Method for delivering network slice authentication and authorization status

Abstract

A wireless communication method for a network slice authentication and authorization function is disclosed. The wireless communication method includes: storing a plurality of recorded network slice authentication and authorization NSSAA states of a wireless terminal, and sending the NSSAA states to an access and mobility management function AMF.

Description

Technical Field

[0001] The present application is generally directed to wireless communications. Background Art

[0002] In 5G communication systems, network slicing is introduced to serve specific customers by providing specific services. Network slices are identified by single network slice selection assistance information (S-NSSAI). Based on S-NSSAI, the network can find a suitable network slice that meets the service requirements.

[0003] For example, a network operator may provide a specific network slice for a machine type communication (MTC) device. Therefore, an S-NSSAI with a specific value is defined to identify the specific network slice.

[0004] In addition, the user equipment (UE) can be configured with a list of network slices that are allowed to access. Before the UE requests to use the services and resources provided by a specific network slice, it should first be verified whether the UE has permission to access that specific slice. This permission authentication is called the Network Slice Authentication Authorization (NSSAA) process. The NSSAA process is in addition to the UE's own primary authentication. After the NSSAA process, the network (e.g., Access and Mobility Management Function (AMF)) stores the NSSAA authentication status of each S-NSSAI for a given UE so that the NSSAA process is not performed again each time the registration associated with the UE is updated.

[0005] However, the UE may have high mobility behavior between the 5G network and the 4G network. When the UE leaves the 5G network, it usually results in a deregistration of the UE and the stored NSSAA authentication state will therefore be removed from the AMF. When the UE moves back to the 5G network, the NSSAA procedure needs to be called again. If the UE moves frequently between the 5G network and the 4G network, a lot of signaling and time will be wasted on triggering the NSSAA procedure again and again. This behavior usually increases signaling consumption and introduces more latency for the inter-system mobility process. In addition, it also degrades the customer experience.

[0006] The present application relates to methods, systems and devices for transmitting slice authentication authorization status. Summary of the invention

[0007] The present disclosure relates to a wireless communication method for network slicing authentication and authorization functions, the wireless communication method comprising:

[0008] storing a plurality of records including a network slice authentication and authorization (NSSAA) state of a wireless terminal, and

[0009] Send the NSSAA status to the Access and Mobility Management Function (AMF).

[0010] Various embodiments may preferably implement the following features:

[0011] Preferably, one of the multiple records includes at least one of a single network slice selection assistance information S-NSSAI or an authentication status of the S-NSSAI.

[0012] Preferably, the wireless communication method further includes: receiving an indication to store the NSSAA status from the AMF.

[0013] Preferably, the wireless communication method further includes: receiving a request for retrieving the NSSAA status from the AMF.

[0014] Preferably, the wireless communication method further comprises: subscribing to a unified data management (UDM) for a registration event associated with the wireless terminal, and receiving a registration event notification corresponding to the registration event associated with the wireless terminal from the UDM.

[0015] Preferably, the registration event is associated with at least one of registration or deregistration of the AMF of the wireless terminal.

[0016] Preferably, the registration event notification includes at least one of an instance identifier of the AMF, an action type indicating one of registration or deregistration, a uniform resource identifier for sending the NSSAA status, or an identifier of the wireless terminal.

[0017] Preferably, the wireless communication method further comprises: sending a request for a uniform resource identifier of the AMF to a network repository function for sending the NSSAA status.

[0018] Preferably, the NSSAA status also includes an identifier of the wireless terminal.

[0019] Preferably, the wireless communication method further comprises: updating the NSSAA state according to the result of the NSSAA process.

[0020] The present disclosure relates to a wireless communication method for access and mobility management functions. The wireless communication method comprises:

[0021] receiving a registration request from a wireless terminal, the registration request including a list of requested single network slice selection assistance information (S-NSSAI), and

[0022] A network slice authentication and authorization (NSSAA) state including multiple records of a wireless terminal is received from a network slice authentication and authorization function (NSSAAF).

[0023] Various embodiments may preferably implement the following features:

[0024] Preferably, one of the plurality of records includes at least one of the S-NSSAI or an authentication status of the S-NSSAI.

[0025] Preferably, the wireless communication method further comprises: sending an indication of storing the NSSAA status to the NSSAA.

[0026] Preferably, the wireless communication method further comprises: sending a request for retrieving the NSSAA status to the NSSAA.

[0027] Preferably, the AMF does not have the NSSAA status of the wireless terminal.

[0028] Preferably, the wireless communication method further comprises: sending a registration request of the wireless terminal to a unified data management (UDM).

[0029] Preferably, the wireless communication method further comprises: sending a uniform resource identifier of the AMF to a network repository function for receiving the NSSAA status.

[0030] Preferably, at least one authentication status corresponding to the requested list of S-NSSAIs is valid or indicates success, and the wireless communication method further includes skipping the NSSAA procedure.

[0031] Preferably, the NSSAA state does not include at least one requested S-NSSAI or at least one authentication state corresponding to the list of requested S-NSSAI times out or indicates failure, and the wireless communication method further includes triggering the NSSAA process.

[0032] The present disclosure relates to a wireless communication method for unified data management. The wireless communication method includes:

[0033] receiving a subscription to registration events associated with the wireless terminal from a Network Slice Authentication and Authorization Function (NSSAAF),

[0034] receiving a registration request for the wireless terminal from an access and mobility management function (AMF), and

[0035] Based on subscription, registration event notifications are sent to NSSAAF.

[0036] Various embodiments may preferably implement the following features:

[0037] Preferably, the registration event notification includes at least one of an instance identifier of the AMF, an action type indicating one of registration or deregistration, a uniform resource identifier for receiving the NSSAA status, or an identifier of the wireless terminal.

[0038] The present disclosure relates to a wireless device, comprising:

[0039] a processor configured to store a plurality of records including a network slice authentication and authorization (NSSAA) state of a wireless terminal, and

[0040] A communication unit configured to send a NSSAA status to an access and mobility management function (AMF).

[0041] Various embodiments may preferably implement the following features:

[0042] Preferably, the processor is configured to perform any wireless communication method of the above methods.

[0043] The present disclosure relates to a wireless device, comprising a communication unit, the communication unit being configured to:

[0044] receiving a registration request from a wireless terminal, the registration request including a list of requested single network slice selection assistance information (S-NSSAI), and

[0045] A network slice authentication and authorization (NSSAA) state including multiple records of a wireless terminal is received from a network slice authentication and authorization function (NSSAAF).

[0046] Various embodiments may preferably implement the following features:

[0047] Preferably, the wireless device further comprises a processor configured to execute any wireless communication method of the foregoing methods.

[0048] The present disclosure relates to a wireless device, comprising a communication unit, the communication unit being configured to:

[0049] receiving a subscription to registration events associated with the wireless terminal from a Network Slice Authentication and Authorization Function (NSSAAF),

[0050] receiving a registration request for the wireless terminal from an access and mobility management function (AMF), and

[0051] Based on subscription, registration event notifications are sent to NSSAAF.

[0052] Various embodiments may preferably implement the following features:

[0053] Preferably, the wireless device further comprises a processor configured to execute any wireless communication method of the foregoing methods.

[0054] The present disclosure relates to a computer program product, which includes a computer-readable program medium code stored thereon, which, when executed by a processor, causes the processor to implement the wireless communication method described in any of the aforementioned methods.

[0055] The exemplary embodiments disclosed herein are intended to provide features that will become apparent by reference to the following description when taken in conjunction with the accompanying drawings. According to various embodiments, exemplary systems, methods, devices, and computer program products are disclosed herein. However, it should be understood that these embodiments are presented by way of example and not limitation, and it will be apparent to those of ordinary skill in the art who read this disclosure that various modifications may be made to the disclosed embodiments while remaining within the scope of this disclosure.

[0056] Therefore, the present disclosure is not limited to the exemplary embodiments and applications described and illustrated herein. In addition, the specific order and / or hierarchy of steps in the methods disclosed herein are merely exemplary methods. Based on design preferences, the specific order or hierarchy of steps of the disclosed methods or processes can be rearranged while remaining within the scope of the present disclosure. Therefore, it should be understood by those of ordinary skill in the art that the methods and techniques disclosed herein present various steps or actions in a sample order, and unless otherwise expressly stated, the present disclosure is not limited to the specific order or hierarchy presented.

[0057] The above-described aspects and other aspects and embodiments thereof are described in more detail in the drawings, the description and the claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 A schematic diagram of a communication system according to an embodiment of the present disclosure is shown.

[0059] Figure 2 An example of a schematic diagram of a wireless terminal according to an embodiment of the present disclosure is shown.

[0060] Figure 3 An example of a schematic diagram of a wireless network node according to an embodiment of the present disclosure is shown.

[0061] Figure 4 A schematic diagram showing a process according to an embodiment of the present disclosure is shown.

[0062] Figure 5A and Figure 5B A schematic diagram showing a process according to an embodiment of the present disclosure is shown.

[0063] Fig. 6A and Figure 6B A schematic diagram showing a process according to an embodiment of the present disclosure is shown.

[0064] Fig. 7A and Figure 7B A schematic diagram showing a process according to an embodiment of the present disclosure is shown.

[0065] Figure 8 A flow chart illustrating a process according to an embodiment of the present disclosure is shown.

[0066] Fig. 9 A flow chart illustrating a process according to an embodiment of the present disclosure is shown.

[0067] Fig.10 A flow chart illustrating a process according to an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0068] Figure 1 A schematic diagram of a communication system according to an embodiment of the present disclosure is shown.

[0069] exist Figure 1 In , there are the following network functions:

[0070] 1) UE: User Equipment.

[0071] 2): RAN: Radio Access Network (node).

[0072] In a 5G communication system, the RAN may be an NR base station (e.g., a gNodeB (gNB)).

[0073] 3)AMF: Access and Mobility Management Function

[0074] AMF includes the following functions: registration management, connection management, reachability management and mobility management. AMF also performs access authentication and access authorization. In addition, AMF is a non-access stratum (NAS) security terminal and relays session management (SM) NAS between UE and session management function (SMF), etc.

[0075] 4)SMF: Session Management Function

[0076] SMF includes the following functions: session establishment, modification and release, UE Internet Protocol (IP) address allocation and management (including optional authorization function), user plane (UP) function (UPF) selection and control, downlink data notification, etc. SMF controls UPF via N4 association.

[0077] 5) UPF: User Plane Function

[0078] UPF includes the following functions: acting as an anchor point for intra / inter-radio access technology (RAT) mobility, packet routing and forwarding, traffic usage reporting, QoS processing of the user plane, downlink packet caching and downlink data notification triggering, etc. UPF can be deployed as an intermediate UPF (I-UPF) or a packet data unit (PDU) session anchor (PSA). PSA / UPF is the UPF that terminates the N6 interface to the data network (DN). I-UPF provides traffic forwarding between RAN and PSA / UPF. I-UPF may support "ULCL" (Uplink Classifier: Unload uplink traffic based on target IP address) or "BP" (Branch Point: Unload uplink traffic based on source IP address) to offload some traffic to the local PSA / UPF.

[0079] 6) PCF: Policy Control Function

[0080] The PCF provides Quality of Service (QoS) policy rules to the Control Plane (CP) function to enforce the QoS policy rules. The PCF converts requests from the Application Function (AF) into policies applicable to the PDU session. The PCF provides the SMF with traffic steering enforcement control affected by the AF in the Policy and Charging Control (PCC) rules, so that the SMF can establish a data path to offload the traffic to the local DN.

[0081] 7) AF: Application Function

[0082] AF interacts with the 3GPP core network to provide services, for example, to support the impact of applications on traffic routing. Based on the operator's deployment, AFs that are considered to be trusted by the operator may be allowed to interact directly with related network functions, while AFs that are not allowed to directly access network functions by the operator should interact with related network functions using an external open framework through the Network Open Function (NEF).

[0083] 8) NSSAAF: Network Slicing Authentication and Authorization Function

[0084] NSSAAF provides services to authenticate whether the UE is allowed to use the services provided by a specific network slice.

[0085] 9) UDM: Unified Data Management

[0086] UDM stores long-term security credentials used in authentication. In addition, UDM stores subscription information.

[0087] Figure 2A schematic diagram of a wireless terminal 20 according to an embodiment of the present disclosure is provided. The wireless terminal 20 may be a user equipment (UE), a mobile phone, a laptop, a tablet computer, an e-book, or a portable computer system, and is not limited thereto. The wireless terminal 20 may include a processor 200 such as a microprocessor or an application specific integrated circuit (ASIC), a storage unit 210, and a communication unit 220. The storage unit 210 may be any data storage device that stores program code 212 accessed and executed by the processor 200. Embodiments of the storage unit 212 include, but are not limited to, a subscriber identity module (SIM), a read-only memory (ROM), a flash memory, a random access memory (RAM), a hard disk, and an optical data storage device. The communication unit 220 may be a transceiver, and is used to send and receive signals (e.g., messages or packets) based on the processing results of the processor 200. In one embodiment, the communication unit 220 communicates with the user via a communication device. Figure 2 At least one antenna 222 is shown for sending and receiving signals.

[0088] In one embodiment, the storage unit 210 and the program code 212 may be omitted, and the processor 200 may include the storage unit with the stored program code.

[0089] The processor 200 may implement any one of the steps of the exemplary embodiments on the wireless terminal 20 , for example, by executing the program code 212 .

[0090] The communication unit 220 may be a transceiver. The communication unit 220 may alternatively or additionally combine a transmitting unit and a receiving unit configured to transmit and receive signals to and from a wireless network node (eg, a base station), respectively.

[0091] Figure 3A schematic diagram of a radio network node 30 according to an embodiment of the present disclosure is provided. The radio network node 30 may be a satellite, a base station (BS), a network entity, a mobility management entity (MME), a serving gateway (S-GW), a packet data network (PDN) gateway (P-GW), a radio access network (RAN), a next generation RAN (NG-RAN), a data network, a core network, or a radio network controller (RNC), and is not limited thereto. In addition, the radio network node 30 may include (execute) at least one network function such as an access and mobility management function (AMF), a session management function (SMF), a user plane function (UPF), a policy control function (PCF), an application function (AF), a network slice authentication authorization function (NSSAAF), etc. The radio network node 30 may include a processor 300 such as a microprocessor or an ASIC, a storage unit 310, and a communication unit 320. The storage unit 310 may be any data storage device that stores a program code 312 accessed and executed by the processor 300. Examples of the storage unit 312 include, but are not limited to, a SIM, a ROM, a flash memory, a RAM, a hard disk, and an optical data storage device. The communication unit 320 may be a transceiver and is used to send and receive signals (eg, messages or packets) according to the processing result of the processor 300. In one example, the communication unit 320 transmits and receives a signal (eg, a message or a packet) via Figure 3 At least one antenna 322 is shown in Figure 3 for transmitting and receiving signals.

[0092] In one embodiment, storage unit 310 and program code 312 may be omitted. Processor 300 may include a storage unit with stored program code.

[0093] The processor 300 may implement any of the steps described in the exemplary embodiments on the radio network node 30 , for example by executing the program code 312 .

[0094] The communication unit 320 may be a transceiver. The communication unit 320 may alternatively or additionally combine a transmitting unit and a receiving unit configured to transmit and receive signals to and from a wireless terminal (eg, a user equipment), respectively.

[0095] In the present disclosure, an identification may be equal to an identifier.

[0096] According to one embodiment, in order to authenticate whether the UE can access the network slice list to obtain the corresponding service, the AMF triggers the NSSAA process by calling the service provided by the NSSAAF.

[0097] Figure 4 FIG. 1 is a schematic diagram showing a process of AMF triggering NSSAA process according to an embodiment of the present disclosure. Figure 4In the UE, AMF, UDM and NSSAAF can be Figure 1 In addition, Figure 4 Also shown in FIG. 1 is an Authentication, Authorization, and Accounting Server (AAA-S). Note that in this embodiment, the Authentication Server Function (AUSF) can be deployed together with the UDM. Figure 4 In the process shown, the UE requests access to the (5G) network and initiates a registration process with the AMF.

[0098] More specifically, the UE sends a registration request with a list of S-NSSAIs. In one embodiment, regardless of the access type (eg, 3GPP access and non-3GPP access), the UE may not include those S-NSSAIs for which NSSAA is ongoing (step 401).

[0099] In step 402, for the initial registration request, the AMF may invoke primary authentication. In one embodiment, for subsequent registration requests, if the UE has already been authenticated and the AMF has a valid security context, the primary authentication may be skipped.

[0100] In step 403, the AMF determines whether slice authentication authorization is required for each S-NSSAI based on locally stored information or information retrieved from the UDM. For example, authentication of the network slice of the S-NSSAI may be omitted when at least one of the following conditions is met:

[0101] 1) If slice authentication and authorization is not required based on the subscription information from UDM,

[0102] 2) If the UE has previously successfully performed authentication for the network slice, regardless of the access type and / or the corresponding result is still valid, or

[0103] 3) Authentication of the UE's network slice is in progress.

[0104] In steps 404a and 404b, the AMF sends a registration accept message to the UE, and optionally, the UE sends a registration complete message.

[0105] In step 405, if necessary, based on the determination result in step 403, a slice authentication and authorization process based on the Extensible Authentication Protocol (EAP) is performed for each S-NSSAI.

[0106] In step 406, based on the result (if any) of the EAP-based slice authentication and authorization process in step 405, the AMF sends a UE configuration update to update the requested S-NSSAI state (e.g., corresponding to the S-NSSAI in the S-NSSAI list sent in step 401) based on the slice-specific authentication result.

[0107] Figure 5A and Figure 5B FIG. 2 shows a schematic diagram of the NSSAA process according to an embodiment of the present disclosure. Figure 5A and Figure 5B In the UE, AMF and NSSAAF can be Figure 1 In addition, AAA-S is also shown in Figure 5A and Figure 5B As shown. Figure 5A and Figure 5B The interaction between UE, AMF, NSSAAF and AAA-S is described.

[0108] More specifically, for S-NSSAI that requires network slice authentication and authorization, AMF can trigger network slice authentication and authorization based on changes in subscription information, or be triggered by AAA-S (step 501).

[0109] In the case where the network slice authentication and authorization process is triggered as a result of the registration process, the AMF may determine based on the UE context in the AMF that for some or all S-NSSAIs subject to network slice authentication and authorization, the UE has already authenticated in accordance with the registration process at the first access. Depending on the network slice authentication and authorization result (e.g. success / failure) from the previous registration, the AMF may decide based on network policy to skip the network slice authentication and authorization of these S-NSSAIs during the registration (process) of the second access.

[0110] If the network slice authentication and authorization procedure corresponds to a reauthentication and reauthorization procedure triggered as a result of AAA-S triggered reauthentication and reauthorization of one or more S-NSSAIs by the UE, or a reauthentication and reauthorization procedure triggered by the AMF based on operator policy or subscription change, and if the S-NSSAI requiring network slice authentication and authorization is included in the allowed S-NSSAIs for each access type, the AMF selects the access type to be used to perform the network slice authentication and authorization procedure based on the network policy.

[0111] In step 502, the AMF may request a user identity (ID) for EAP authentication (ie, EAP ID) for S-NSSAI from the UE in a NAS MM transport message including S-NSSAI.

[0112] In step 503, the UE provides the EAP ID of the S-NSSAI together with the S-NSSAI in a NAS MM transport message towards the AMF.

[0113] In step 504, the AMF sends the EAP ID in the Nssaaf_NSSAA_Authenticate request to the NSSAAF, and the NSSAAF provides an interface with the AAA-S (e.g., including an EAP ID response, a General Public Subscription Identifier (GPSI) and / or S-NSSAI).

[0114] In step 505, if there is an AAA-Proxy (AAA-P) (for example, because the AAA-S belongs to a third party and the operator deploys a proxy to the third party), the NSSAAF forwards the EAP ID Response message to the AAA-P, otherwise the NSSAAF forwards the message directly to the AAA-S. The NSSAAF routes to the AAA-S based on the S-NSSAI. The NSSAAF / AAA-P forwards the EAP Identity message to the AAA-S along with the S-NSSAI and GPSI. The AAA-S stores the GPSI to create an association with the EAP ID in the EAP ID Response message, so that the AAA-S can use it later to revoke authorization or trigger reauthentication. The AAA-S uses the EAP-ID and S-NSSAI to identify which UE and slice authorization is requested.

[0115] In steps 506 to 509 ( Figure 5A ) and 8 to 11 ( Figure 5B ), exchanging EAP-messages with the UE. Note that these steps may occur in one or more iterations.

[0116] In step 512, EAP authentication is completed and the EAP-Success / Failure message is delivered to the NSSAAF / AAA-P along with the GPSI and S-NSSAI.

[0117] In step 513, the NSSAAF sends a Nssaaf_NSSAA_Authenticate response (eg, including EAP-Success / Failure, S-NSSAI, GPSI) to the AMF.

[0118] In step 514, the AMF sends a NAS MM transport message (eg, including EAP-Success / Failure) to the UE.

[0119] In step 515, based on the result of the slice-specific authentication (EAP-Success / Failure), the AMF initiates the UE configuration update procedure for each access type if a new allowed NSSAI or a new rejected NSSAI needs to be delivered to the UE, or if AMF reallocation is required.

[0120] If the S-NSSAI is successfully verified through the NSSAA procedure, the AMF sets the NSSAA status of the corresponding S-NSSAI to EAP-Success, otherwise the NSSAA status of the corresponding S-NSSAI is set to EAP-Failure. The AMF stores the NSSAA status of each S-NSSAI in the UE context and also updates the UE with the allowed one or more NSSAIs. Later, if the UE requests a registration update, the AMF will not trigger the NSSAA procedure for those S-NSSAIs whose status is set to EAP-Success.

[0121] In one embodiment, information on whether the S-NSSAI is successfully authenticated may be stored in the NSSAAAF. In addition, a list of S-NSSAIs (e.g., multiple S-NSSAIs) and their corresponding NSSAA authentication states may be grouped into NSSAA states. In this embodiment, such NSSAA states may be provided to the AMF when needed to avoid unnecessary NSSAA procedures (e.g., registration procedures or handover procedures) in subsequent processes. Thus, the AMF is able to use the retrieved NSSAA state to determine whether an NSSAA procedure is required for the indicated S-NSSAI.

[0122] Example 1 - NSSAA state extraction mode

[0123] In one embodiment, after successfully performing the NSSAA procedure, the NSSAAF stores or updates the NSSAA state, and the AMF extracts (e.g., accesses or retrieves) the NSSAA state from the NSSAAF.

[0124] Fig. 6A and Figure 6B FIG. 1 is a schematic diagram showing a process in which the AMF extracts the NSSAA status from the NSSAA F according to an embodiment of the present disclosure. Fig. 6A and Figure 6B In the UE, AMF, UDM and NSSAAF can be Figure 1 In addition, Fig. 6A and Figure 6B AAA-S is also shown in FIG. Note that AUSF can be deployed together with UDM. In this embodiment, it is assumed that the UE previously moved from a 5G network to a 4G network and now moves back to a 5G network. That is, the NSSAA process is initially expected because the NSSAA state is not stored in the AMF.

[0125] In addition, in order to avoid unnecessary NSSAA procedures, in this embodiment, the NSSAAF stores the results of the NSSAA procedure for one or more S-NSSAIs, and the AMF retrieves the stored NSSAA status from the NSSAAF.

[0126] Specifically, similar to Figure 4 and the process shown in Figure 5, triggering the NSSAA process (step 601). In one embodiment, based on local policies or UE characteristics (for example, the UE may frequently move between the 4G network and the 5G network), the AMF may request the NSSAAAF to store the NSSAA state after the NSSAA process is successfully performed. For example, when sending an Nnssaaf_NSSAA_Authenticate request to the NSSAAAF, the AMF includes a "store NSSAA state" indication, which is used to instruct the NSSAAAF to store the NSSAA state after the NSSAA process.

[0127] In step 602, after the NSSAA process is successfully performed, the NSSAAF stores the NSSAA state in its local memory or shared memory.

[0128] In one embodiment, the NSSAAF may determine to store the NSSAA state after the NSSAA process based on one of the following instructions: an instruction to store the NSSAA state from a local configuration (e.g., configured by an operator); or, during the NSSAA process, a "store NSSAA state" indication from the AMF.

[0129] In one embodiment, the NSSAA status includes a list of records (e.g., including S-NSSAI and / or EAP authentication status) for a given UE. In one embodiment, each record indicates (e.g., includes) an EAP-based authentication status for a given S-NSSAI. In one embodiment, the EAP authentication status indicates one of EAP-Success or EAP-Failure.

[0130] In one embodiment, the NSSAA state stored by the NSSAAF may be associated with a timeout period. When the timeout period expires, the stored NSSAA state shall be deemed useless.

[0131] Steps 603 to 606b are similar to steps 401 to 404b, and a registration update procedure is performed when the UE moves from the 4G network back to the 5G network.

[0132] In step 607 ( Figure 6B As shown in FIG, before the AMF initiates the NSSAA process for any S-NSSAI, the AMF determines to retrieve the NSSAA status from the NSSAAAF.

[0133] In steps 608a and 608b, the AMF sends an NSSAA status retrieval request to the NSSAA AF and obtains the NSSAA status from the NSSAA status retrieval response sent from the NSSAA AF.

[0134] In one embodiment, in the NSSAA state retrieval request, the AMF indicates an identifier (e.g., GPSI) of a given UE for which the NSSAA state is required.

[0135] In one embodiment, the NSSAA status returned by the NSSAAF includes a binary record list (eg, including S-NSSAI and / or EAP authentication status). In one embodiment, the EAP authentication status indicates the result of the NSSAA process corresponding to the S-NSSAI.

[0136] In step 609, if there are one or more S-NSSAIs that are not included in the returned NSSAA state but are required by the NSSAA process, the AMF triggers the NSSAA process described in Figure 5 for the (these) S-NSSAIs.

[0137] In step 610 , if step 609 is performed, the NSSAAF further updates the stored NSSAA state according to the result of the NSSAA process performed in step 609 .

[0138] In step 611, based on the result of step 609, the AMF sends a configuration update to the UE to update the requested S-NSSAI state.

[0139] Example 2 - NSSAA state push mode

[0140] In one embodiment, the NSSAAF stores or updates the NSSAA state after successfully executing the NSSAA procedure. At the same time, the NSSAAF registers events for the AMF subscribed by the UDM for a given UE. When it receives a notification of a new AMF registration, the NSSAAF pushes (e.g., sends) the NSSAA state to the AMF.

[0141] Fig. 7A and Figure 7B FIG. 1 is a schematic diagram showing a process in which the NSSAAF pushes the NSSAA state to the AMF according to an embodiment of the present disclosure. Fig. 7A and Figure 7B In the UE, AMF, UDM and NSSAAF can be Figure 1 In addition, AAA-S is also shown in Fig. 7A and Figure 7B Note that in this embodiment, AUSF can be deployed together with UDM.

[0142] exist Fig. 7A and Figure 7BIn the process shown, it is assumed that the UE previously moved from a 5G network to a 4G network and moved back to a 5G network. Therefore, the NSSAA process is initially expected because there is no NSSAA state stored in the AMF.

[0143] To avoid unnecessary NSSAA procedures, in this embodiment, the NSSAAF stores the results of the NSSAA procedures for these S-NSSAIs and provides the stored NSSAA status to the AMF.

[0144] More specifically, the NSSAA process is triggered in step 701 .

[0145] In one embodiment, in step 701, the AMF may request the NSSAAAF to store the NSSAA state after (or during) the NSSAA process.

[0146] In step 702, after the NSSAA process is successfully performed, the NSSAAF stores the NSSAA state in its local memory or shared memory.

[0147] In one embodiment, NSSAAF can be based on Fig. 6A The instructions set forth in step 602 determine the stored NSSAA state.

[0148] In step 703, the NSSAAF subscribes to the UDM for the AMF registration event for the given UE. For example, the NSSAAF sends an AMF registration event subscription request to the UDM.

[0149] Later, if the UDM receives an AMF registration and / or AMF deregistration message from the AMF (e.g. associated with a given UE), the UDM sends an AMF registration event notification to the NSSAAF. Thus, the NSSAF confirms that the UE is registered with the new AMF or deregistered from the previous AMF.

[0150] In steps 604 to 607b, when the UE moves from the 4G network back to the 5G network, a registration update procedure is performed.

[0151] In one embodiment, once the AMF accepts the registration request from the UE, the AMF sends an AMF registration to the UDM. In addition, when the AMF sends the AMF registration to the UDM, the AMF may include an AMF callback uniform resource identifier (URI) for (e.g., receiving) NSSAA status notification in the AMF registration request message. The UDM stores the AMF callback URI for NSSAA status notification in the AMF registration context.

[0152] In step 708, UDM sends an AMF registration event notification to NSSAAF.

[0153] In one embodiment, the AMF registration event notification includes at least one of the following:

[0154] –AMF instance ID,

[0155] – Registration or deregistration actions,

[0156] – an identifier of the UE (e.g. UE ID) or

[0157] - Optionally, the AMF callback URI for NSSAA status notification (e.g., named nssaaStatusCallbackUri).

[0158] In this embodiment, the NSSAAF obtains the AMF callback URI for NSSAA status notification, so the NSSAA status can be sent to the AMF using the callback URI.

[0159] In one embodiment, if there is no AMF callback URI for NSSAA status notification (in the AMF registration event notification), the NSSAAF can query the Network Repository Function (NRF) to obtain the NF profile of the AMF and obtain the corresponding callback URI. In this embodiment, the AMF registers its callback URI for NSSAA status notification with the NRF in its NF profile.

[0160] In step 709, the NSSAAF sends an NSSAA status notification to the AMF.

[0161] In one embodiment, the NSSAA status notification includes the following information:

[0162] - an identifier of a given UE,

[0163] - Binary record list (eg, including S-NSSAI and EAP authentication status). In one embodiment, the EAP authentication status indicates the result of the NSSAA procedure for the corresponding S-NSSAI.

[0164] In step 710, if there is an S-NSSAI that is not included in the returned NSSAA state but is required by the NSSAA process, the AMF triggers the NSSAA process described in Figure 5 for the (these) S-NSSAI.

[0165] In step 711 , if step 710 is performed, the NSSAAF further updates the stored NSSAA state according to the result of the NSSAA process performed in step 710 .

[0166] In step 712, based on the result of step 710, the AMF sends a configuration update to the UE to update the requested S-NSSAI state.

[0167] Figure 8 A flow chart illustrating a process according to an embodiment of the present disclosure is shown. Figure 8 The process shown in may be used in a wireless device including (e.g., executing, providing services of) NSSAAF, and includes the following steps:

[0168] Step 800: Store multiple recorded network slice authentication and authorization (NSSAA) states including wireless terminals.

[0169] Step 801: Send the NSSAA status to the Access and Mobility Management Function (AMF).

[0170] exist Figure 8 In the process shown, the wireless device (ie, NSSAAF) stores a plurality of recorded NSSAA states including wireless terminals (eg, UEs). Next, the wireless device may send the NSSAA state to the AMF (eg, a wireless network that executes or provides services of the AMF).

[0171] In one embodiment, one of the plurality of records includes at least one of the S-NSSAI or an authentication status of the S-NSSAI.

[0172] In one embodiment, the wireless device receives an indication from the AMF to store the NSSAA state.

[0173] In one embodiment, the wireless device receives a request from the AMF to retrieve the NSSAA state.

[0174] In one embodiment, the wireless device subscribes to the UDM for registration events associated with the wireless terminal.

[0175] In one embodiment, for example, when a registration event associated with the wireless terminal occurs, the wireless device receives a registration event notification corresponding to the registration event associated with the wireless terminal from the UDM.

[0176] In one embodiment, the registration event is associated with at least one of registration or deregistration of the AMF of the wireless terminal.

[0177] In one embodiment, the registration event notification includes at least one of an instance identifier of the AMF, an action type indicating one of registration or deregistration, a uniform resource identifier for sending the NSSAA status, or an identifier of the wireless terminal.

[0178] In one embodiment, the wireless device sends a request to the NRF for a uniform resource identifier of the AMF for communicating (eg, sending) the NSSAA state.

[0179] In one embodiment, the NSSAA state also includes an identifier of the wireless terminal (eg, UE ID).

[0180] In one embodiment, the wireless device updates the NSSAA state based on the results of the NSSAA process.

[0181] Fig. 9 A flow chart illustrating a process according to an embodiment of the present disclosure is shown. Fig. 9 The process shown in may be used in a wireless device including an AMF (e.g., executing or providing services of the AMF), and includes the following steps:

[0182] Step 900: Receive a registration request from a wireless terminal including a list of requested single network slice selection assistance information.

[0183] Step 901: Receive a network slice authentication and authorization status including multiple records of a wireless terminal from a network slice authentication and authorization function.

[0184] exist Fig. 9 In the process shown, the wireless device (i.e., AMF) receives a registration request including a list of requested S-NSSAIs from a wireless terminal (e.g., UE). Note that the list of requested S-NSSAIs may include at least one S-NSSAI. Next, the wireless device receives an NSSAA status including multiple records of the wireless terminal from the NSSAAAF. Based on the NSSAA status, additional NSSAA procedures may be avoided.

[0185] In one embodiment, one of the plurality of records includes at least one of the S-NSSAI or an authentication status of the S-NSSAI.

[0186] In one embodiment, the wireless device sends an indication to the NSSAAF to store the NSSAA state.

[0187] In one embodiment, the wireless device sends a request to the NSSAAF to retrieve the NSSAA status.

[0188] In one embodiment, the wireless device does not have the NSSAA status of the wireless terminal.

[0189] In one embodiment, the wireless device sends the URI of the wireless device (ie, AMF) to the NRF for communicating (eg, receiving) the NSSAA status.

[0190] In one embodiment, at least one authentication status corresponding to the requested list of S-NSSAIs is valid or indicates success. In this case, the wireless device may skip the NSSAA process.

[0191] In one embodiment, the NSSAA state does not include at least one requested S-NSSAI (e.g., in the list of requested S-NSSAIs), or at least one authentication state corresponding to the list of requested S-NSSAIs times out or indicates a failure. In this embodiment, the wireless device may trigger the NSSAA process.

[0192] Fig.10 A flow chart illustrating a process according to an embodiment of the present disclosure is shown. Fig.10 The process shown in may be used in a wireless device that includes a UDM (e.g., executes or provides services of a UDM), and includes the following steps:

[0193] Step 1000: Receive a subscription to registration events associated with a wireless terminal from a network slice authentication and authorization function (NSSAAF).

[0194] Step 1001: Receive a registration request from a wireless terminal from an access and mobility management function (AMF).

[0195] Step 1002: Based on the subscription, a registration event notification is sent to the NSSAAF.

[0196] exist Fig.10 In the process shown, the wireless device (i.e., UDM) receives a subscription to a registration event associated with the wireless terminal from the NSSAAF. Next, the wireless device receives a registration request from the wireless terminal from the AMF. Based on the subscription received in step 1000, the wireless device sends a registration event notification to the NSSAAF.

[0197] In one embodiment, the registration event notification includes at least one of an instance identifier of the AMF, an action type indicating one of registration or deregistration, a uniform resource identifier for communicating (e.g., receiving) an NSSAA state, or an identifier of the wireless terminal.

[0198] Although various embodiments of the present disclosure have been described above, it should be understood that they are presented only by way of example and not by way of limitation. Similarly, various figures may depict exemplary architectures or configurations, which are provided to enable those of ordinary skill in the art to understand the exemplary features and functions of the present disclosure. However, it should be understood by these persons that the present disclosure is not limited to the exemplary architectures or configurations shown, but may be implemented using various alternative architectures and configurations. In addition, as will be appreciated by those of ordinary skill in the art, one or more features of an embodiment may be combined with one or more features of another embodiment described herein. Therefore, the breadth and scope of the present disclosure should not be limited by any of the above-described exemplary embodiments.

[0199] It should also be understood that any reference to an element using names such as "first," "second," etc., herein does not generally limit the number or order of these elements. Rather, these names may be used herein as a convenient method of distinguishing between two or more elements or instances of an element. Thus, reference to a first and a second element does not mean that only two elements can be used, or that the first element must precede the second element in some manner.

[0200] In addition, it should be understood by those skilled in the art that any of a variety of different technologies and techniques may be used to represent information and signals. For example, data, instructions, commands, information, signals, bits, symbols, etc. that may be referred to in the above description may be represented by voltage, current, electromagnetic waves, magnetic fields or particles, optical fields or particles, or any combination thereof.

[0201] The skilled person should also understand that any of the various illustrative logical blocks, units, processors, devices, circuits, methods, and functions described in conjunction with the aspects disclosed herein may be implemented by electronic hardware (e.g., digital implementations, analog implementations, or a combination of both), firmware, various forms of programs or design codes containing instructions (for convenience, they may be referred to herein as "software" or "software units"), or any combination of these technologies.

[0202] In order to clearly illustrate this interchangeability of hardware, firmware and software, various illustrative components, blocks, units, circuits and steps have been generally described above with respect to their functions. Whether such functions are implemented as hardware, firmware or software, or a combination of these technologies, depends on the specific application and the design constraints imposed on the entire system. Skilled technicians can implement the described functions in various ways for each specific application, but the decision of such implementation will not lead to deviation from the scope of this disclosure. According to various embodiments, processors, devices, components, circuits, structures, machines, units, etc. may be configured to perform one or more functions described herein. The terms "configured to" or "configured for" used herein with respect to a specified operation or function refer to a processor, device, component, circuit, structure, machine, unit, etc. that is physically constructed, programmed and / or arranged to perform a specified operation or function.

[0203] In addition, the technician should understand that the various illustrative logic blocks, units, devices, components and circuits described herein can be implemented in or performed by an integrated circuit (IC), which can include a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, or any combination thereof. The logic blocks, units and circuits may also include antennas and / or transceivers to communicate with various components within a network or within a device. The general-purpose processor may be a microprocessor, but alternatively, the processor may be any conventional processor, controller or state machine. The processor may also be implemented as a combination of computing devices (e.g., a combination of a DSP and a microprocessor), multiple microprocessors, one or more microprocessors combined with a DSP core, or any other suitable configuration for performing the functions described herein. If implemented in software, these functions may be stored as one or more instructions or codes on a computer-readable medium. Therefore, the steps of the method or algorithm disclosed herein may be implemented as software stored on a computer-readable medium.

[0204] Computer-readable media include computer storage media and communication media, which include any media that can be enabled to send a computer program or code from one place to another. Storage media can be any available media that can be accessed by a computer. As an example and not limitation, such computer-readable media can include RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other media that can be used to store the desired program code in the form of instructions or data structures and can be accessed by a computer.

[0205] In this application, the term "unit" as used herein refers to software, firmware, hardware, and any combination of these elements for performing the relevant functions described herein. In addition, for the purpose of discussion, various units are described as discrete units; however, as is apparent to those of ordinary skill in the art, two or more units may be combined to form a single unit that performs the relevant functions according to the embodiments of the present disclosure.

[0206] In addition, in the embodiments of the present disclosure, memory or other memory and communication components may be used. It should be understood that, for the sake of clarity, the above description describes the embodiments of the present disclosure with reference to different functional units and processors. However, it is apparent that any appropriate functional distribution between different functional units, processing logic elements or domains may be used without departing from the present disclosure. For example, the functions illustrated as being performed by a separate processing logic element or controller may be performed by the same processing logic element or controller. Therefore, reference to a specific functional unit is merely a reference to a suitable device for providing the function, rather than indicating a strict logical or physical structure or organization.

[0207] Various modifications to the embodiments described in this disclosure will be apparent to those skilled in the art, and the general principles defined herein may be applied to other embodiments without departing from the scope of this disclosure. Therefore, this disclosure is not intended to be limited to the embodiments shown herein, but is to be accorded the broadest scope consistent with the novel features and principles disclosed herein, as described in the following claims.

Claims

1. A wireless communication method for network slicing authentication and authorization function, the wireless communication method comprising: storing a plurality of records of network slice authentication and authorization NSSAA states including wireless terminals, receiving a request from an access and mobility management function, AMF, for retrieving said NSSAA state, and Send the NSSAA status to the AMF.

2. The wireless communication method according to claim 1, wherein: One of the multiple records includes at least one of a single network slice selection assistance information S-NSSAI or an authentication status of the S-NSSAI.

3. The wireless communication method according to claim 1 or 2, further comprising: receiving an indication from the AMF to store the NSSAA state.

4. The wireless communication method according to claim 3, further comprising: subscribing to a unified data management function UDM for registration events associated with the wireless terminal, and A registration event notification is received from the UDM corresponding to the registration event associated with the wireless terminal.

5. The wireless communication method according to claim 4, wherein: The registration event is associated with at least one of registration or deregistration of the AMF of the wireless terminal.

6. The wireless communication method according to claim 4, wherein: The registration event notification includes at least one of an instance identifier of the AMF, an action type indicating one of registration or deregistration, a uniform resource identifier for sending the NSSAA state, or an identifier of the wireless terminal.

7. The wireless communication method according to any one of claims 4 to 6, further comprising: Sending a request for the uniform resource identifier of the AMF to the network repository function for sending the NSSAA status to the AMF.

8. The wireless communication method according to any one of claims 4 to 6, wherein: The NSSAA state also includes an identifier of the wireless terminal.

9. The wireless communication method according to any one of claims 1 to 2, 4 to 6, further comprising: The NSSAA state is updated according to the result of the NSSAA process.

10. A wireless communication method for an access and mobility management function AMF, the wireless communication method comprising: receiving a registration request from a wireless terminal, the registration request comprising a requested list of single network slice selection assistance information S-NSSAI, sending a request to the Network Slice Authentication and Authorization Function NSSAAF for retrieving the status of the Network Slice Authentication and Authorization NSSAA, and The NSSAA state including a plurality of records of the wireless terminal is received from the NSSAAF.

11. The wireless communication method according to claim 10, wherein: One of the plurality of records includes at least one of an S-NSSAI or an authentication status of the S-NSSAI.

12. The wireless communication method according to claim 10 or 11, further comprising: Send an indication to the NSSAAF to store the NSSAA state.

13. The wireless communication method according to claim 10, wherein: The AMF does not have the NSSAA state of the wireless terminal.

14. The wireless communication method according to claim 10 or 11, further comprising: A registration request for the wireless terminal is sent to a unified data management (UDM).

15. The wireless communication method according to claim 14, further comprising: Sending the uniform resource identifier of the AMF to the network repository function for receiving the NSSAA status.

16. The wireless communication method according to any one of claims 10, 11, 13, and 15, wherein: at least one authentication status corresponding to said list of requested S-NSSAIs is valid or indicates success, and The wireless communication method further includes skipping the NSSAA process.

17. The wireless communication method according to any one of claims 10, 11, 13, and 15, wherein: the NSSAA state does not include at least one requested S-NSSAI or at least one authentication state corresponding to the list of requested S-NSSAIs times out or indicates a failure, and The wireless communication method further includes triggering an NSSAA process.

18. A wireless communication method for unified data management, the wireless communication method comprising: receiving a subscription to a registration event associated with the wireless terminal from the network slice authentication and authorization function NSSAAF, receiving a registration request for the wireless terminal from an access and mobility management function AMF, and Based on the subscription, a registration event notification is sent to the NSSAAF.

19. The wireless communication method according to claim 18, wherein: The registration event notification includes at least one of an instance identifier of the AMF, an action type indicating one of registration or deregistration, a uniform resource identifier for receiving an NSSAA status, or an identifier of the wireless terminal.

20. A network slice authentication and authorization function, comprising: a processor configured to store a plurality of recorded network slice authentication authorization (NSSAA) states comprising wireless terminals, and A communication unit, wherein the communication unit is configured to: receiving a request from an access and mobility management function, AMF, for retrieving said NSSAA state, Send the NSSAA status to the AMF.

21. The network slice authentication and authorization function according to claim 20, wherein: The processor is further configured to execute the wireless communication method according to any one of claims 2 to 9.

22. An access and mobility management function, comprising a communication unit, the communication unit being configured to: receiving a registration request from a wireless terminal, the registration request comprising a requested list of single network slice selection assistance information S-NSSAI, A request for retrieving the network slice authentication authorization NSSAA status is sent to the network slice authentication authorization function NSSAAF, and the NSSAA status including multiple records of the wireless terminal is received from the NSSAAF.

23. The access and mobility management function according to claim 22, further comprising a processor configured to implement the wireless communication method according to any one of claims 11 to 17.

24. A unified data management function, comprising a communication unit, wherein the communication unit is configured to: receiving a subscription to a registration event associated with the wireless terminal from the network slice authentication and authorization function NSSAAF, receiving a registration request for the wireless terminal from an access and mobility management function AMF, and Based on the subscription, a registration event notification is sent to the NSSAAF.

25. The unified data management function of claim 24, further comprising a processor configured to implement the wireless communication method of claim 19.

26. A computer program product comprising computer-readable program medium codes stored thereon, which, when executed by a processor, cause the processor to implement the wireless communication method according to any one of claims 1 to 19.

Images