device, allowed mobility behavior of the third device, or capabilities of the third device.

[0134] Figure 7 A flow chart of a method 700 for notifying a device of a result of authentication and authorization of another device according to some embodiments of the present disclosure is shown. The method 700 may be implemented at the second device.

[0135] At block 710 , the second device performs authentication and authorization on the third device.

[0136] At block 720 , the second device sends a notification to the first device indicating the result of the authentication and authorization.

[0137] In some example embodiments, the method 700 further comprises: receiving a subscription request for the result from the first device, the subscription request comprising an identification of the third device.

[0138] In some example embodiments, the identifier of the third device includes one of the following: an identifier of an unmanned aerial system to which the third device belongs, a universal public user identifier of the third device, or a user permanent identifier of the third device.

[0139] In some example embodiments, the notification further indicates an association between the third device and the fourth device, the third device being controlled by the fourth device, or the fourth device being controlled by the third device.

[0140] In some example embodiments, sending the notification includes sending the notification via one of: a network open function device, a service capability open function device, or a machine type communication interworking function device.

[0141] In some example embodiments, the first device comprises an access and mobility management function device or a unified data management device, the second device comprises an unmanned aerial system traffic management device, and the third device comprises a unmanned aerial vehicle or a unmanned aerial vehicle controller.

[0142] In some example embodiments, the notification also includes at least one of: an allowed flight path associated with an identification of a cell serving the third device, a tracking area associated with the third device, an allowed flight altitude of the third device, an allowed flight speed of the third device, allowed mobility behavior of the third device, or capabilities of the third device.

[0143] In some example embodiments, an apparatus capable of performing any of the methods 600 (e.g., a first device) may include a component for performing the corresponding steps of the method 600. The component may be implemented in any suitable form. For example, the component may be implemented in a circuit or a software module.

[0144] In some example embodiments, the apparatus includes: means for receiving, at a first device, a notification from a second device, the notification indicating a result of authentication and authorization performed by the second device for a third device; and means for updating a policy for communication between the third device and a data network based on the result of the authentication and authorization.

[0145] In some example embodiments, the apparatus further comprises means for sending a subscription request for the result from the first device to the second device. The subscription request comprises an identification of the third device.

[0146] In some example embodiments, the identifier of the third device includes one of the following: an identifier of an unmanned aerial system to which the third device belongs, a universal public user identifier of the third device, or a user permanent identifier of the third device.

[0147] In some example embodiments, the first device updates the policy for the communication by obtaining a first policy for mobility management of the third device if determining that the result indicates success of authentication and authorization, and updating the policy for the communication using the first policy.

[0148] In some example embodiments, the notification further indicates an association between the third device and the fourth device, the third device being controlled by the fourth device, or the fourth device being controlled by the third device.

[0149] In some example embodiments, the apparatus further comprises means for establishing, based on the association, a first packet data unit session for communication between the third device and the second device and a second packet data unit session for communication between the fourth device and the second device in accordance with the determination result indicating success of the authentication and the authorization.

[0150] In some example embodiments, the apparatus further comprises means for configuring a user plane functional device to route traffic between the second device and the third device based on the association.

[0151] In some example embodiments, the apparatus further comprises means for terminating a packet data unit session for communication between the third device and the data network if the determination result indicates a determination of authentication and authorization failure.

[0152] In some example embodiments, the apparatus further comprises means for modifying a policy in the user plane functional device to enable the third device to communicate only with the second device if it is determined that the result indicates a determination of authentication and authorization failure.

[0153] In some example embodiments, the means for receiving the notification includes means for receiving the notification via one of: a network open function device, a service capability open function device, or a machine type communication interworking function device.

[0154] In some example embodiments, the first device comprises an access and mobility management function device, and the apparatus further comprises means for forwarding the notification to at least one of: a unified data management device, a session management function device, or a policy control function device.

[0155] In some example embodiments, the first device includes a unified data management device, and the apparatus further includes a component for forwarding the notification to at least one of: an access and mobility management function device, to a session management function device via the access and mobility management function device, or to a policy control function device via the access and mobility management function device.

[0156] In some example embodiments, the second device comprises an unmanned aerial system traffic management device, and the third device comprises a drone or a drone controller.

[0157] In some example embodiments, the notification also includes at least one of: an allowed flight path associated with an identification of a cell serving the third device, a tracking area associated with the third device, an allowed flight altitude of the third device, an allowed flight speed of the third device, allowed mobility behavior of the third device, or capabilities of the third device.

[0158] In some example embodiments, an apparatus (e.g., a second device) capable of performing any of the methods 700 may include a component for performing each step of the method 700. The component may be implemented in any suitable form. For example, the component may be implemented in a circuit or a software module.

[0159] In some example embodiments, the apparatus includes: means for performing authentication and authorization of the third device at the second device; and means for sending a notification to the first device, the notification indicating a result of the authentication and authorization.

[0160] In some example embodiments, the apparatus further comprises: receiving a subscription request for the result from the first device, the subscription request comprising an identification of the third device.

[0161] In some example embodiments, the identifier of the third device includes one of the following: an identifier of an unmanned aerial system to which the third device belongs, a universal public user identifier of the third device, or a user permanent identifier of the third device.

[0162] In some example embodiments, the notification further indicates an association between the third device and the fourth device, the third device being controlled by the fourth device, or the fourth device being controlled by the third device.

[0163] In some example embodiments, the means for sending the notification includes means for sending the notification via one of: a network open function device, a service capability open function device, or a machine type communication interworking function device.

[0164] In some example embodiments, the first device comprises an access and mobility management function device or a unified data management device, the second device comprises an unmanned aerial system traffic management device, and the third device comprises a unmanned aerial vehicle or a unmanned aerial vehicle controller.

[0165] In some example embodiments, the notification also includes at least one of: an allowed flight path associated with an identification of a cell serving the third device, a tracking area associated with the third device, an allowed flight altitude of the third device, an allowed flight speed of the third device, allowed mobility behavior of the third device, or capabilities of the third device.

[0166] Figure 8 800 is a simplified block diagram of a device 800 suitable for implementing an embodiment of the present disclosure. The device 800 may be provided to implement a communication device, such as the first device 301, the second device 302, the AMF 105, the UDM 104, the SMF 106, or the PCF 107. As shown, the device 800 includes one or more processors 810, one or more memories 820 coupled to the processor 810, and one or more communication modules 840 coupled to the processor 810.

[0167] The communication module 840 is used for two-way communication. The communication module 840 has at least one antenna to facilitate communication. The communication interface may represent any interface required to communicate with other network elements.

[0168] Processor 810 may be of any type suitable for the local technology network and may include one or more of the following: as non-limiting examples, a general purpose computer, a special purpose computer, a microprocessor, a digital signal processor (DSP), and a processor based on a multi-core processor architecture. Device 800 may have multiple processors, such as application specific integrated circuit chips that are time slaved to a clock that synchronizes a main processor.

[0169] The memory 820 may include one or more non-volatile memories and one or more volatile memories. Examples of non-volatile memories include, but are not limited to, read-only memory (ROM) 824, electrically programmable read-only memory (EPROM), flash memory, hard disk, compact disk (CD), digital video disk (DVD), and other magnetic and / or optical memories. Examples of volatile memories include, but are not limited to, random access memory (RAM) 822 and other volatile memories that do not persist over the duration of a power outage.

[0170] Computer program 830 includes computer executable instructions executed by associated processor 810. Program 830 may be stored in ROM 820. Processor 810 may perform any suitable actions and processes by loading program 830 into RAM 820.

[0171] The embodiments of the present disclosure can be implemented by means of program 830, so that the device 800 can execute the following steps: Figures 6 to 7 Any process of the present disclosure discussed. The embodiments of the present disclosure may also be implemented by hardware or a combination of software and hardware.

[0172] In some embodiments, the program 830 may be tangibly embodied in a computer-readable medium that may be included in the device 800 (e.g., in the memory 820) or in other storage devices accessible by the device 800. The device 800 may load the program 830 from the computer-readable medium to the RAM 822 for execution. The computer-readable medium may include any type of tangible non-volatile memory, such as ROM, EPROM, flash memory, hard disk, CD, DVD, etc. Fig. 9 An example of a computer readable medium 900 in the form of a CD or DVD is shown. The computer readable medium has a program 830 stored thereon.

[0173] It should be understood that future networks may utilize network function virtualization (NFV), which is a network architecture concept that proposes virtualizing network node functions into "building blocks" or entities that can be operationally connected or linked together to provide services. A virtualized network function (VNF) may include one or more virtual machines that use standard or general-purpose servers rather than custom hardware to run computer program code. Cloud computing or data storage may also be used. In radio communications, this may mean node operations to be performed at least in part in a central / centralized unit CU (e.g., a server, host, or node) that is operably coupled to a distributed unit DU (e.g., a radio head / node). Node operations may also be distributed among multiple servers, nodes, or hosts. It should also be understood that the allocation of labor between core network operations and base station operations may vary depending on the implementation.

[0174] In one embodiment, the server can generate a virtual network through which the server communicates with the distributed units. In general, virtual networking can involve the process of combining hardware and software network resources and network functions into a single software-based management entity (virtual network). Such a virtual network can provide a flexible distribution of operations between servers and wireless heads / nodes. In fact, any digital signal processing task can be performed in the CU or DU, and the boundaries of transferring responsibilities between the CU and DU can be selected based on the implementation.

[0175] Accordingly, in one embodiment, a CU-DU architecture is implemented. In this case, the device 800 may be included in a central unit (e.g., a control unit, an edge cloud server, a server) that is operably coupled (e.g., via a wireless or wired network) to a distributed unit (e.g., a remote radio head / node). That is, the central unit (e.g., an edge cloud server) and the distributed units may be independent devices that communicate with each other via a radio path or via a wired connection. Alternatively, they may be in the same entity that communicates via a wired connection, etc. The edge cloud or edge cloud server may serve multiple distributed units or radio access networks. In one embodiment, at least some of the processes may be performed by the central unit. In another embodiment, the device 800 may alternatively be included in a distributed unit, and at least some of the processes may be performed by the distributed unit.

[0176] In one embodiment, the execution of at least some functions of the device 800 can be shared between two physically separate devices (DU and CU) that form an operational entity. Accordingly, it can be seen that the apparatus describes an operational entity comprising one or more physically separate devices for performing at least some of the described processes. In one embodiment, such a CU-DU architecture can provide a flexible distribution of operations between the CU and the DU. In fact, any digital signal processing task can be performed in the CU or the DU, and the boundaries for transferring responsibilities between the CU and the DU can be selected based on the implementation. In one embodiment, the device 800 controls the execution of the process regardless of the location of the device and regardless of where the process / function is executed.

[0177] In general, various embodiments of the present disclosure may be implemented in hardware or dedicated circuits, software, logic, or any combination thereof. Some aspects may be implemented in hardware, while other aspects may be implemented in firmware or software, which may be executed by a controller, microprocessor, or other computing device. Although various aspects of the embodiments of the present disclosure are shown and described as block diagrams, flow charts, or using some other graphical representations, it should be understood that the blocks, devices, systems, techniques, or methods described herein may be implemented in hardware, software, firmware, dedicated circuits or logic, general hardware or controllers or other computing devices, or some combination thereof, as non-limiting examples.

[0178] The present disclosure also provides at least one computer program product tangibly stored on a non-transitory computer readable storage medium. The computer program product includes computer executable instructions, such as instructions included in a program module executed in a device on a target real or virtual processor to perform the above referenced Figure 6-7 The method 600 or 700 described. In general, program modules include routines, programs, libraries, objects, classes, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The functions of program modules can be combined or separated between program modules as needed in various embodiments. The machine executable instructions of program modules can be executed in local or distributed devices. In distributed devices, program modules can be located in local and remote storage media.

[0179] The program code for executing the method of the present disclosure can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer or other programmable data processing device so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code can be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine, partially on a remote machine, or entirely on a remote machine or server.

[0180] In the context of the present disclosure, computer program codes or related data may be carried by any suitable carrier to enable a device, apparatus or processor to perform various processes and operations as described above. Examples of carriers include signals, computer readable media, etc.

[0181] The computer readable medium may be a computer readable signal medium or a computer readable storage medium. The computer readable medium may include, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared or semiconductor system, apparatus or device, or any suitable combination of the foregoing. More specific examples of computer readable storage media would include an electrical connection having one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0182] In addition, although operations are described in a particular order, this should not be understood as requiring the specific order shown or to perform these operations in sequence, or to perform all the operations shown, to achieve the desired result. In some cases, multitasking and parallel processing may be advantageous. Similarly, although several specific implementation details are included in the above discussion, these details should not be interpreted as limitations on the scope of the present disclosure, but should be interpreted as descriptions of features peculiar to a particular embodiment. Certain features described in the context of a separate embodiment may also be implemented in combination in a single embodiment. On the contrary, the various features described in the context of a single embodiment may also be implemented in multiple embodiments individually or in any suitable sub-combination.

[0183] Although the disclosure has been described in language specific to structural features and / or methodological actions, it should be understood that the disclosure defined in the appended claims is not necessarily limited to the specific features or actions described above. Instead, the specific features and actions described above are disclosed as example forms of implementing the claims.

Claims

1. A first device for communication, comprising: at least one processor; as well as at least one memory including computer program code; The at least one memory and the computer program code are configured to, with the at least one processor, cause the first device to: receiving a notification from a second device indicating a result of an authentication and authorization performed involving the second device and a third device, wherein the notification further indicates an association between the third device and a fourth device, the third device being controlled by the fourth device, or the fourth device being controlled by the third device; and updating a policy for communication between the third device and the fourth device based on the results of the authentication and authorization, The first device is further configured to: in accordance with determining that the result indicates success of the authentication and authorization, configuring a user plane functional device based on the association to route traffic between the third device and the fourth device and to forward a request for: establishing a packet data unit session for communication between the third device and the fourth device based on the association; Based on determining that the result indicates a failure of the authentication and authorization, a policy in a user plane functional device is modified to enable the third device to communicate only with the second device.

2. The first device according to claim 1, wherein the first device is further configured to: A subscription request for the result of the authentication and authorization of the third device is sent to the second device, where the subscription request includes an identifier of the third device.

3. The first device of claim 1, wherein the notification further comprises one of the following: an identification of the third device, The identifier of the UAV system to which the third device belongs, or An identifier of a group of drone systems, wherein the third device belongs to a drone system in the group.

4. The first device according to claim 2 or 3, wherein the identification of the third device comprises one of the following: The identifier of the drone system to which the third device belongs, an identifier capable of uniquely identifying the third device in the drone system, the universal public user identity of the third device, or A permanent identifier of a user of the third device.

5. The first device of claim 1 , wherein the first device is caused to update the policy for communication by: If it is determined that the result indicates success of the authentication and authorization, then: obtaining a first policy for mobility management of the third device, and The policy for communicating is updated using the first policy.

6. The first device of claim 1 , wherein the first device is caused to receive the notification by receiving the notification via one of: Network exposure function equipment, Service capability exposure function equipment, or Machine type communication interoperability device.

7. The first device of claim 1 , wherein the first device comprises an access and mobility management function device, and the first device is further caused to forward the notification to at least one of: Unified data management equipment, Session management function device, or Policy control function equipment.

8. The first device of claim 1, wherein the first device comprises a unified data management device, and the first device is further caused to forward the notification to at least one of: Access and mobility management functional equipment, Session management function device, via the access and mobility management function device to the session management function device, Policy control function device, or Via the access and mobility management function device to the policy control function device.

9. The first device of claim 1, wherein the second device comprises an unmanned aerial system traffic management device, and the third device comprises a drone or a drone controller.

10. The first device according to claim 1, wherein the notification further comprises at least one of the following: an allowed flight path associated with an identification of a cell serving said third device, a tracking area associated with the third device, the allowed mobility behavior of the third device, or capabilities of the third device.

11. A method for communication, comprising: receiving, at a first device, a notification from a second device, the notification indicating a result of authentication and authorization performed by the second device for a third device, wherein the notification further indicates an association between the third device and a fourth device, the third device being controlled by the fourth device, or the fourth device being controlled by the third device; updating a policy for communication between the third device and the fourth device based on the results of the authentication and authorization; in accordance with determining that the result indicates success of the authentication and authorization, configuring a user plane functional device based on the association to route traffic between the third device and the fourth device and to forward a request for: establishing a packet data unit session for communication between the third device and the fourth device based on the association; as well as Based on determining that the result indicates a failure of the authentication and authorization, a policy in a user plane functional device is modified to enable the third device to communicate only with the second device.

12. An apparatus for communication, comprising: means for receiving, at a first device, a notification from a second device, the notification indicating a result of an authentication and authorization performed by the second device with respect to a third device, wherein the notification further indicates an association between the third device and a fourth device, the third device being controlled by the fourth device, or the fourth device being controlled by the third device; as well as means for updating a policy for communication between said third device and a data network based on said results of said authentication and authorization; means for: in response to determining that the result indicates success of the authentication and authorization, configuring a user plane functional device based on the association to route traffic between the third device and the fourth device, and forwarding a request for: establishing a packet data unit session for communication between the third device and the fourth device based on the association; Means for: modifying a policy in a user plane functional device based on determining that the result indicates a failure of the authentication and authorization to enable the third device to communicate only with the second device.

13. A non-transitory computer readable medium comprising a computer program for causing an apparatus to at least perform the method according to claim 11.

Images