Method and apparatus for configuring a temporary user equipment (UE) external identifier in a wireless communication system

Abstract

The disclosure relates to a 5G or 6G communication system for supporting a higher data transmission rate. According to the disclosure, a temporary UE identifier can be efficiently configured for identifying a UE that subscribes to a mobile communication system, for an external server located outside the mobile communication system.

Description

Technical Field

[0001] This disclosure relates to interworking between a mobile communication system and an external server of a communication network. Specifically, this disclosure relates to technologies related to network exposure functions for a server located outside the mobile communication network to obtain information necessary for providing user services from the mobile communication system. Background Technology

[0002] 5G mobile communication technology defines a wide frequency band, enabling high transmission rates and new services. It can be implemented not only in "sub-6GHz" bands such as 3.5GHz, but also in "above-6GHz" bands, including 28GHz and 39GHz, known as millimeter waves. Furthermore, to achieve transmission rates 50 times faster than 5G and ultra-low latency one-tenth that of 5G, the implementation of 6G mobile communication technology (referred to as "super 5G systems") in terahertz bands (e.g., the 95GHz to 3THz band) has been considered.

[0003] In the early stages of 5G mobile communication technology development, to support services and meet performance requirements related to enhanced Mobile Broadband (eMBB), Ultra Reliable Low Latency Communication (URLLC), and massive Machine-Type Communication (mMTC), ongoing standardization has been implemented for the following: beamforming and massive MIMO (to mitigate radio wave path loss and increase the transmission distance of millimeter waves), support for basic parameter sets (e.g., operating multiple subcarrier spacing) (to effectively utilize millimeter wave resources and dynamically operate time slot formats), initial access technologies (to support multi-beam transmission and broadband), the definition and operation of BWP (BandWidth Part), new channel coding methods (such as LDPC (Low Density Parity Check) codes for large data transmissions and polar codes for highly reliable transmission of control information), L2 preprocessing, and network slicing (to provide dedicated networks for specific services).

[0004] Currently, considering the services that 5G mobile communication technology will support, discussions are underway regarding improvements and performance enhancements to the initial 5G mobile communication technology, and physical layer standardization has been established for technologies such as: V2X (Vehicle-to-everything) (used to assist autonomous vehicles in determining driving based on information sent by the vehicle about its location and status, and to enhance user convenience), NR-U (New Radio Unlicensed) (for system operation in accordance with various regulatory requirements for unlicensed bands), NRUE power saving, Non-Terrestrial Network (NTN) (which is UE-satellite direct communication used to provide coverage in areas where communication with terrestrial networks is unavailable), and positioning.

[0005] Furthermore, ongoing standardization is underway regarding the following technologies in terms of air interface architecture / protocols: Industrial Internet of Things (IIoT) (for supporting new services through interoperability and convergence with other industries), IAB (Integrated Access and Backhaul) (for providing nodes for network service area extension by supporting radio backhaul links and access links in an integrated manner), mobility enhancements (including conditional handover and DAPS (Dual Active Protocol Stack) handover), and two-step random access (2-step RACH for NR) (for simplifying random access procedures). Ongoing standardization is also underway regarding the system architecture / services for combining Network Functions Virtualization (NFV) and Software-Defined Networking (SDN) technologies (e.g., service-based architectures or service-based interfaces) and for Mobile Edge Computing (MEC) for UE location-based reception services.

[0006] With the commercialization of 5G mobile communication systems, an exponential increase in connected devices will be added to the communication network. Accordingly, enhanced functionality and performance of 5G mobile communication systems, as well as the integrated operation of connected devices, are expected to be necessary. To this end, new research is planned related to: extended reality (XR) for effectively supporting AR (Augmented Reality), VR (Virtual Reality), MR (Mixed Reality), etc.; 5G performance improvements and complexity reduction through the utilization of Artificial Intelligence (AI) and Machine Learning (ML); AI service support; metaverse service support; and drone communication.

[0007] Furthermore, this development of 5G mobile communication systems will serve as a foundation for the development of new waveforms for providing terahertz band coverage in 6G mobile communication technologies, multi-antenna transmission technologies (such as full-dimensional MIMO (FD-MIMO), array antennas, and large antennas), metamaterial-based lenses and antennas for improving terahertz band signal coverage, high-dimensional spatial multiplexing technologies using OAM (Orbital Angular Momentum) and RIS (Reconfigurable Intelligent Surface), as well as full-duplex technologies for improving the frequency efficiency of 6G mobile communication technologies and improving system networks, AI-based communication technologies for implementing system optimization by utilizing satellites and AI (artificial intelligence) from the design stage and internalizing end-to-end AI support functions, and next-generation distributed computing technologies for implementing services with complexity exceeding the operational limits of UEs by utilizing ultra-high-performance communication and computing resources.

[0008] There is a need for a method for a server located outside the mobile communication network to obtain the information necessary to provide user services from the mobile communication system.

[0009] The above information is presented as background information only to aid in understanding this disclosure. No determination or assertion is made regarding whether any of the above content can be applied to this disclosure as prior art. Summary of the Invention

[0010] Technical issues

[0011] This disclosure provides a method for configuring a temporary UE identifier for an external server located outside a mobile communication system to identify UEs subscribing to the mobile communication system.

[0012] Solution to the problem

[0013] A method for an entity in a wireless communication system according to an embodiment of the present disclosure may include: receiving a temporary UE external identifier request message including at least one of an Internet Protocol (IP) address and an Application Function (AF) identifier of a user equipment (UE); obtaining a Subscription Permanent Identifier (SUPI) of the UE based on the UE's IP address; obtaining an Application Authentication and Key Management (AKMA) Key Identifier (A-KID) based on at least one of the SUPI and the AF identifier; and generating a temporary UE external identifier based on at least one of the A-KID and the AF identifier.

[0014] An entity in a wireless communication system according to an embodiment of the present disclosure may include: a transceiver; and a controller configured to control the transceiver to receive a temporary UE external identifier request message including at least one of an Internet Protocol (IP) address and an Application Function (AF) identifier of a user equipment (UE), to perform control to obtain a Subscription Permanent Identifier (SUPI) of the UE based on the UE's IP address, to perform control to obtain an Application Authentication and Key Management (AKMA) Key Identifier (A-KID) based on at least one of the SUPI and the AF identifier, and to perform control to generate a temporary UE external identifier based on at least one of the A-KID and the AF identifier.

[0015] Beneficial effects of the invention

[0016] According to embodiments of this disclosure, a temporary UE identifier of a UE subscribing to a mobile communication system can be obtained as information necessary for an external server located outside the mobile communication system to provide user services.

[0017] Before proceeding with the detailed description below, it may be advantageous to define certain words and phrases used throughout this patent document: the terms “comprising” and “including” and their derivatives mean unrestricted inclusion; the term “or” is inclusive, meaning and / or; the phrases “associated with” and “related to” and their derivatives may mean including, being included in, interconnected with, containing, contained within, connected to or connected with, coupled to or coupled with, able to communicate with, cooperate with, interleaved, juxtaposed, proximate to, bound to or bound with, having, possessing the properties of, etc.; and the term “controller” means any device, system, or part thereof that controls at least one operation, such a device may be implemented in hardware, firmware, or software, or in some combination of at least two of these. It should be noted that the functionality associated with any particular controller may be centralized or distributed, local or remote.

[0018] Furthermore, the various functions described below can be implemented or supported by one or more computer programs, each computer program being formed by computer-readable program code and embodied in a computer-readable medium. The terms "application" and "program" refer to one or more computer programs, software components, instruction sets, procedures, functions, objects, classes, instances, associated data, or portions thereof suitable for implementation in appropriate computer-readable program code. The phrase "computer-readable program code" includes any type of computer code, including source code, object code, and executable code. The phrase "computer-readable medium" includes any type of media accessible by a computer, such as read-only memory (ROM), random access memory (RAM), hard disk drive, optical disc (CD), digital video disc (DVD), or any other type of storage. "Non-transitory" computer-readable media does not include wired, wireless, optical, or other communication links that transmit transient electrical or other signals. Non-transitory computer-readable media includes media that can permanently store data and media that can store data and subsequently overwrite it, such as rewritable optical discs or erasable memory devices.

[0019] This patent document provides definitions for certain words and phrases, and those skilled in the art will understand that, in many cases (if not most), such definitions apply to the prior and future use of the words and phrases defined in this way. Attached Figure Description

[0020] The above and other aspects, features and advantages of certain embodiments of the present disclosure will become more apparent from the following description taken in conjunction with the accompanying drawings, in which:

[0021] Figure 1 This illustrates a scenario where edge computing is configured without layer partitioning;

[0022] Figure 2 This illustrates a structure in which external servers typically interoperate using Application Authentication and Key Management (AKMA) and 3GPP network functions;

[0023] Figure 3a This is a sequence diagram illustrating a method for obtaining a temporary UE identifier using A-KID according to an embodiment of the present disclosure;

[0024] Figure 3b This is a sequence diagram illustrating a method for obtaining a temporary UE identifier when the NEF is provided with the IP address of the UE according to an embodiment of the present disclosure;

[0025] Figure 3c This is a sequence diagram illustrating a method for obtaining a temporary UE identifier when the NEF is provided with an A-KID, according to an embodiment of the present disclosure;

[0026] Figure 4 This is a sequence diagram illustrating a method for generating and managing temporary UE identifiers for NEF according to embodiments of the present disclosure;

[0027] Figure 5 This is a sequence diagram illustrating a method for configuring a temporary UE external identifier using a service provider according to an embodiment of this disclosure;

[0028] Figure 6 This is a sequence diagram illustrating a method for configuring a temporary external identifier for a UE during an AKMA authentication procedure according to an embodiment of the present disclosure;

[0029] Figure 7 This is a sequence diagram illustrating a method for managing a temporary UE external identifier according to an embodiment of the present disclosure;

[0030] Figure 8 This is a sequence diagram illustrating the method by which the EES generates and manages temporary UE external identifiers for each of the multiple EASs;

[0031] Figure 9 This is a block diagram illustrating the configuration of entities according to embodiments of the present disclosure;

[0032] Figure 10 This is a block diagram illustrating the configuration of a server device according to an embodiment of the present disclosure; and

[0033] Figure 11 This is a block diagram illustrating the configuration of a UE according to an embodiment of the present disclosure. Detailed Implementation

[0034] The following discussion Figures 1 to 11 The various embodiments used to describe the principles of this disclosure in this patent document are merely illustrative and should not be construed as limiting the scope of this disclosure in any way. Those skilled in the art will understand that the principles of this disclosure can be implemented in any suitable system or device.

[0035] In describing embodiments of this disclosure, descriptions related to techniques known in the art and not directly associated with this disclosure will be omitted. This omission of unnecessary descriptions is to prevent obscuring the main ideas of this disclosure and to more clearly convey them.

[0036] For the same reason, some elements may be exaggerated, omitted, or shown schematically in the accompanying drawings. Furthermore, the size of each element does not perfectly reflect its actual size. In the drawings, identical or corresponding elements have the same reference numerals.

[0037] The advantages and features of this disclosure, as well as the ways in which they are implemented, will become apparent from the embodiments described in detail below with reference to the accompanying drawings. However, this disclosure is not limited to the embodiments set forth below, but can be implemented in a variety of different forms. The following embodiments are provided only to fully disclose this disclosure and to inform those skilled in the art of its scope, and this disclosure is limited only by the scope of the appended claims. Throughout the specification, the same or similar reference numerals denote the same or similar elements.

[0038] Here it will be understood that each box in a flowchart illustration, and combinations of boxes in a flowchart illustration, can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, special-purpose computer, or other programmable data processing device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing device, create parts for implementing the functions specified in one or more flowchart boxes. These computer program instructions can also be stored in a computer-usable or computer-readable storage medium, which can instruct the computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-usable or computer-readable storage medium produce an article of manufacture including instruction parts that implement the functions specified in one or more flowchart boxes. Computer program instructions can also be loaded onto a computer or other programmable data processing device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, such that the instructions, which execute on the computer or other programmable device, provide steps for implementing the functions specified in one or more flowchart boxes.

[0039] Furthermore, each box in the flowchart diagram may represent a module, code segment, or code section comprising one or more executable instructions for implementing a specified logical function(s). It should also be noted that in some alternative implementations, the functions mentioned in the boxes may appear out of order. For example, two boxes shown consecutively may actually execute substantially concurrently, or the two boxes may sometimes execute in reverse order, depending on the functions involved.

[0040] As used herein, "unit" refers to a software or hardware element that performs a predetermined function, such as a field-programmable gate array (FPGA) or application-specific integrated circuit (ASIC). However, "unit" does not always have a meaning limited to software or hardware. A "unit" can be configured to be stored in addressable memory or to execute one or more processors. Therefore, a "unit" includes, for example, software elements, object-oriented software elements, class elements or task elements, processes, functions, attributes, procedures, subroutines, program code segments, drivers, firmware, microcode, circuits, data, databases, data structures, tables, arrays, and parameters. The elements and functions provided by a "unit" can be combined into a smaller number of elements or "units," or divided into a larger number of elements or "units." Furthermore, elements and "units" can be implemented as replicas of one or more CPUs within a device or secure multimedia card.

[0041] The operating principles of this disclosure will be described in detail below with reference to the accompanying drawings. The terminology described below is defined with reference to the functions in this disclosure and may vary depending on the user, the user's intention, or habits. Therefore, the definition of terminology should be based on the entire contents of this specification.

[0042] In this disclosure, for ease of description, terms referring to network entities and entities of edge computing systems, terms referring to messages, terms referring to identification information, etc., are used illustratively. Therefore, this disclosure is not limited to the terms used below, and other terms relating to the subject matter having equivalent technical meaning may be used.

[0043] In the following description, for ease of description, the terms and names defined in the 5G system standards will be used to describe this disclosure. However, this disclosure is not limited to these terms and names, and can be applied in the same manner to systems conforming to other standards.

[0044] According to embodiments, the external servers disclosed below may include edge computing servers (Edge Enabler Server (EES), Edge Configuration Server (ECS), or Edge Application Server (EAS)).

[0045] For external servers installed outside the operator's 3GPP mobile communication system, a UE identifier is required for interoperability with the network functions of the communication system used to provide services to users. However, it is difficult to pre-configure a UE identifier that can be identified within the 3GPP network for the subscriber UE in the external mobile communication server. Using the UE IP address is also limited because the UE cannot be identified by IP address when Network Address Translation (NAT) is installed. Furthermore, a method is needed to assign a different temporary identifier for each service used (or for each external server), making it impossible to track user personal information.

[0046] Accordingly, this disclosure provides a method for providing a UE identifier required for interoperability with a mobile communication network to an external server. According to embodiments, a method is provided for generating and sending temporary UE identifiers using an identifier provided to an AKMA anchor function (AAnF) that plays the role of authentication and key management for applications (AKMA), and a method for generating and managing different temporary UE identifiers for each external application (or each external server).

[0047] For example, (1) a method in which an external server requests a network function (NF) of a communication system to generate a temporary UE identifier using A-KID or application information, (2) a method for generating different temporary UE identifiers and managing the validity of each external server to protect the user's personal information, (3) a method for matching (or mapping) the generated temporary UE identifier with an external server and registering / updating the temporary UE identifier in a unified data management (UDM), (4) a method for sending the generated temporary UE identifier to an external server using a network exposure function (NEF), and (5) a method for configuring a temporary UE identifier in the UE's client using a session connection (e.g., an EDGE-1 or EDGE-4 interface) between the UE and an external server (e.g., an ECS or EES).

[0048] According to the aforementioned embodiments, a temporary UE identifier is provided to an external server installed outside the operator's network of the mobile communication system, thereby enabling the service to be provided to the user using the 3GPP network exposure function.

[0049] In addition, a method is provided to provide different temporary UE identifiers for each service or external application server and configure temporary UE identifiers in the client (e.g., edge enabler client, EEC) in the UE, thereby minimizing the exposure of fixed UE identifiers (e.g., mobile station international subscriber directory number, MSISDN) and the tracking of user personal information.

[0050] Figure 1 This illustrates a scenario where edge computing is configured without layer partitioning. For example, Figure 1 An edge computing system within the service area of ​​a 3GPP mobile network operator is shown.

[0051] Figure 1 The network and edge computing entities shown are described below.

[0052] In the edge computing system, UE 100 can send application data services to the edge data network 110 and receive application data services from the edge data network 110.

[0053] For example, an edge computing system may include an edge enabler server 120, an edge data network configuration server 130, and an edge enabler client (EEC) 135. The edge enabler server 120 builds an edge hosting environment (or edge computing platform) and can know information about the edge application server 115 running in the edge hosting environment.

[0054] Edge enabler server 120 can perform negotiation functions with UE 100 to connect application client 140 of UE 100 and edge application server 115 in an edge-hosted environment. UE 100 supporting an edge computing system may have an embedded edge enabler client 135. Negotiation can be performed through interoperability between edge enabler client 135 and edge enabler server 120. The layer that performs interoperability (such as negotiation) between edge enabler client 135 and edge enabler server 120 may be referred to as the edge enabler layer. UE 100 mentioned in this disclosure may include not only smartphones but also IoT devices and vehicles.

[0055] Edge configuration server 130 knows deployment information about edge enabler server 120. Edge configuration server 130 can send configuration information for using edge computing services to UE 100. Configuration information may include edge data network connection information (e.g., data network name, S-NSSAI, etc.), edge data network service area (e.g., cell list, tracking area list, and PLMN ID), edge enabler server connection information (e.g., URI), etc. The edge data network service area may be the available area of ​​edge enabler server 120 configured by edge enabler server 120. UE can obtain information about edge enabler servers accessible at a specific location based on the edge data network service area. UE 100 can also obtain this information through edge enabler client 135 when the edge data network configuration server knows information about edge application server 115 running in the edge hosting environment of a specific edge enabler server 120.

[0056] Edge application server 115 refers to a third-party application server running in an edge computing system. For example, edge application server 115 is a third-party application server running on infrastructure provided by an edge hosting environment and is able to provide services close to UE 100, thus providing ultra-low latency services.

[0057] Application client 140, edge enabler client 135 linking application client 140 to edge computing services, and mobile terminal (MT, not shown) accessing the mobile communication system may exist in UE 100. Applications in UE 100 are applications provided by third parties and may refer to client applications running in the UE for any application service. Multiple applications may run in UE 100. At least one of these applications may use mobile edge computing services. Edge enabler client 135 in UE 100 refers to a client that performs operations necessary for using edge computing services in UE 100. For example, edge enabler client 135 may determine whether any application can use edge computing services and may perform operations to connect to a network interface, allowing data from application client 140 of UE 100 to be sent to edge application server 115 providing edge computing services.

[0058] The 3GPP communication layer can be used by mobile terminals to perform operations for establishing data connections for using edge computing services. The 3GPP communication layer can refer to the layer that performs modem operations for using a mobile communication system. For example, the 3GPP communication layer can be used to establish radio connections for data communication, register a UE in a mobile communication system, establish connections for data transmission to and from the mobile communication system, and send and receive data.

[0059] Figure 2 This illustrates a structure in which external servers typically use Application Authentication and Key Management (AKMA) and 3GPP network functions for interoperability.

[0060] When UE 205 wishes to access a 3GPP 5G network, UE 205 can request a registration procedure from the access and mobility management function (AMF) 200. Here, an authentication procedure for UE 205 can be executed. When executing the basic authentication procedure for UE 205, the authentication server function (AUSF) 210 can send a UE authentication-related information request to the unified data management (UDM) 220. When whether AKMA is used is registered in the subscriber information about UE 205 (when information about whether AKMA is applied to the subscriber exists in the UDM), the UDM 220 can send an AKMA indication to the AUSF 210 indicating whether AKMA is applied to UE 205. Upon receiving the AKMA indication from the UDM 220, the AUSF 210 can generate an AKMA anchor key (K_AKMA) and an AKMA key identifier (A-KID). AUSF 210 can register the generated K_AKMA, the generated A-KID, and the subscription permanent identifier (SUPI) in the Application Authentication and Key Management (AKMA) Anchor Function (AAnF) 230.

[0061] AAnF 230 can be installed / deployed in conjunction with AUSF 210 or Network Exposure Function (NEF) 240. When UE 205 sends an application session establishment request to application function (AF) 250, the A-KID can be included. AF 250 can send an AKMA application key (K_AF) request message to AAnF 230, including the A-KID received from UE 205 and AF identifier (AFID) of AF 250. AF 250 can obtain the AKMA application key K_AF in response to this request message. When K_AF is successfully obtained, AF 250 can accept the application session establishment request from UE 205. When K_AF is not obtained, AF 250 can reject the application session establishment request. In general AKMA-based authentication operations, AF 250 can be an ECS or EES of an edge computing system.

[0062] Figure 3aThis is a sequence diagram illustrating a method for obtaining a temporary UE identifier according to an embodiment of the present disclosure; Figure 3b This is a sequence diagram illustrating a method for obtaining a temporary UE identifier according to an embodiment of the present disclosure; and Figure 3c This is a sequence diagram illustrating a method for obtaining a temporary UE identifier according to an embodiment of the present disclosure.

[0063] Specifically, Figure 3a This is a sequence diagram illustrating a general method for obtaining a temporary UE identifier. Figure 3b This is a sequence diagram illustrating a method for obtaining a temporary UE identifier when the NEF is provided with the IP address of the UE, according to an embodiment of the present disclosure. Figure 3c This is a sequence diagram illustrating a method for obtaining a temporary UE identifier when the NEF is provided with an A-KID, according to an embodiment of the present disclosure.

[0064] In operation S310, at least one EAS 303 may send a UE ID application programming interface (API) request to EES 302. This request message may include the UE IP address. EES 302 and / or EAS 303 may be any external server.

[0065] In operation S320, EES 302 can send a temporary UE external identifier (temporary external ID) request message to NEF 301. This request message may include the UE IP address, the EES Application Function (AF) identifier (ID), additional temporary UE external identifier allocation instructions, and EAS information (EAS ID, address information, EAS application ID, application ID used for EAS service provision, application port ID, etc.). When EES 302 supports AKMA authentication, this request message may also include A-KID, which is the AKMA key identifier.

[0066] Additional temporary UE external identifier allocation instructions can refer to a request for the generation and allocation of a new identifier in addition to the UE external identifier that has already been generated / configured by NEF 301.

[0067] When A-KID is included in a temporary UE external identifier request message from EES 302, NEF 301 can identify the validity of A-KID (e.g., the validity of A-KID can be identified by an AAnF query, and the SUPI of the UE identified by A-KID can be obtained from AAnF), and then operation S306 can be performed (generating a temporary UE external identifier based on A-KID and AF ID, without performing operations S330 to S350, which will be described later).

[0068] Specifically, such as Figure 3b As shown, when NEF 301 receives a temporary UE external identifier request message from EES 302 that includes the UE IP address but not the A-KID, it can initiate an operation starting from operation S330.

[0069] In operation S330, NEF 301 can use the UE IP address to obtain the SUPI. For example, when the UE IP address is included in a temporary UE external identifier request message and the A-KID is not included, NEF 301 can find the SUPI value corresponding to the UE IP address. NEF 301 can obtain the SUPI by providing the UE IP address used for binding support functions, or it can determine the SUPI based on the mapping between UE IP addresses and SUPIs stored in NEF 301.

[0070] In operation S340, NEF 301 can find the A-KID using the SUPI. For example, NEF 301 can find the A-KID corresponding to the obtained SUPI value. Alternatively, NEF 301 can find the A-KID corresponding to the obtained SUPI value and AF ID. During the AKMA authentication procedure, the A-KID and SUPI value can be mapped and stored in NEF 301. Therefore, NEF 301 can obtain the A-KID corresponding to the SUPI value based on the mapped A-KID and SUPI value information.

[0071] In operation S350, NEF 301 can obtain A-KID from AAnF 300 (retrieve A-KID from AAnF). For example, when the mapping between SUPI and A-KID is not stored in NEF 301, NEF 301 can provide AAnF 300 with at least one of the SUPI value and AFID. NEF 301 can receive an A-KID corresponding to at least one of the SUPI value and AFID.

[0072] In operation S360, NEF 301 can generate a temporary UE external identifier. For example, NEF 301 can use the obtained A-KID value and the AF ID received from EES 302 to generate a temporary UE external identifier that can be used for the corresponding AF. According to an embodiment, NEF (301) can configure the temporary UE external identifier in the format of username@field by combining the fully qualified domain name (FQDN) part of the AF ID and the field part of the A-KID. When both the AF ID and EAS information are received, NEF 301 can configure the username part including the AF ID and EAS information, or it can configure the username part using only the EAS information. When an "additional temporary UE external identifier allocation instruction" is received from EES 302, NEF 301 needs to generate a new identifier that is different from the UE external identifier that has already been generated / configured by NEF 301. When EAS information about multiple EAS 303 is received from EES 302, NEF 301 can generate multiple UE external identifiers for each EAS 303. For example, NEF 301 can generate multiple temporary UE external identifiers, each corresponding to a different EAS 303. NEF 301 can then match (map) the generated temporary UE external identifiers with SUPI and A-KID and store them.

[0073] When NEF 301 receives a Temporary UE External Identifier Request message including A-KID from EES 302, NEF 301 can use the A-KID included in the Temporary UE External Identifier Request message received from EES 302 to obtain SUPI, such as... Figure 3c As shown. NEF 301 can use the A-KID, AFID or EAS information received from EES 302 as described above to generate a temporary UE external identifier, and can match (map) the generated temporary UE external identifier with the obtained SUPI and store it.

[0074] In operation S370, NEF 301 can register the generated temporary UE external identifier in UDM 304. For registration, the message sent by NEF 301 to UDM 304 may include the generated temporary UE external identifier, AF ID, and EAS information (application port identifier or application identifier in a UE with an application session connected to the AF). The temporary UE external identifier can be registered in UDM 304, thereby mapping it to SUPI, AF ID, and EAS information (application port identifier or application identifier in a UE with an application session connected to the AF). Alternatively, NEF 301 can register the temporary UE external identifier corresponding to SUPI, AF ID, and EAS information in a user data store (UDR, not shown) other than UDM 304.

[0075] In operation S380, NEF 301 can subscribe to the event exposure notification service provided by UDM 304 by sending a Nudm_EventExposure_Subscribe message to UDM 304 to manage the validity period of temporary UE external identifiers. Events governed by Nudm_EventExposure_Subscribe can include UE reachability, PDU session state, CN type change, roaming status, etc. The expiration conditions for A-KID validity can include the following:

[0076] -When the validity period of A-KID expires, the validity period of the temporary UE external identifier also expires;

[0077] - When a UE is deregistered, the validity period of the temporary UE external identifier expires;

[0078] - The validity of the temporary UE external identifier expires when the application session between the UE and the AF expires. For example, the validity of the temporary UE external identifier may also expire (with the same validity period as the PDU session) when the PDU session in which the application session between the UE and the AF was established is released; and / or

[0079] - The validity of a temporary UE external identifier may also expire when the UE's core network (CN) type changes. For example, when the UE's CN type changes from 5GC to Evolved Packet Core (EPC), the validity of the temporary UE external identifier based on A-KID may also expire because AKMA authentication is not available in EPC.

[0080] In another embodiment, NEF 301 can send a request to the AMF or SMF for subscription to the event exposure notification service. In this case, NEF 301 can directly receive event occurrence notifications from the AMF or SMF, such as UE deregistration, UE reachability, CN type change, roaming status, and PDU session status.

[0081] When NEF 301 receives an event notification, NEF 301 can determine that the validity of the temporary UE external identifier generated in operation S360 has expired.

[0082] In operation S390, NEF 301 can send a temporary UE external identifier to the AF (EES). Multiple temporary UE external identifiers can be sent, and each temporary UE external identifier can be different for each application server (e.g., EAS) connected to the AF (e.g., EES).

[0083] In operation S395, EES 302 can send a temporary UE external identifier received from NEF 301 to EAS 303. Alternatively, EES 302 can send an EDGE-3 dedicated UE identifier obtained by modifying the temporary UE external identifier received from NEF 301 for each EAS 303. Specifically, NEF 301 can provide a temporary UE external identifier to EES 302, and EES 302 can generate and manage multiple EDGE-3 interface (interface between EES 302 and EAS 303) dedicated UE identifiers corresponding to the temporary UE external identifier received from NEF 301. Different EDGE-3 dedicated UE identifiers can be assigned to each EAS 303 registered in EES 302.

[0084] According to the aforementioned disclosure, an external server located outside the mobile communication network can obtain a temporary UE identifier of a UE subscribing to the mobile communication system, thereby providing services to the UE. For example, an external server that cannot identify information such as an IP address can easily provide services to the UE based on the temporary UE identifier. (See reference...) Figures 3a to 3c As mentioned above, an external server can obtain a temporary UE external identifier by requesting NEF.

[0085] Here, because a temporary UE external identifier is used, the UE can avoid exposing personal information. Furthermore, a different temporary UE external identifier is generated for each application server (e.g., EAS), thus using a different temporary UE external identifier depending on the external server, which prevents personal information about the UE from being exposed to the external server.

[0086] Figure 4This is a sequence diagram illustrating a method for generating and managing temporary UE identifiers for NEF according to an embodiment of this disclosure.

[0087] In operation S410, EES 400 sends a temporary UE external identifier request message to NEF 401. This request message may include the UE IP address, the EES AF ID, and information about the EAS registered with the EES. The information about the EAS may include the application descriptor of the services provided by the EAS, the EAS AF ID, the OS app ID (the identifier of the application receiving services from the EAS in the UE), the application port ID (the port identifier of the application receiving services from the EAS in the UE), etc.

[0088] In operation S420, NEF 401 can find the SUPI value corresponding to the UE IP address included in the temporary UE external identifier request message received from EES 400. To obtain the SUPI value, NEF 401 can provide the UE IP address to the binding support function (BSF) and obtain the SUPI value from the BSF, or it can determine the SUPI based on the IP address-SUPI mapping information stored in NEF 401.

[0089] In operation S430, as described above, NEF 401 can obtain the A-KID value corresponding to the obtained SUPI. To obtain the A-KID value, NEF 401 can provide the SUPI value to AAnF and obtain the A-KID value from AAnF. Alternatively, NEF 401 can find the A-KID based on the A-KID-SUPI mapping information stored in NEF 401. The A-KID corresponding to the SUPI and the UE IP address obtained from EES can be mapped and stored in NEF 401.

[0090] In operation S440, NEF 401 can generate temporary UE external identifiers, which can be mapped and stored with UE IP address, SUPI, and A-KID. When a message sent from EES 400 to NEF 401 includes information about multiple EASs, NEF 401 can generate temporary UE external identifiers for each of the multiple EASs. NEF 401 can store the generated temporary UE external identifiers as information for mapping with EES AF ID and information about the EAS (application descriptor, EASAF ID, OS app ID, and application port ID).

[0091] In operation S450, NEF 401 can register / configure the temporary UE external identifier generated by the aforementioned method as information for mapping with the EES AF ID and information about the EAS in UDM or UDR 402.

[0092] In operation S460, UDM or UDR 402 can send a response to NEF 401 in response to a registration / configuration request from NEF 401.

[0093] In operation S470, when NEF 401 receives a successful registration / configuration response from UDM or UDR 402, NEF 401 can send a temporary UE external identifier to EES 400. Multiple temporary UE external identifiers can be generated and mapped to multiple EAS messages and provided to EES 400.

[0094] Figure 5 This is a sequence diagram illustrating a method for configuring a temporary UE external identifier using a service provider according to an embodiment of the present disclosure.

[0095] In operation S510, the EEC 500 in the UE can execute an application session establishment procedure to provide services to the ECS 503. During the application session establishment procedure between the EEC 500 and ECS 503, the EEC 500 can provide an A-KID to the ECS 503. The ECS 503 can use the received A-KID to perform an AKMA authentication procedure and complete the application session establishment procedure between the EEC 500 and ECS 503.

[0096] In operation S520, EEC 500 can send a service provisioning request message to ECS 503 to receive edge configuration information from ECS 503. When EEC 500 does not have information about the temporary UE external identifier, EEC 500 can send a service provisioning request message that includes a temporary UE external identifier configuration request indication, or it can send a request message to ECS 503 that does not include information about the UE identifier.

[0097] In operation S530, when the service provisioning request message received from EEC 500 includes a temporary UE external identifier configuration request indication or does not include information about the UE identifier, ECS 503 may send a temporary UE external identifier request message to NEF 502. The temporary UE external identifier request message sent from ECS 503 to NEF 502 may include at least one of ECS 503's A-KID and AF ID. If necessary, ECS 503 may also include the AF ID of the EES expected to send an EEC registration or EAS discovery request message in the request message, and may send the request message to NEF 502.

[0098] In operation S540, NEF 502 can perform a verification procedure on the A-KID received from ECS 503. Furthermore, NEF 502 can obtain the SUPI value by identifying the UE indicated by the A-KID. To obtain the SUPI value, NEF 502 can send the A-KID received from ECS 503 to AAnF 501 and obtain the SUPI corresponding to that UE.

[0099] In operation S550, NEF 502 can generate / assign a temporary UE external identifier indicated by the A-KID received from ECS 503. For example, NEF 502 can generate / assign a temporary UE external identifier corresponding to the AF ID and autonomously acquired SUPI received from ECS 503. NEF 502 can register the generated temporary UE external identifier in UDM. The message sent by NEF 502 to UDM for this registration may include the generated temporary UE external identifier, AF ID, SUPI, etc. The temporary UE external identifier can be mapped to SUPI and AF ID and registered in UDM. Alternatively, the temporary UE external identifier can be registered in a UDR other than UDM, corresponding to the UE's SUPI and AF ID.

[0100] In operation S560, NEF 502 can send the generated / assigned temporary UE external identifier to ECS 503. For example, NEF 502 can send a response message including the temporary UE external identifier to a temporary UE external identifier request message from ECS 503.

[0101] In operation S570, ECS 503 can send a service provisioning response message, which includes a temporary UE external identifier received from NEF 502 and edge configuration information, to EEC 500.

[0102] When the EEC 500 receives a temporary UE external identifier via a service provisioning response message, it can use the received temporary UE external identifier when subsequently communicating with the edge computing server (ECS or EES). For example, the EEC 500 can use the temporary UE external identifier received from the ECS 503 when it needs to include the UE identifier when sending a service provisioning request message to the ECS 503 or an EEC registration request, EAS discovery request, or application context relocation initiation request message to the EES.

[0103] Figure 6 This is a sequence diagram illustrating a method for configuring a temporary external identifier for a UE during an AKMA authentication procedure according to an embodiment of the present disclosure.

[0104] In operation S610, UE 600 (e.g., the UE's EEC) can execute an application session establishment procedure that includes the AKMA authentication procedure. UE 600 can send an application session establishment procedure request message to ECS 603.

[0105] In S620 operation, ECS 603 can send an AKMA key request to NEF 602. ECS 603 can also send an AKMA key request to AAnF 601 via NEF 602. The AKMA key request message may include A-KID and AF_ID.

[0106] In operation S630, NEF 602 can obtain K_AF and K_AF expiration time from AAnF 601.

[0107] After successfully receiving K_AF from AAnF 601, in operation S640, NEF 602 can generate a temporary UE external identifier based on A-KID and AF_ID received from ECS 603.

[0108] When a temporary UE external identifier is generated in S640, in operation S650, NEF 602 can send an AKMA key request response message to ECS 603, which includes K_AF and K_AF expiration time obtained from AAnF 601 and the temporary UE external identifier.

[0109] When the temporary UE external identifier is not included in the AKMA key request response message received from NEF 602, in operation S660, ECS 603 may send a temporary UE external identifier request message to NEF 602 according to the edge computing service provider policy. The temporary UE external identifier request message may include the ECS's A-KID and AF ID.

[0110] After receiving a temporary UE external identifier request message from ECS 603, NEF 602 can generate a temporary UE external identifier in operation S670, as in the previous operation S604. For example, NEF 602 can generate a temporary UE external identifier based on the A-KID and AF_ID included in the request message sent by ECS 603.

[0111] In operation S680, NEF 602 can send the generated temporary UE external identifier to ECS 603.

[0112] In operation S690, NEF 602 can register a temporary UE external identifier in UDM 604. For example, after sending the generated temporary UE external identifier to ECS 603, NEF 602 can register the temporary UE external identifier in UDM 604. When registering the temporary UE external identifier, a temporary UE external identifier corresponding to the UE's SUPI and AF ID can be registered in UDM 604. Alternatively, the temporary UE external identifier can be registered in a UDR other than UDM 604, corresponding to the UE's SUPI and AF ID.

[0113] When ECS 603 successfully establishes an application session with UE (EEC) 600 including AKMA authentication, in operation S691, ECS 603 may include the temporary UE external identifier obtained in the above process in the response message to the application session establishment request, and may send the response message to UE 600.

[0114] In operation S692, UE (EEC) 600 may store a temporary UE external identifier included in the application session establishment request response message received from ECS 603. Furthermore, UE (EEC) 600 may use the received temporary UE external identifier in messages subsequently sent to ECS 603 or EES (e.g., service provisioning requests, EEC registration requests, EAS discovery requests, or application context relocation initiation requests). According to an embodiment, UE (EEC) 600 may generate an EEC ID by modifying the temporary UE external identifier received from ECS 603.

[0115] In operation S693, UE (EEC) 600 may include the temporary UE external identifier or EEC ID obtained or regenerated in the aforementioned operation in a message sent to ECS 603 or EES (e.g., service provisioning request, EEC registration request, EAS discovery request, or application context relocation initiation request). For example, UE (EEC) 600 may send a service provisioning request message including the temporary UE external identifier to ECS 603.

[0116] Figure 7 This is a sequence diagram illustrating a method for managing temporary UE external identifiers according to an embodiment of the present disclosure.

[0117] After obtaining a temporary UE external identifier from EES 702, in operation S710, EAS 703 can request to subscribe to an event notification service related to the management (change or expiration) of the received identifier. The subscription request message may include the UE identifier, the notification target address, etc.

[0118] In operation S720, EES 702 can request NEF 701 to subscribe to the temporary UE external identifier management event notification service. Alternatively, EES 702 can request notification services from NEF 701 related to the occurrence of the following events:

[0119] -UE cancellation;

[0120] - The validity of the temporary UE external identifier expires when the application session between the UE and the AF expires. For example, the validity of the temporary UE external identifier may also expire (its validity period is the same as the PDU session lifespan) when the PDU session in which the application session between the UE and the AF was established is released; and / or

[0121] - The validity of a temporary UE external identifier may also expire when the UE's CN type changes. For example, when the UE's CN type changes from 5GC to EPC, the validity of the temporary UE external identifier based on A-KID may also expire because AKMA authentication is not available in EPC.

[0122] In operation S730, NEF 701 can subscribe to event occurrence notification services related to different 3GPP NFs (e.g., AMF, SMF, UDM, or AAnF) to monitor whether events related to the management of temporary UE external identifiers received from EES 702 have occurred. According to an embodiment, NEF 701 can request to subscribe to the A-KID validity expiration event notification service from AAnF. The A-KID validity expiration event notification subscription request message sent from NEF 701 to AAnF may include A-KID, AF ID, SUPI, indication of an updated A-KID, etc.

[0123] When a subscription request is accepted by AAnF, AAnF may send a notification of the corresponding event to NEF 701 when the A-KID expires. Alternatively, when an indication of an updated A-KID is included in a notification subscription request message sent from NEF 701 to AAnF, AAnF may not immediately send a notification message indicating the expiration of the A-KID to NEF 701 when the A-KID expires. When a new (valid) A-KID for the UE is generated, AAnF may send a notification message to NEF 701 including the newly generated valid A-KID.

[0124] In operation S740, NEF 701 is prepared to detect whether an event related to the management of the temporary UE external identifier has occurred, and then send a response message to EES 702. The response message may include the subscription-related ID and the expiration time of the notification service.

[0125] In operation of S750, EES 702 can send response messages received from NEF 701 to EAS 703.

[0126] In operation S760, events such as UE deregistration, application session expiration between UE and AF, UE CN type change (5GC to EPC), A-KID expiration, and EEC deregistration from EES can be detected. Here, in operation S770, EES 702 can send an event notification message (UE ID management event notification message) to EAS 703. When EES 702 obtains a newly generated A-KID (from AAnF) due to A-KID expiration, EES 702 can generate a new temporary UE external identifier and include this new temporary UE external identifier in the UE ID management event notification message to be sent to EAS 703.

[0127] Figure 8 This is a sequence diagram illustrating the methods for generating and managing temporary UE external identifiers for each of a plurality of EAS. Figure 8 The method provides a way to reduce the involvement / load of the 3GPP CN in generating and managing EAS-specific temporary UE external identifiers (signaling load between the NEF and EES within the 3GPP CN and signaling load for UE identifier UDM / UDR registration). For example, when requesting UE identifiers from multiple EASs, the EES can perform the generation and management of UE identifiers to autonomously prevent personal information tracking without causing signaling between the EES and the 3GPP CN in each request.

[0128] exist Figure 8In the illustrated embodiment, when the temporary UE external identifier is stored in EES 801 (S810), the operation of EES begins upon receiving a UE identifier request from the EAS registered in EES 801. Figure 8 EAS1 802 and EAS2 803 can be multiple servers serving a single UE. EES 801 can be the source EES.

[0129] In operation S820, EAS1 802 sends a UE identifier request message to EES 801. The UE identifier request message includes UE-related information, such as the UE's IP address.

[0130] In operation S830, EES 801 can identify a temporary UE external identifier that matches the UE information received from EAS1, and can generate / assign an EAS1-specific temporary UE identifier (a UE identifier used only on the EDGE-3 interface between EAS1 and EES). In operation S840, EES 801 can send the generated / assigned temporary UE identifier to EAS1802.

[0131] In operation S850, EAS2 803 can send a UE identifier request message to EES 801. The UE identifier request message may include UE-related information, such as the UE's IP address.

[0132] In operation S860, EES 801 can identify a temporary UE external identifier (UE identifier obtained from NEF) that matches the UE information received from EAS2 803, and can generate / assign an EAS2 dedicated temporary UE identifier to the UE that is different from the already assigned EDGE-3 dedicated temporary UE identifier (EAS1 dedicated temporary UE identifier).

[0133] In operation S870, EES 801 can send the EAS2-specific temporary UE identifier to EAS2 803. EES 801 can store the mapping between the temporary UE external identifier obtained from NEF and the EAS1 / EAS2-specific UE identifier. When a capability exposure request is received from EAS1 802 or EAS2 803, and because of this request, EES 801 needs to request information about the UE or service from NEF or 3GPP NF, EES 801 can generate an AF request message to be sent to NEF or 3GPP NF, including / using the temporary UE external identifier obtained from NEF.

[0134] In operation S880 or S881, when EES 801 receives status information from EEC 800 regarding the application client (AC) connected to EAS1 802 (e.g., AC operation terminated) or receives an EAS deregistration request message from EAS1 802, EES 801 can identify that the services of EAS1 802 are not being provided to the UE. Apart from the aforementioned situations, operation S880 or S881 can be applied to all situations in which EES 801 can identify that the services of EAS1 802 are no longer being provided to the UE.

[0135] In operation S890, when EES 801 identifies that EAS1 802 has suspended service for a specific UE in the aforementioned operation, EES 801 can cause the validity of the UE identifier dedicated to EAS1 802 (the UE identifier dedicated to the EDGE-3 interface between EAS1 and EES) to expire. The expired EDGE-3 dedicated UE identifier can be revoked and can be reused by another UE or another EAS.

[0136] EES 801 can receive an application context relocation initiation request from EEC 800 in operation S891, or it can receive an UP path change notification from a 3GPP network (e.g., NEF 804) in operation S892. Here, EES 801 can perform application context relocation for the target EES 805.

[0137] In operation S893, when application context relocation is successfully performed in the aforementioned operation, EES 801 may cause the validity of the EAS-specific UE identifier (EAS1 / EAS2-specific UE identifier as described above) assigned to the UE in which EEC 800 is installed in EES 801 to expire.

[0138] In operation S894, EES 801 can send a request to NEF 804 to request the expiration of the validity of the allocated temporary UE external identifier. In operation S895, source EES 801 can send the temporary UE external identifier obtained from NEF 804 to target EES 805 according to the edge computing service policy. The request message to NEF 804 for the expiration of the temporary UE external identifier may include the AF ID of source EES 801 and the temporary UE external identifier to be expired.

[0139] exist Figure 8 In this context, EAS1 802 and EAS2 803 can each request to subscribe to a notification service for the expiration of the validity period of the assigned EDGE-3 dedicated UE identifier (a notification sent from EES to EAS).

[0140] Although edge computing servers have been described as specific embodiments in the description of this disclosure, all application servers capable of interoperating with 3GPP network systems are included within the scope of this disclosure.

[0141] Figure 9 This is a block diagram illustrating the configuration of an entity according to an embodiment of this disclosure. The entity may be an entity that performs a Network Exposure Function (NEF).

[0142] The entity may include a transceiver 900, a storage device 910, and a controller 920. The transceiver 900 can send signals to and receive signals from another network entity. The transceiver 900 can receive request messages (e.g., from an EES). The transceiver 900 can communicate with an application server (e.g., an EAS) via the EES.

[0143] The storage device 910 can store at least one of the information transmitted and received by the transceiver 900 and the information generated by the controller 920.

[0144] In this disclosure, the controller 920 may be defined as a circuit, an application-specific integrated circuit, or at least one processor.

[0145] The controller 920 can control the overall operation of entities according to embodiments provided in this disclosure. According to an embodiment, the controller 920 can control the transceiver 900 to receive a temporary user equipment (UE) external identifier request message, which includes at least one of the UE's Internet Protocol (IP) address and Application Function (AF) identifier.

[0146] In addition, the controller 920 can perform control to obtain the UE's Subscription Permanent Identifier (SUPI) based on the UE's IP address, and obtain the Application Authentication and Key Management (AKMA) Key Identifier (A-KID) based on at least one of the SUPI and AF identifiers.

[0147] In addition, controller 920 can perform control to generate a temporary UE external identifier based on at least one of A-KID and AF identifier.

[0148] When the temporary UE external identifier request message includes A-KID, the controller 920 can perform control to generate a temporary UE external identifier based on the A-KID and AF identifier included in the temporary UE external identifier request message.

[0149] When a temporary UE external identifier request message includes an additional temporary UE external identifier allocation instruction, controller 920 may perform control to generate a new temporary UE external identifier that is not previously generated by the entity.

[0150] When a temporary UE external identifier request message includes multiple pieces of server information, the controller 920 can perform control to generate multiple temporary UE external identifiers based on the multiple pieces of server information respectively.

[0151] The controller 920 can control the transceiver 900 to send at least one of the generated temporary UE external identifier, AF identifier, and server information to the entity performing the unified data management (UDM) function.

[0152] The controller 920 can control the transceiver 900 to send the generated temporary UE external identifier to at least one server. When generating a temporary UE external identifier for each of multiple servers, each of the generated temporary UE external identifiers can be sent to each of the multiple servers.

[0153] The controller 920 can control the transceiver 900 to send the SUPI to the Application Authentication and Key Management (AKMA) Anchor Function (AAnF) and receive the A-KID corresponding to the SUPI from the AAnF.

[0154] The controller 920 can perform control to map and store in the storage device 910 A-KID corresponding to the SUPI and IP address included in the temporary UE external identifier request message.

[0155] Figure 10 This is a block diagram illustrating the configuration of a server device according to an embodiment of the present disclosure. The server device may include a transceiver 1000, a storage device 1010, and a controller 1020. The transceiver 1000 can send signals to and receive signals from another network entity. The transceiver 1000 can send information to and receive information from an entity (e.g., NEF).

[0156] Storage device 1010 can store at least one of information transmitted and received by transceiver 1000 and information generated by controller 1020. For example, storage device 1010 can store a temporary UE external identifier received by transceiver 1000.

[0157] The controller 1020 may be defined as a circuit, an application-specific integrated circuit (ASIC), or at least one processor. The controller 1020 can control the overall operation of the UE according to embodiments provided in this disclosure. For example, the controller 1020 may provide services to the UE using a received temporary UE external identifier.

[0158] Figure 11This is a block diagram illustrating the configuration of a UE according to an embodiment of the present disclosure. The UE may include a transceiver 1100, a storage device 1110, and a controller 1120. The transceiver 1100 can send signals to and receive signals from another network entity. For example, the transceiver 1100 can send and receive information to and from an external server, such as an application server.

[0159] Storage device 1110 may store at least one of information transmitted and received by transceiver 1100 and information generated by controller 1120. For example, storage device 1110 may store a temporary UE external identifier received by transceiver 1100, such that the received temporary UE external identifier can be used in subsequent communications with the edge computing server.

[0160] Controller 1120 may be defined as a circuit, an application-specific integrated circuit (ASIC), or at least one processor. Controller 1120 may control the overall operation of the UE according to embodiments provided in this disclosure. For example, controller 1120 may perform control to execute an application session establishment procedure with an application server. Furthermore, as described above, controller 1120 may control the storage of temporary UE external identifiers received via transceiver 1100 in storage device 1110. Controller 1120 may control the use of the received temporary UE external identifiers in communication between the UE and the edge computing server. Although specific embodiments have been described in the detailed description of this disclosure, various modifications are possible without departing from the scope of this disclosure. Therefore, the scope of this disclosure should not be limited to the described embodiments and should be defined not only by the claims described below but also by their equivalents.

[0161] Although this disclosure has been described with reference to various embodiments, various changes and modifications will be apparent to those skilled in the art. This disclosure is intended to include such changes and modifications that fall within the scope of the appended claims.

Claims

1. A Network Exposure Function (NEF) entity in a wireless communication system, the NEF comprising: transceiver; as well as At least one processor is configured as follows: The system receives a User Equipment (UE) Identifier (ID) request message from the Application Function (AF) via a transceiver. The UE ID request message includes the UE's Internet Protocol (IP) address and the AF ID. Based on the UE's IP address and the AF ID, obtain the temporary UE external ID, and A response message, including the obtained temporary UE external ID, is sent to the AF via the transceiver.

2. The NEF entity according to claim 1, wherein, The at least one processor is further configured to: Based on the UE's IP address, obtain the UE's Subscription Permanent Identifier (SUPI), and The temporary UE external ID is obtained based on the obtained SUPI.

3. The NEF entity according to claim 2, wherein, The at least one processor is further configured to: The transceiver sends the UE's IP address to the Binding Support Function (BSF) entity, and The transceiver receives the SUPI corresponding to the IP address of the UE from the BSF entity.

4. The NEF entity according to claim 1, wherein, The UE ID request message also includes an application port ID.

5. The NEF entity according to claim 1, wherein, The at least one processor is further configured to: The transceiver receives an AKMA key request message from the AF for the application authentication and key management (AKMA) authentication procedure. The AKMA key request message includes an AKMA key identifier (A-KID) and the AF ID. Based on the A-KID and the AF ID, the temporary UE external ID is sent to the AF via the transceiver.

6. The NEF entity according to claim 1, wherein, The at least one processor is further configured to: At least one of the temporary UE external ID, the AF ID, or the application port ID is sent to the Unified Data Management (UDM) entity via the transceiver.

7. The NEF entity according to claim 1, wherein, The at least one processor is further configured to: Obtain the SUPI of the UE based on the UE's IP address. The SUPI is sent to the AKMA Anchor Function (AAnF) entity via the transceiver. Receive the A-KID corresponding to the SUPI from the AAnF entity via the transceiver, and The temporary UE external ID is obtained based on at least one of the A-KID or the AF ID.

8. The NEF entity according to claim 7, wherein, The at least one processor is further configured to: When the UE ID request message includes the IP address of the UE, the A-KID corresponding to the SUPI and the IP address included in the UE ID request message are mapped and stored.

9. A method for a Network Exposure Function (NEF) entity in a wireless communication system, the method comprising: Receive a User Equipment (UE) Identifier (ID) Request message from the Application Function (AF), the UE ID Request message including the UE's Internet Protocol (IP) address and AF ID; Obtain a temporary UE external ID based on the UE's IP address and the AF ID; and Send a response message to the AF including the obtained temporary UE external ID.

10. The method of claim 9, further comprising: The subscription permanent identifier (SUPI) of the UE is obtained based on the UE's IP address. as well as The temporary UE external ID is obtained based on the obtained SUPI.

11. The method of claim 10, further comprising: Send the UE's IP address to the Binding Support Function (BSF) entity; as well as Receive the SUPI corresponding to the IP address of the UE from the BSF entity.

12. The method according to claim 9, wherein, The UE ID request message also includes an application port ID.

13. The method of claim 9, further comprising: The AF receives an AKMA key request message for the application authentication and key management (AKMA) authentication procedure, the AKMA key request message including an AKMA key identifier (A-KID) and the AF ID; as well as The temporary UE external ID is sent to the AF based on the A-KID and the AF ID.

14. The method of claim 9, further comprising: Send at least one of the temporary UE external ID, the AF ID, or the application port ID to the Unified Data Management (UDM) entity.

15. The method of claim 9, further comprising: Obtain the SUPI of the UE based on the UE's IP address; Send the SUPI to the AKMA Anchor Function (AAnF) entity; Receive the A-KID corresponding to the SUPI from the AAnF entity; and The temporary UE external ID is obtained based on at least one of the A-KID or the AF ID.

16. The method of claim 15, further comprising: When the UE ID request message includes the IP address of the UE, the A-KID corresponding to the SUPI and the IP address included in the UE ID request message are mapped and stored.

Images