Establishment and discovery of application-related default protocol data unit sessions in 5G networks

Abstract

An automated method for enabling an enterprise communication system (3) to contact a device application of a device (1) comprising a (wireless) transceiver (1.1) and connected to a 5G communication network (3) via a (radio) communication access network, whereby an enterprise application of the enterprise communication system (3) subscribes to a PDU update from the 5G communication network (2), the device application has a unique device application identifier, whereby the device application has a unique device application identifier, whereby the unique device identifier is provided to the device (1), and whereby the device identifier is used by the device (1) during login, characterized by the following steps: i) requesting, by the device (1), a PDU (Protocol Data Unit) session from the 5G communication network (2), ii) creating, by the 5G communication network (2), the requested PDU session, whereby the device application has a unique device application identifier, whereby the device application has a unique device application identifier, whereby the unique device identifier is provided to the device (1), and whereby the device identifier is used by the device (1) during login. Iii) adding, by the session management function (SMF), information about the new PDU session to a database of the 5G communication network (2), iv) informing, by the 5G communication network (2), the enterprise application about the new PDU session, v) inferring, by the enterprise application, a device identifier or a device application identifier from the information provided by the session management function (SMF), vi) if the device application identifier and / or the device identifier matches the list of identifiers or application types, the enterprise application contacts the device application by using information contained in the received PDU event notification, thereby storing the list in the enterprise communication system.

Description

Technical Field

[0001] The present invention relates to an automated method for a device application for enabling an enterprise communication system to contact a device, the device comprising a wireless transceiver and connected to a 5G communication network via a (radio) communication access network. The invention also relates to an arrangement designed for running the method. Background Art

[0002] The present invention disclosure report solves the following scenario. The application (= device application) resides on a mobile or static device, and the device includes a 5G (wireless) transceiver. The transceiver is hereinafter also referred to as user equipment (abbreviated as: UE). The UE logs on (onboard) to the 5G network. Enterprise applications connected to the 5G network via a user plane function (abbreviated as: UPF) can in principle communicate with device applications via the 5G network. To do this, the UE must request a protocol data unit (abbreviated as: PDU) session between the UE and the UPF from the 5G network. Once the session is initiated, the UE can notify the enterprise application that it can now be reached via the 5G network.

[0003] However, some device applications (e.g., smoke detectors and light switches) act as servers and expect to be connected to by enterprise applications, rather than the other way around, i.e., they themselves do not act as clients connected to enterprise applications. This creates a chicken and egg problem: the device application expects to be connected to by the enterprise application, but the enterprise application does not know the IP address of the UE associated with the device application, and the enterprise application cannot request a PDU session from the associated UE.

[0004] Some solutions that help solve this problem are disclosed in the prior art, such as:

[0005] 1. Provide the enterprise application address and data network name to the UE through an offline mechanism, such as by configuring the UE manually or via another channel (Bluetooth, WLAN...).

[0006] 2. If there is no DNS server available locally, the UE or enterprise application can use a discovery mechanism like mDNS (multicast DNS, RFC 6762 or https: / / en.wikipedia.org / wiki / Multicast_DNS) to resolve the host name to a local IP address. Here, the enterprise application will send a message to a URL unique to the device application. For example, a URL representing a device application identifier.

[0007] 3. The mechanism of dynDNS (dynamic DNS, https: / / de.wikipedia.org / wiki / Dynamisches_DNS) is also known. It enables the dynamic update of the computer's IP address to a DNS name. This can be used to handle the recovery of the UE's IP address when a server residing "behind" the UE is reachable under a fixed name. Here, the device needs to associate its IP address with its URL on the DNS server.

[0008] 4. The applicant's solution solves the problem of reversing the client and server roles at the TLS layer between two hosts during the TCP channel opening. This solves the situation where the TCP client (here, the device with the UE) should act as a TLS server. The solution involves establishing the channel once the IP address is known.

[0009] 5. European patent application 22173744.8 describes how to signal a device provisioning method (including information about the provisioning server, such as IP address, authentication certificates, etc.) to the device with which a session is established. This method is applicable to provisioning methods originating from the device (acting as a client), but also to provisioning methods originating from an enterprise application or provisioning service. Here, the address of the provisioning server and related information are provided by the network during network access.

[0010] 6. The mechanism of publish and subscribe is known (https: / / en.wikipedia.org / wiki / Publish%E2%80%93subscribe_pattern), which allows a publisher to send messages to a group of receivers that the publisher may not know. Subscribers to a specific source and / or message will receive the message. Technically, this can be achieved through different multicast addresses or through middleware that manages subscribers to specific messages or events. This approach is used in protocols such as XMPP, Jabber, and OPC-UA. In the context of the question in the first part, the session management function (SMF) acts as a publisher and the enterprise application acts as a subscriber. Summary of the invention

[0011] The purpose of the present invention is to provide a solution for enterprise applications to reach / contact server applications on a device connected to a 5G communication network via a (wireless) transceiver.

[0012] To achieve this object, the invention provides solutions according to the independent claims. Advantageous embodiments are provided in the dependent claims.

[0013] According to one aspect of the present disclosure, an enterprise communication infrastructure is able to query a server on a device connected to a 5G communication system via a (radio) communication access network. This is achieved by leveraging the latest methods of publish-subscribe and reverse session establishment and combining them with modified 5G capabilities.

[0014] The invention claims an automated method for enabling an enterprise communication system to contact a device application of a device, the device comprising a wireless transceiver and connected to a 5G communication network via a (radio) communication access network, - an enterprise application of the enterprise communication system subscribes to a PDU session update from the 5G communication network, - whereby the device application has a unique device application identifier, - thereby providing the device with a unique device identifier, and - whereby the device identifier is used by the device during login, thus: i) The device requests a PDU session from the 5G communication network (the request can be triggered by the application middleware or the device application itself), ii) the requested PDU session is created by the 5G communication network, iii) Information about the new PDU session is added to the database of the 5G communication network by the Session Management Function (SMF), iv) The 5G communication network informs the enterprise application about the new PDU session, v) the device identifier or device application identifier is inferred by the enterprise application from the information provided by the SMF, vi) if the device application identifier and / or the device identifier matches a list of identifiers or application types (e.g., "light switch", "light sensor"), the enterprise application contacts the device application by using the information contained in the received PDU event notification, whereby the list is stored in the enterprise communication system. The list contains information about the devices that the enterprise application needs to interact with.

[0015] In a further embodiment of the method, the device identifier and / or the device application identifier is associated with an IPv6 address, which is provided to the wireless transceiver by the device application or device middleware, whereby the IPv6 address contains the device application identifier to ensure a one-to-one relationship between the IPv6 address and the device application identifier.

[0016] "Associated" and "contained" mean that the device application identifier may not be part of IPv6 in clear text but in a protected form to ensure that 5G networks may not have access to this information. Protection can be achieved by encrypting the device application information with a symmetric key known to both the application generating the GPSI and the enterprise application. The encryption can be done using known encryption algorithms such as AES (Advanced Encryption Standard) or 3DES (Triple Data Encryption Standard) or others. Alternatively, the information can be encrypted using an asymmetric method such as RSA (Rivest, Shamir, Adleman) or ECIES (Elliptic Curve Integrated Encryption Scheme).

[0017] In a further embodiment of the method, the device identifier and / or the device application identifier is associated with a unique GPSI (General Public Subscription Identifier).

[0018] "Associated" means that the device application identifier may not be part of the GPSI in plain text but in a protected form to ensure that the 5G network may not have access to the information. Protection can be achieved by encrypting the device application information with a symmetric key known to both the application generating the GPSI and the enterprise application. The encryption can be done using known encryption algorithms such as AES (Advanced Encryption Standard) or 3DES (Triple Data Encryption Standard) or others. Alternatively, the information can be encrypted using an asymmetric method such as RSA (Rivest, Shamir, Adleman) or ECIES (Elliptic Curve Integrated Encryption Scheme).

[0019] In a further embodiment of the method, the generation of the GPSI is based on the device application identifier to ensure a one-to-one relationship between the GSPI and the device application identifier.

[0020] In a further embodiment of the method, GPSI generation is also based on the device identifier to ensure a one-to-one relationship between GPSI and device identifier.

[0021] In a further embodiment of the method, the GPSI is part of the PDU session information stored in a pertinent database of the SMF.

[0022] In a further embodiment of the method, the enterprise application retrieves the address and GPSI of the wireless transceiver from an SMF event notification published after the new PDU session has been established. The enterprise app retrieves the device application identifier from the GPSI, and The enterprise application also retrieves the device identifier from the GPSI, if provided.

[0023] In a further embodiment of the method, the enterprise application uses the IP address contained in the SMF event notification for sending data packets to the device application via a User Plane Function (UPF).

[0024] In a further embodiment of the method, the IPv6 address contains the device identifier to ensure a one-to-one relationship between the IPv6 address and the device identifier.

[0025] In a further embodiment of the method, the enterprise application retrieves the IPv6 address of the (wireless) transceiver from an SMF event notification published after the new PDU session has been established.

[0026] In a further embodiment of the method, the enterprise application retrieves the device application identifier from the IPv6 address.

[0027] In a further embodiment of the method, the enterprise application also retrieves the device identifier from the IPv6 address (if provided).

[0028] In a further embodiment of the method, the enterprise application uses an IPv6 address when sending data packets to the device application via a user plane function (UPF).

[0029] The invention also claims an arrangement which is designed to carry out the method according to the invention.

[0030] The advantages of the present invention are:

[0031] 1) Support server applications on devices connected to 5G networks via UE.

[0032] 2) There is no need to pre-configure the mobile device (application) with the address of the enterprise application or the address of the domain name resolution server (see Section 2).

[0033] 3) When using an intermediate application, a. People do not need to plan what enterprise applications can contact device applications (as is the case with prior art). b. The IP addresses of the enterprise applications that receive (multiple) SMF event notifications will not be leaked to the 5G system, nor will it leak how many enterprise applications have received the information.

[0034] 4) Neither the device application identifier nor the device identifier will be leaked to the 5G network.

[0035] In a further embodiment Other benefits and advantages of the present invention will become apparent after careful reading of the detailed description with appropriate reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 A block diagram showing the arrangement, and Figure 2A -C shows a flow chart of an embodiment of the method. DETAILED DESCRIPTION

[0037] Two variations of this solution are disclosed: one utilizing a General Public Subscription Identifier (GPSI) and the other utilizing IPv6 addresses.

[0038] Both variants are based on Figure 1 Same arrangement as shown. Figure 1 A block diagram of an arrangement is shown, comprising a device 1 with a (wireless) transceiver, a 5G communication network (2) and an enterprise communication system 3 comprising enterprise applications, such as a provisioning server. The device 1 and the enterprise communication system are linked to the 5G communication network via a (radio) access link.

[0039] Both variations include the following steps:

[0040] I. Initiation a. The mobile device (1) is equipped with a unique device identifier (eg, GPSI, IPv6 address). b. Applications on the enterprise communication system 3 subscribe to event notifications from the network's session management function (SMF).

[0041] II. The identifier is provided to the UE, for example by device middleware or during previous manual UE configuration.

[0042] III. The UE uses this identifier during registration.

[0043] IV. After that, the UE requests a PDU session from the network. This session is also called a connection. This request can be triggered by the application middleware or the device application.

[0044] V. The network creates the requested PDU session.

[0045] VI.SMF adds information about the new PDU session to the network database.

[0046] VII. Notify the enterprise application about the new PDU session. (See step Ib).

[0047] VIII. The enterprise application infers the device application identifier from the information provided by the SMF.

[0048] IX. If the identifier matches the list of identifiers or application types ("light switch", "light sensor"), the enterprise application contacts the device application by using the information contained in the received SMF event notification.

[0049] Peculiarities of GPSI-Based Implementation Regarding step Ia: GPSI generation is based on the device application identifier, and there is a one-to-one relationship between GSPI and the device application identifier. In an improvement of the present disclosure, GPSI is also based on the device identifier, and there is a one-to-one relationship between GPSI and the device identifier.

[0050] Regarding step VI: GPSI is part of the PDU session information stored in the relevant SMF database.

[0051] Regarding step VIII: The Enterprise Application retrieves the UE's IP address and GPSI from the SMF Event Notification published after the new PDU Session has been established. The Enterprise Application retrieves the Device Application Identifier from the GPSI. If provided, the Enterprise Application also retrieves the Device Identifier from the GPSI.

[0052] Regarding step IX: The enterprise application uses the IP address contained in the SMF event notification for sending data packets to the device application via the UPF.

[0053] Specificities of IPv6-based implementations Regarding step II: the device application or device middleware provides the UE with an IPv6 address. The address contains a device application identifier, and there is a one-to-one relationship between the IPv6 address and the device application identifier. Optionally, the IPv6 address also contains a device identifier, and there is a one-to-one relationship between the IPv6 address and the device identifier.

[0054] Regarding step VIII: The Enterprise Application retrieves the IPv6 address of the UE from the SMF Event Notification issued after the new PDU Session has been established. The Enterprise Application retrieves the Device Application Identifier from the IPv6 address. If provided, the Enterprise Application also retrieves the Device Identifier from the IPv6 address.

[0055] Regarding step IX: When sending data packets to the device application via the UPF, the enterprise application uses the IPv6 address.

[0056] Further Embodiments A. The device identifier or device application identifier is stored in the GSPI or IPv6 address in a way that the 5G system cannot infer the identifier. For example, this can be achieved by encrypting the device (application) identifier. This can be achieved through symmetric encryption, where both the application generating the GPSI or IPv6 address and the enterprise application need to know the key. Alternatively, this can be done through asymmetric encryption (directly using RSA or indirectly using ECDSA in combination with semi-static Diffie Hellman key agreement), called ECIES. In this case, the application generating the GPSI or IPv6 address needs to know the public key of the application on the enterprise side.

[0057] B. Instead of the enterprise application, the middle application subscribes to event notifications from the SMF. The application distributes the information received from the SMF to other applications. For example, this can be achieved through a publish-subscribe mechanism. Here, the enterprise application subscribes to SMF updates from the middle application.

[0058] The advantage of using an intermediate application is that only one application on the enterprise side needs to be authenticated and authorized by the 5G network as an application function. In addition, SMF event notifications only need to be sent to one application function.

[0059] C. In an improvement of B, the intermediary application distributes only a subset of the received SMF event notifications to the enterprise application, such as only GPSI and IPv6 addresses.

[0060] D. In an improvement to B, the intermediary application infers the device (application) identifier from the SMF event notification and provides it to the enterprise application.

[0061] E. A variation of GSPI is used for layer 2 PDU sessions. Here, MAC addresses are used as endpoint identifiers and they are exposed by SMF.

[0062] F. According to ETSI TS123 316, the access of device applications to the 5G network is coordinated by the wired access network.

[0063] Necessary changes to 3GPP specifications GPSI-based solution: Add GSPI to PDU establishment information element and related SMF data objects.

[0064] IPv6-based solution: Add the device application's IPv6 address to the UE's PDU session request; this becomes the UE's static IPv6 address.

[0065] Figures 2A to 2CThe example shown in the flowchart shows how the disclosed solution can be combined with the disclosure of European patent application 22173744.8. Here, the UE provides information about the login or bootstrapping methods supported by the device (of which the UE is part). This information can be provided during the PDU session establishment. In a variant, the information provided can also contain information about existing certificates on the device UE, such as manufacturer certificates or subject key identifiers (SKID). Examples of these methods are OPC UA, NETCONF, RESTCONF, CMP, SCEP, EST, BRSKI (and variants). This enables enterprise applications to call methods supported by the device. With the contact information of the login device available (IP address, certificate information, etc.), the enterprise application can use the method described in European patent application 22173744.8 to provide information about the enterprise application to perform the login. For the provisioning server (PVS), this can be certificate information, such as the SKID or fingerprint of the PVS's certificate, or the serial number and issuer of the PVS certificate.

[0066] When the PDU session is established, the device provides information about its own certificates (here: IDevID) and about the login methods it supports (here: NETCONF). In response, it receives its IP address and information about the PVS (here: PVS-SKID).

[0067] The PVS is now informed about the new UE and has relevant information (such as GPSI, DEV-SKID, supported login methods, etc.). The PVS as an enterprise application can then perform a lookup in its device database to query the login and configuration status of the device. If the device is new and needs to be configured, or if the configuration of the device needs to be updated, the PVS contacts the device to provision locally managed credentials (here, LDevID) to the device using the signaled login method (here: NETCONF).

[0068] Although the present invention has been explained relative to its preferred embodiment as described above, it will be appreciated that many other possible modifications and variations may be made without departing from the scope of the present invention. Therefore, it is contemplated that one or more of the appended claims will cover these modifications and variations that fall within the true scope of the present invention.

[0069] Reference numerals list 1 device 1.1 (Wireless) Transceiver 2 5G Communication Network 3Enterprise communication system.

Claims

1. An automated method for enabling an enterprise communication system (3) to contact a device application of a device (1), the device comprising a transceiver (1.1) and connected to a 5G communication network (3) via a (radio) communication access network, - an enterprise application of the enterprise communication system (3) subscribes to PDU updates from the 5G communication network (2), - whereby the device application has a unique device application identifier, - thereby providing the device (1) with a unique device identifier, and - whereby the device identifier is used by the device (1) during the logging on, It is characterized by the following steps: i) a PDU (Protocol Data Unit) session is requested by the device (1) from the 5G communication network (2), ii) the requested PDU session is established by the 5G communication network (2), iii) information about the new PDU session is added to a database of the 5G communication network (2) by a session management function (SMF), iv) the enterprise application is informed by the 5G communication network (2) about the new PDU session, v) the device identifier or device application identifier is inferred by the enterprise application from the information provided by the SMF, vi) if the device application identifier and / or the device identifier matches the list of identifiers or application types, the enterprise application contacts the device application by using the information contained in the received PDU event notification, thereby storing the list in the enterprise communication system, The device identifier and / or device application identifier is thereby an IPv6 address, which is provided to the wireless transceiver by the device application or device middleware, whereby the IPv6 address contains the device application identifier to ensure a one-to-one relationship between the IPv6 address and the device application identifier.

2. The method according to claim 1, wherein The device identifier is a unique General Public Subscription Identifier (GPSI).

3. The method according to claim 2, wherein GPSI generation is based on the device application identifier to ensure a one-to-one relationship between GSPI and device application identifier.

4. The method according to claim 3, wherein GPSI generation is also based on the device identifier to ensure a one-to-one relationship between GPSI and device identifier.

5. A method according to one of claims 2 to 4, whereby the GPSI is part of the PDU session information stored in a relevant database of the SMF.

6. A method according to one of claims 2 to 5, whereby the enterprise application retrieves the address and GPSI of the radio transceiver from an SMF event notification issued after the new PDU session is established, The enterprise application retrieves the device application identifier from the GPSI, and The enterprise application also retrieves the device identifier from the GPSI, if provided.

7. A method according to one of claims 2 to 6, whereby the enterprise application uses an IP or MAC address contained in an SMF event notification for sending data packets to a device application via a User Plane Function (UPF).

8. Method according to one of the preceding claims, whereby the IPv6 also contains a device identifier to ensure a one-to-one relationship between the IPv6 address and the device identifier.

9. The method according to one of the preceding claims, whereby The enterprise application retrieves the IPv6 address of the radio transceiver from the SMF event notification published after the new PDU session has been established.

10. The method according to one of the preceding claims, whereby The enterprise application retrieves the device application identifier from the IPv6 address.

11. The method according to claim 10, wherein The enterprise application also retrieves the device identifier from the IPv6 address, if provided.

12. The method according to one of the preceding claims, whereby The enterprise application uses IPv6 addresses when sending data packets to the device application via the User Plane Function (UPF).

13. Arrangement designed and configured to carry out the method according to one of claims 1 to 12.

Images