PDU session assisted authentication and authorization and slice specific authentication and authorization using L3 WTRU to network relay

Abstract

A wireless transmit / receive unit (WTRU) may be configured to receive a key identifier. The key identifier may be associated with a second WTRU. Additionally or alternatively, the key identifier may include a 5G ProSe remote user key (5GPRUK) identifier (ID). The WTRU may be configured as a WTRU to network relay for the second WTRU. The key identifier may be received during a key request procedure. The key request procedure may be performed by the WTRU on behalf of the second WTRU. The WTRU may be configured to transmit the key identifier to a network function. The key identifier may be transmitted to the network function to initiate a secondary authentication procedure. The WTRU may be configured to receive an authentication response message from the second WTRU. The WTRU may be configured to receive a response from the network function.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the benefit of U.S. Provisional Patent Application No. 63 / 323,760, filed on March 25, 2022, which is hereby incorporated by reference in its entirety. Background Art

[0003] Specific security procedures performed over the control plane have been specified for 5G Proximity Services (ProSe) associated with remote wireless transmit / receive unit (WTRU) and relay WTRU authorization and PC5 link security. For example, remote WTRU and relay WTRU authorization and PC5 link security may be based on remote WTRU authentication (e.g., performed by the network via the relay WTRU during PC5 link establishment). Summary of the invention

[0004] A first wireless transmit / receive unit (WTRU) may be configured to receive a key identifier. The key identifier may be associated with a second WTRU. Additionally or alternatively. For example, the key identifier may include a 5G ProSe Remote User Key (5GPRUK) identifier (ID) associated with the second WTRU. The first WTRU may be configured as a WTRU to network relay for the second WTRU. For example, the first WTRU may be a relay WTRU and the second WTRU may be a remote WTRU. The key identifier may be received during a key request procedure. The key request procedure may be performed by the first WTRU on behalf of the second WTRU.

[0005] The first WTRU may be configured to transmit the key identifier to a network function. The key identifier may be transmitted to the network function to initiate a secondary authentication procedure (e.g., a slice-specific authentication procedure). For example, the key identifier may be transmitted to the network function to initiate a secondary authentication procedure on behalf of the second WTRU. The first WTRU may be configured to receive an authentication message (e.g., from the network function). The authentication message may include the key identifier, which may be used to determine that the authentication message is associated with the second WTRU. Additionally or alternatively, the first WTRU may be configured to transmit the authentication message to the second WTRU. For example, the first WTRU may be configured to transmit the authentication message to the second WTRU based on the authentication message including the key identifier. The network function may be identified by an access and mobility function (AMF) or a session management function (SMF). The AMF may send the key identifier to the SMF. For example, the SMF may send the key identifier to a ProSe anchor function (PAnF) or a ProSe key management function (PKMF).

[0006] The first WTRU may be configured to receive an authentication response message from the second WTRU. The authentication response message may include the key identifier. Additionally or alternatively, the first WTRU may be configured to receive a response from the network function. The response may include the key identifier. Additionally or alternatively, the response may indicate the result of the auxiliary authentication procedure. The key identifier may be transmitted to the network function in a remote WTRU report message. The response may include a remote WTRU report response message. The first WTRU may be configured to send an indication that the second WTRU is authorized to communicate via a link or release the link. For example, the first WTRU may be configured to send an indication that the second WTRU is authorized to communicate via a link or release the link based on the remote WTRU report response message. The link may be a PC5 link.

[0007] A base station may be configured to receive a key identifier. The key identifier may be received from a first WTRU. The key identifier may be associated with a second WTRU. The first WTRU may be configured as a WTRU-to-network relay for the second WTRU. The key identifier may be received during a key request procedure. The key request procedure may be performed by the first WTRU on behalf of the second WTRU. The key identifier may be received to initiate a secondary authentication procedure on behalf of the second WTRU. The base station may be configured to send an authentication message. For example, the base station may be configured to send the authentication message to the second WTRU. The authentication message may include the key identifier. The authentication message may be transmitted to the second WTRU via the first WTRU. For example, the authentication message may be transmitted to the second WTRU via the first WTRU based on the authentication message including the key identifier. The base station may be configured to send a response to the first WTRU. The response may include the key identifier. Additionally or alternatively, the response may indicate a result of the secondary authentication procedure. The WTRU may release a link with the second WTRU based on the result of the secondary authentication procedure. Data network (DN) information may be retrieved from the second WTRU.For example, a secondary authentication may be triggered based on a determination that the DN is authorized, that the DN requires a secondary authentication, and one or more of a previous authentication. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1A is a system diagram illustrating an example communication system in which one or more disclosed embodiments may be implemented;

[0009] Figure 1B is an example of an embodiment in which Figure 1A A system diagram of an example wireless transmit / receive unit (WTRU) for use within the illustrated communication system;

[0010] Figure 1C is an example of an embodiment in which Figure 1A a system diagram of an example Radio Access Network (RAN) and an example Core Network (CN) used within the illustrated communication system;

[0011] Figure 1D is an example of an embodiment in which Figure 1A A system diagram of another example RAN and another example CN used within the illustrated communication system;

[0012] Figure 2 illustrates examples associated with 5GPRUK / 5GPRUKID exchange between a remote WTRU, a relay WTRU, and a network using a control plane;

[0013] Figure 3A and Figure 3B illustrates examples associated with key identifier 5GPRUK / 5GPRUK ID exchange between a remote WTRU, a WTRU to network relay and a network using a user plane;

[0014] Figure 4A and Figure 4B illustrates examples associated with a protocol data unit (PDU) session assisted authentication and authorization (A&A) procedure performed via a layer 3 WTRU to network relay; and

[0015] Figure 5A and Figure 5B Illustrated are examples associated with Network Slice Specific Authentication and / or Authorization (NSSAA) procedures performed via a Layer 3 WTRU to network relay. DETAILED DESCRIPTION

[0016] Figure 1A 1 is a diagram illustrating an example communication system 100 in which one or more disclosed embodiments may be implemented. The communication system 100 may be a multiple access system that provides content such as voice, data, video, messaging, broadcast, etc. to multiple wireless users. The communication system 100 may enable multiple wireless users to access such content through sharing of system resources (including wireless bandwidth). For example, the communication system 100 may employ one or more channel access methods such as code division multiple access (CDMA), time division multiple access (TDMA), frequency division multiple access (FDMA), orthogonal FDMA (OFDMA), single carrier FDMA (SC-FDMA), zero tail unique word DFT spread OFDM (ZT UW DTS-s OFDM), unique word OFDM (UW-OFDM), resource block filtered OFDM, filter bank multi-carrier (FBMC), etc.

[0017] like Figure 1AAs shown, the communication system 100 may include wireless transmit / receive units (WTRUs) 102a, 102b, 102c, 102d, RAN 104 / 113, CN 106 / 115, public switched telephone network (PSTN) 108, Internet 110 and other networks 112, but it should be understood that the disclosed embodiments contemplate any number of WTRUs, base stations, networks, and / or network elements. Each of the WTRUs 102a, 102b, 102c, 102d may be any type of device configured to operate and / or communicate in a wireless environment. By way of example, the WTRUs 102a, 102b, 102c, 102d (any of which may be referred to as a “station” and / or “STA”) may be configured to send and / or receive wireless signals and may include user equipment (UE), a mobile station, a fixed or mobile subscriber unit, a subscription-based unit, a pager, a cellular phone, a personal digital assistant (PDA), a smart phone, a laptop, a netbook, a personal computer, a wireless sensor, a hotspot or Mi-Fi device, an Internet of Things (IoT) device, a watch or other wearable device, a head-mounted display (HMD), a vehicle, a drone, medical devices and applications (e.g., remote surgery), industrial devices and applications (e.g., robots and / or other wireless devices operating in an industrial and / or automated process chain environment), a consumer electronic device, a device operating on a commercial and / or industrial wireless network, etc. Any of the WTRUs 102a, 102b, 102c, and 102d may be interchangeably referred to as a WTRU.

[0018] The communication system 100 may also include a base station 114a and / or a base station 114b. Each of the base stations 114a, 114b may be any type of device that is configured to wirelessly interface with at least one of the WTRUs 102a, 102b, 102c, 102d to facilitate access to one or more communication networks, such as the CN 106 / 115, the Internet 110, and / or other networks 112. By way of example, the base stations 114a, 114b may be a base transceiver station (BTS), a Node B, an eNode B, a Home Node B, a Home eNode B, a gNB, an NR Node B, a site controller, an access point (AP), a wireless router, and the like. While the base stations 114a, 114b are each depicted as a single element, it should be appreciated that the base stations 114a, 114b may include any number of interconnected base stations and / or network elements.

[0019] The base station 114a may be part of the RAN 104 / 113, which may also include other base stations and / or network elements (not shown), such as a base station controller (BSC), a radio network controller (RNC), a relay node, etc. The base station 114a and / or the base station 114b may be configured to send and / or receive wireless signals on one or more carrier frequencies (which may be referred to as cells (not shown)). These frequencies may be in a licensed spectrum, an unlicensed spectrum, or a combination of licensed and unlicensed spectrums. A cell may provide coverage of wireless services to a specific geographic area, which may be relatively fixed or may change over time. The cell may be further divided into cell sectors. For example, a cell associated with the base station 114a may be divided into three sectors. Therefore, in one embodiment, the base station 114a may include three transceivers, i.e., one transceiver for each sector of the cell. In an embodiment, the base station 114a may employ multiple-input multiple-output (MIMO) technology and may utilize multiple transceivers for each sector of the cell. For example, beamforming may be used to send and / or receive signals in a desired spatial direction.

[0020] The base stations 114a, 114b may communicate with one or more of the WTRUs 102a, 102b, 102c, 102d over an air interface 116, which may be any suitable wireless communication link (e.g., radio frequency (RF), microwave, centimeter wave, micrometer wave, infrared (IR), ultraviolet (UV), visible light, etc.). The air interface 116 may be established using any suitable radio access technology (RAT).

[0021] More specifically, as noted above, the communication system 100 may be a multiple access system and may employ one or more channel access schemes such as CDMA, TDMA, FDMA, OFDMA, SC-FDMA, etc. For example, the base station 114a in the RAN 104 / 113 and the WTRUs 102a, 102b, 102c may implement a radio technology such as Universal Mobile Telecommunications System (UMTS) Terrestrial Radio Access (UTRA), which may use Wideband CDMA (WCDMA) to establish the air interface 115 / 116 / 117. WCDMA may include communication protocols such as High Speed ​​Packet Access (HSPA) and / or Evolved HSPA (HSPA+). HSPA may include High Speed ​​Downlink (DL) Packet Access (HSDPA) and / or High Speed ​​UL Packet Access (HSUPA).

[0022] In an embodiment, the base station 114a and the WTRUs 102a, 102b, 102c may implement a radio technology such as Evolved UMTS Terrestrial Radio Access (E-UTRA) that may establish the air interface 116 using Long Term Evolution (LTE) and / or Advanced LTE (LTE-A) and / or Advanced LTE Pro (LTE-APro).

[0023] In an embodiment, the base station 114a and the WTRUs 102a, 102b, 102c may implement a radio technology such as NR radio access, which may establish the air interface 116 using New Radio (NR).

[0024] In an embodiment, the base station 114a and the WTRUs 102a, 102b, 102c may implement multiple radio access technologies. For example, the base station 114a and the WTRUs 102a, 102b, 102c may together implement LTE radio access and NR radio access, for example using the dual connectivity (DC) principle. Thus, the air interface utilized by the WTRUs 102a, 102b, 102c may be characterized by multiple types of radio access technologies and / or transmissions transmitted to / from multiple types of base stations (e.g., eNBs and gNBs).

[0025] In other embodiments, the base station 114a and the WTRUs 102a, 102b, 102c may implement radio technologies such as IEEE 802.11 (i.e., Wireless Fidelity (WiFi)), IEEE 802.16 (i.e., Worldwide Interoperability for Microwave Access (WiMAX)), CDMA2000, CDMA2000 1X, CDMA2000 EV-DO, Interim Standard 2000 (IS-2000), Interim Standard 95 (IS-95), Interim Standard 856 (IS-856), Global System for Mobile Communications (GSM), Enhanced Data rates for GSM Evolution (EDGE), GSM EDGE (GERAN), etc.

[0026] Figure 1AThe base station 114b in the may be, for example, a wireless router, a Home NodeB, a Home eNodeB, or an access point, and may utilize any suitable RAT to facilitate wireless connectivity in a local area, such as a business location, a home, a vehicle, a campus, an industrial facility, an air corridor (e.g., for use by drones), a road, and the like. In one embodiment, the base station 114b and the WTRUs 102c, 102d may implement a radio technology (such as IEEE 802.11) to establish a wireless local area network (WLAN). In an embodiment, the base station 114b and the WTRUs 102c, 102d may implement a radio technology (such as IEEE 802.15) to establish a wireless personal area network (WPAN). In yet another embodiment, the base station 114b and the WTRUs 102c, 102d may utilize a cellular-based RAT (e.g., WCDMA, CDMA2000, GSM, LTE, LTE-A, LTE-A Pro, NR, etc.) to establish a picocell or a femtocell. As Figure 1A As shown, base station 114b may have a direct connection to Internet 110. Therefore, base station 114b may not need to access Internet 110 via CN 106 / 115.

[0027] The RAN 104 / 113 may be in communication with the CN 106 / 115, which may be any type of network configured to provide voice, data, applications, and / or Voice over Internet Protocol (VoIP) services to one or more of the WTRUs 102a, 102b, 102c, 102d. The data may have different quality of service (QoS) requirements, such as different throughput requirements, latency requirements, error tolerance requirements, reliability requirements, data throughput requirements, mobility requirements, etc. The CN 106 / 115 may provide call control, billing services, mobile location-based services, prepaid calling, Internet connectivity, video distribution, etc., and / or perform advanced security functions, such as user authentication. Although not described in detail in the text, the CN 106 / 115 may be configured to provide voice, data, applications, and / or Voice over Internet Protocol (VoIP) services to one or more of the WTRUs 102a, 102b, 102c, 102d. The data may have different quality of service (QoS) requirements, such as different throughput requirements, latency requirements, error tolerance requirements, reliability requirements, data throughput requirements, mobility requirements, etc. The CN 106 / 115 may provide call control, billing services, mobile location-based services, prepaid calling, Internet connectivity, video distribution, etc., and / or perform advanced security functions, such as user authentication. Figure 1A Although not shown in the figure, it will be appreciated that the RAN 104 / 113 and / or the CN 106 / 115 may be in direct or indirect communication with other RANs that employ the same RAT as the RAN 104 / 113 or a different RAT. For example, in addition to being connected to the RAN 104 / 113, which may utilize NR radio technology, the CN 106 / 115 may also be in communication with another RAN (not shown) that employs GSM, UMTS, CDMA 2000, WiMAX, E-UTRA, or WiFi radio technology.

[0028] The CN 106 / 115 may also serve as a gateway for the WTRUs 102a, 102b, 102c, 102d to access the PSTN 108, the Internet 110, and / or other networks 112. The PSTN 108 may include a circuit-switched telephone network that provides plain old telephone service (POTS). The Internet 110 may include a global system of interconnected computer networks and devices that use common communication protocols, such as the Transmission Control Protocol (TCP), the User Datagram Protocol (UDP), and / or the Internet Protocol (IP) in the TCP / IP Internet protocol suite. The networks 112 may include wired communication networks and / or wireless communication networks owned and / or operated by other service providers. For example, the networks 112 may include another CN connected to one or more RANs, which may employ the same RAT as the RAN 104 / 113 or a different RAT.

[0029] Some or all of the WTRUs 102a, 102b, 102c, 102d in the communication system 100 may include multi-mode capabilities (e.g., the WTRUs 102a, 102b, 102c, 102d may include multiple transceivers for communicating with different wireless networks via different wireless links). Figure 1A The illustrated WTRU 102c may be configured to communicate with the base station 114a, which may employ a cellular-based radio technology, and with the base station 114b, which may employ an IEEE 802 radio technology.

[0030] Figure 1B is a system diagram illustrating an example WTRU 102. Figure 1B As shown, the WTRU 102 may include, among other things, a processor 118, a transceiver 120, a transmit / receive element 122, a speaker / microphone 124, a keypad 126, a display / touchpad 128, non-removable memory 130, removable memory 132, a power source 134, a global positioning system (GPS) chipset 136, and / or other peripherals 138. It will be appreciated that the WTRU 102 may include any sub-combination of the foregoing elements while remaining consistent with an embodiment.

[0031] The processor 118 may be a general purpose processor, a special purpose processor, a conventional processor, a digital signal processor (DSP), a plurality of microprocessors, one or more microprocessors associated with a DSP core, a controller, a microcontroller, an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) circuit, any other type of integrated circuit (IC), a state machine, etc. The processor 118 may perform signal decoding, data processing, power control, input / output processing, and / or any other functionality that enables the WTRU 102 to operate in a wireless environment. The processor 118 may be coupled to the transceiver 120, which may be coupled to the transmit / receive element 122. Although Figure 1B The processor 118 and the transceiver 120 are depicted as separate components, but it is understood that the processor 118 and the transceiver 120 may be integrated together in an electronic package or chip.

[0032] The send / receive element 122 may be configured to send a signal to a base station (e.g., base station 114a) or receive a signal from the base station by an air interface 116. For example, in one embodiment, the send / receive element 122 may be an antenna configured to send and / or receive an RF signal. In an embodiment, the send / receive element 122 may be a transmitter / detector configured to send and / or receive, for example, IR, UV or visible light signals. In another embodiment, the send / receive element 122 may be configured to send and / or receive both RF signals and optical signals. It should be understood that the send / receive element 122 may be configured to send and / or receive any combination of wireless signals.

[0033] Although the transmit / receive element 122 Figure 1B 1 as a single element, the WTRU 102 may include any number of transmit / receive elements 122. More specifically, the WTRU 102 may employ MIMO technology. Thus, in one embodiment, the WTRU 102 may include two or more transmit / receive elements 122 (e.g., multiple antennas) for transmitting and receiving wireless signals over the air interface 116.

[0034] The transceiver 120 may be configured to modulate signals to be transmitted by the transmit / receive element 122 and to demodulate signals received by the transmit / receive element 122. As noted above, the WTRU 102 may have multi-mode capabilities. For example, the transceiver 120 may include multiple transceivers for enabling the WTRU 102 to communicate via multiple RATs, such as NR and IEEE 802.11.

[0035] The processor 118 of the WTRU 102 may be coupled to and may receive user input data from a speaker / microphone 124, a keypad 126, and / or a display / touchpad 128 (e.g., a liquid crystal display (LCD) display unit or an organic light emitting diode (OLED) display unit). The processor 118 may also output user data to the speaker / microphone 124, the keypad 126, and / or the display / touchpad 128. In addition, the processor 118 may access information from and store data in any type of suitable memory, such as a non-removable memory 130 and / or a removable memory 132. The non-removable memory 130 may include a random access memory (RAM), a read-only memory (ROM), a hard disk, or any other type of memory storage device. The removable memory 132 may include a subscriber identity module (SIM) card, a memory stick, a secure digital (SD) memory card, and the like. In other embodiments, the processor 118 may access information from and store data in a memory that is not physically located on the WTRU 102, such as on a server or a home computer (not shown).

[0036] The processor 118 may receive power from the power source 134, and may be configured to distribute and / or control power to other components in the WTRU 102. The power source 134 may be any suitable device for powering the WTRU 102. For example, the power source 134 may include one or more dry cell batteries (e.g., nickel-cadmium (NiCd), nickel-zinc (NiZn), nickel-metal hydride (NiMH), lithium-ion (Li-ion), etc.), solar cells, fuel cells, etc.

[0037] The processor 118 may also be coupled to the GPS chipset 136, which may be configured to provide location information (e.g., longitude and latitude) regarding the current location of the WTRU 102. In addition to or in lieu of the information from the GPS chipset 136, the WTRU 102 may receive location information from a base station (e.g., base stations 114a, 114b) over the air interface 116 and / or determine its location based on the timing of signals received from two or more nearby base stations. It will be appreciated that the WTRU 102 may acquire location information by any suitable location-determination method while remaining consistent with an embodiment.

[0038] The processor 118 may also be coupled to other peripherals 138, which may include one or more software modules and / or hardware modules that provide additional features, functionality, and / or wired or wireless connectivity. For example, the peripherals 138 may include an accelerometer, an electronic compass, a satellite transceiver, a digital camera (for photos and / or video), a universal serial bus (USB) port, a vibration device, a television transceiver, a hands-free headset, module, a frequency modulation (FM) radio unit, a digital music player, a media player, a video game player module, an Internet browser, a virtual reality and / or augmented reality (VR / AR) device, an activity tracker, etc. The peripheral device 138 may include one or more sensors, which may be one or more of the following: a gyroscope, an accelerometer, a Hall effect sensor, a magnetometer, an orientation sensor, a proximity sensor, a temperature sensor, a time sensor; a geolocation sensor; an altimeter, a light sensor, a touch sensor, a magnetometer, a barometer, a gesture sensor, a biometric sensor, and / or a humidity sensor.

[0039] The WTRU 102 may include a full-duplex radio for which transmission and reception of some or all signals (e.g., associated with specific subframes for both UL (e.g., for transmission) and downlink (e.g., for reception)) may be concurrent and / or simultaneous. The full-duplex radio may include an interference management unit 139 for reducing and / or substantially eliminating self-interference via signal processing performed by hardware (e.g., a choke) or via a processor (e.g., a separate processor (not shown) or via the processor 118). In an embodiment, the WRTU 102 may include a half-duplex radio for which transmission and reception of some or all signals (e.g., associated with specific subframes for both UL (e.g., for transmission) or downlink (e.g., for reception)) may be concurrent and / or simultaneous.

[0040] Figure 1C 1 is a system diagram illustrating the RAN 104 and the CN 106 in accordance with an embodiment. As noted above, the RAN 104 may employ an E-UTRA radio technology to communicate with the WTRUs 102a, 102b, 102c over the air interface 116. The RAN 104 may also be in communication with the CN 106.

[0041] The RAN 104 may include evolved Node-Bs 160a, 160b, 160c, though it will be appreciated that the RAN 104 may include any number of evolved Node-Bs while remaining consistent with an embodiment. The evolved Node-Bs 160a, 160b, 160c may each include one or more transceivers for communicating with the WTRUs 102a, 102b, 102c over the air interface 116. In one embodiment, the evolved Node-Bs 160a, 160b, 160c may implement MIMO technology. Thus, the evolved Node-B 160a, for example, may use multiple antennas to transmit wireless signals to and / or receive wireless signals from the WTRU 102a.

[0042] Each of the evolved Node Bs 160a, 160b, 160c may be associated with a particular cell (not shown) and may be configured to handle radio resource management decisions, handover decisions, scheduling of users in UL and / or DL, etc. Figure 1C As shown, the eNode-Bs 160a, 160b, 160c may communicate with one another via an X2 interface.

[0043] Figure 1C The illustrated CN 106 may include a mobility management entity (MME) 162, a serving gateway (SGW) 164, and a packet data network (PDN) gateway (or PGW) 166. While each of the foregoing elements is depicted as being part of the CN 106, it should be understood that any of these elements may be owned and / or operated by an entity other than the CN operator.

[0044] The MME 162 may be connected to each of the evolved Node-Bs 162a, 162b, 162c in the RAN 104 via an S1 interface and may serve as a control node. For example, the MME 162 may be responsible for authenticating users of the WTRUs 102a, 102b, 102c, bearer activation / deactivation, selecting a particular serving gateway during an initial attach of the WTRUs 102a, 102b, 102c, etc. The MME 162 may provide a control plane function for switching between the RAN 104 and other RANs (not shown) that employ other radio technologies, such as GSM and / or WCDMA.

[0045] The SGW 164 may be connected to each of the evolved Node-Bs 160a, 160b, 160c in the RAN 104 via an S1 interface. The SGW 164 may generally route and forward user data packets to / from the WTRUs 102a, 102b, 102c. The SGW 164 may perform other functions, such as anchoring the user plane during inter-evolved Node-B handovers, triggering paging when DL data is available for the WTRUs 102a, 102b, 102c, managing and storing the context of the WTRUs 102a, 102b, 102c, and the like.

[0046] The SGW 164 may be connected to the PGW 166, which may provide the WTRUs 102a, 102b, 102c with access to packet-switched networks, such as the Internet 110, to facilitate communications between the WTRUs 102a, 102b, 102c and IP-enabled devices.

[0047] The CN 106 may facilitate communications with other networks. For example, the CN 106 may provide the WTRUs 102a, 102b, 102c with access to circuit-switched networks, such as the PSTN 108, to facilitate communications between the WTRUs 102a, 102b, 102c and traditional land-line communications devices. For example, the CN 106 may include, or may be in communication with, an IP gateway (e.g., an IP Multimedia Subsystem (IMS) server) that acts as an interface between the CN 106 and the PSTN 108. In addition, the CN 106 may provide the WTRUs 102a, 102b, 102c with access to other networks 112, which may include other wired networks and / or wireless networks owned and / or operated by other service providers.

[0048] Although the WTRU Figures 1A to 1D Although described as wireless terminals, it is contemplated that in certain representative embodiments, such terminals may (eg, temporarily or permanently) use a wired communication interface with a communication network.

[0049] In a representative embodiment, the other network 112 may be a WLAN.

[0050] A WLAN in infrastructure basic service set (BSS) mode may have an access point (AP) for the BSS and one or more stations (STA) associated with the AP. The AP may have access or an interface to a distribution system (DS) or another type of wired / wireless network that carries traffic to and / or carries traffic away from the BSS. Traffic originating from outside the BSS and leading to the STA may be reached by the AP and may be delivered to the STA. Traffic originating from the STA and leading to a destination outside the BSS may be transmitted to the AP to be delivered to the corresponding destination. Traffic between STAs within the BSS may be transmitted by the AP, for example, wherein the source STA may transmit traffic to the AP, and the AP may deliver traffic to the destination STA. Traffic between STAs within the BSS may be considered and / or referred to as point-to-point traffic. Point-to-point traffic may be transmitted between the source STA and the destination STA (e.g., directly between them) using a direct link establishment (DLS). In certain representative embodiments, the DLS may use 802.11e DLS or 802.11z tunnel DLS (TDLS). A WLAN using an independent BSS (IBSS) mode may not have an AP, and STAs within or using the IBSS (eg, all STAs in the STA) may communicate directly with each other. The IBSS communication mode may sometimes be referred to herein as an "ad hoc" communication mode.

[0051] When using the 802.11ac infrastructure operating mode or a similar operating mode, the AP may send beacons on a fixed channel (such as a primary channel). The primary channel may be a fixed width (e.g., a 20 MHz wide bandwidth) or a width dynamically set via signaling. The primary channel may be an operating channel of the BSS and may be used by the STA to establish a connection with the AP. In certain representative embodiments, carrier sense multiple access / collision avoidance (CSMA / CA) may be implemented, for example, in an 802.11 system. For CSMA / CA, a STA (e.g., each STA) (including the AP) may listen to the primary channel. If the primary channel is listened / detected and / or determined to be busy by a particular STA, the particular STA may back off. One STA (e.g., only one station) may transmit at any given time in a given BSS.

[0052] High throughput (HT) STAs may communicate using a 40 MHz wide channel, for example, via a combination of a primary 20 MHz channel and adjacent or non-adjacent 20 MHz channels to form a 40 MHz wide channel.

[0053] Very high throughput (VHT) STA can support 20MHz, 40MHz, 80MHz and / or 160MHz wide channels. 40MHz channels and / or 80MHz channels can be formed by combining continuous 20MHz channels. 160MHz channels can be formed by combining 8 continuous 20MHz channels, or by combining two non-continuous 80MHz channels (this can be called 80+80 configuration). For 80+80 configuration, after channel coding, the data can pass through a segment parser that can divide the data into two streams. Each stream can be processed by inverse fast Fourier transform (IFFT) and time domain processing separately. These streams can be mapped to two 80MHz channels, and data can be sent by sending STA. At the receiver of the receiving STA, the above-mentioned operation for 80+80 configuration can be reversed, and the combined data can be transmitted to the medium access control (MAC).

[0054] 802.11af and 802.11ah support operating modes below 1GHz. Channel operating bandwidths and carriers are reduced in 802.11af and 802.11ah relative to those used in 802.11n and 802.11ac. 802.11af supports 5MHz, 10MHz, and 20MHz bandwidths in the TV White Space (TVWS) spectrum, and 802.11ah supports 1MHz, 2MHz, 4MHz, 8MHz, and 16MHz bandwidths using non-TVWS spectrum. According to a representative embodiment, 802.11ah may support instrument type control / machine type communications, such as MTC devices in macro coverage areas. MTC devices may have certain capabilities, such as limited capabilities, including support for (e.g., only support for) certain bandwidths and / or limited bandwidths. MTC devices may include batteries with battery life above a threshold (e.g., to maintain very long battery life).

[0055] WLAN systems that can support multiple channels and channel bandwidths (such as 802.11n, 802.11ac, 802.11af, and 802.11ah) include channels that can be designated as primary channels. The primary channel may have a bandwidth equal to the maximum common operating bandwidth supported by all STAs in the BSS. The bandwidth of the primary channel may be set and / or limited by a STA (which supports the minimum bandwidth operating mode) from all STAs operating in the BSS. In the example of 802.11ah, for STAs (e.g., MTC-type devices) that support (e.g., only support) a 1MHz mode, the primary channel may be 1MHz wide, even if the AP and other STAs in the BSS support 2MHz, 4MHz, 8MHz, 16MHz, and / or other channel bandwidth operating modes. Carrier sensing and / or network allocation vector (NAV) settings may depend on the state of the primary channel. If the primary channel is busy, for example, because a STA (supporting only a 1MHz operating mode) is sending to the AP, the entire available frequency band may be considered busy even if most of the frequency bands remain idle and may be available.

[0056] In the United States, the available frequency band for 802.11ah is 902MHz to 928MHz. In South Korea, the available frequency band is 917.5MHz to 923.5MHz. In Japan, the available frequency band is 916.5MHz to 927.5MHz. The total bandwidth available for 802.11ah is 6MHz to 26MHz, depending on the country code.

[0057] Figure 1D 1 is a system diagram illustrating the RAN 113 and the CN 115 in accordance with an embodiment. As noted above, the RAN 113 may employ NR radio technology to communicate with the WTRUs 102a, 102b, 102c over the air interface 116. The RAN 113 may also be in communication with the CN 115.

[0058] The RAN 113 may include gNBs 180a, 180b, 180c, though it will be appreciated that the RAN 113 may include any number of gNBs while remaining consistent with an embodiment. The gNBs 180a, 180b, 180c may each include one or more transceivers for communicating with the WTRUs 102a, 102b, 102c over the air interface 116. In one embodiment, the gNBs 180a, 180b, 180c may implement MIMO technology. For example, the gNBs 180a, 180b may utilize beamforming to send signals to and / or receive signals from the gNBs 180a, 180b, 180c. Thus, the gNB 180a may, for example, use multiple antennas to send wireless signals to and / or receive wireless signals from the WTRU 102a. In an embodiment, the gNBs 180a, 180b, 180c may implement carrier aggregation technology. For example, gNB 180a may transmit multiple component carriers to WTRU 102a (not shown). A subset of these component carriers may be on unlicensed spectrum, while the remaining component carriers may be on licensed spectrum. In an embodiment, gNBs 180a, 180b, 180c may implement coordinated multi-point (CoMP) technology. For example, WTRU 102a may receive coordinated transmissions from gNB 180a and gNB 180b (and / or gNB 180c).

[0059] The WTRUs 102a, 102b, 102c may communicate with the gNBs 180a, 180b, 180c using transmissions associated with parameter sets that may be scalable. For example, OFDM symbol spacing and / or OFDM subcarrier spacing may vary for different transmissions, different cells, and / or different portions of the wireless transmission spectrum. The WTRUs 102a, 102b, 102c may communicate with the gNBs 180a, 180b, 180c using subframes or Transmission Time Intervals (TTIs) of varying or scalable lengths (e.g., containing varying numbers of OFDM symbols and / or varying absolute time lengths over time).

[0060] The gNBs 180a, 180b, 180c may be configured to communicate with the WTRUs 102a, 102b, 102c in a standalone configuration and / or a non-standalone configuration. In a standalone configuration, the WTRUs 102a, 102b, 102c may communicate with the gNBs 180a, 180b, 180c while not accessing other RANs (e.g., such as the eNodeBs 160a, 160b, 160c). In a standalone configuration, the WTRUs 102a, 102b, 102c may use one or more of the gNBs 180a, 180b, 180c as mobility anchors. In a standalone configuration, the WTRUs 102a, 102b, 102c may communicate with the gNBs 180a, 180b, 180c using signals in an unlicensed band. In a non-standalone configuration, the WTRUs 102a, 102b, 102c may communicate / connect with the gNB 180a, 180b, 180c while also communicating / connecting with another RAN, such as the eNode-B 160a, 160b, 160c. For example, the WTRUs 102a, 102b, 102c may implement the DC principle to communicate with one or more gNBs 180a, 180b, 180c and one or more eNode-Bs 160a, 160b, 160c substantially simultaneously. In a non-standalone configuration, the eNode-B 160a, 160b, 160c may act as a mobility anchor for the WTRUs 102a, 102b, 102c, and the gNB 180a, 180b, 180c may provide additional coverage and / or throughput for serving the WTRUs 102a, 102b, 102c.

[0061] Each of the gNBs 180a, 180b, 180c may be associated with a particular cell (not shown) and may be configured to handle radio resource management decisions, handover decisions, scheduling of users in UL and / or DL, support of network slicing, dual connectivity, interworking between NR and E-UTRA, routing of user plane data towards a user plane function (UPF) 184a, 184b, routing of control plane information towards an access and mobility management function (AMF) 182a, 182b, etc. Figure 1D As shown, gNBs 180a, 180b, and 180c may communicate with each other via an Xn interface.

[0062] Figure 1DThe illustrated CN 115 may include at least one AMF 182a, 182b, at least one UPF 184a, 184b, at least one session management function (SMF) 183a, 183b, and possible data networks (DNs) 185a, 185b. Although each of the foregoing elements is depicted as part of the CN 115, it should be understood that any of these elements may be owned and / or operated by an entity other than the CN operator.

[0063] The AMF 182a, 182b may be connected to one or more of the gNBs 180a, 180b, 180c in the RAN 113 via the N2 interface and may act as a control node. For example, the AMF 182a, 182b may be responsible for authenticating users of the WTRU 102a, 102b, 102c, support of network slicing (e.g., handling of different PDU sessions with different requirements), selecting a specific SMF 183a, 183b, management of registration areas, termination of NAS signaling, mobility management, etc. The AMF 182a, 182b may use network slicing to customize CN support for the WTRU 102a, 102b, 102c based on the type of services utilized by the WTRU 102a, 102b, 102c. For example, different network slices may be established for different use cases, such as services relying on ultra-reliable low latency (URLLC) access, services relying on enhanced mobile broadband (eMBB) access, services for machine type communication (MTC) access, etc. The AMF 162 may provide a control plane function for switching between the RAN 113 and other RANs (not shown) that employ other radio technologies, such as LTE, LTE-A, LTE-A Pro, and / or non-3GPP access technologies such as WiFi.

[0064] The SMF 183a, 183b may be connected to the AMF 182a, 182b in the CN 115 via the N11 interface. The SMF 183a, 183b may also be connected to the UPF 184a, 184b in the CN 115 via the N4 interface. The SMF 183a, 183b may select and control the UPF 184a, 184b, and configure traffic routing through the UPF 184a, 184b. The SMF 183a, 183b may perform other functions such as managing and allocating WTRU IP addresses, managing PDU sessions, controlling policy enforcement and QoS, providing downlink data notification, etc. The PDU session type may be IP-based, non-IP-based, Ethernet-based, etc.

[0065] The UPF 184a, 184b may be connected to one or more of the gNBs 180a, 180b, 180c in the RAN 113 via the N3 interface, which may provide the WTRUs 102a, 102b, 102c with access to packet-switched networks, such as the Internet 110, to facilitate communications between the WTRUs 102a, 102b, 102c and IP-enabled devices. The UPF 184, 184b may perform other functions, such as routing and forwarding packets, enforcing user plane policies, supporting multi-homed PDU sessions, handling user plane QoS, buffering downlink packets, providing mobility anchoring, etc.

[0066] The CN 115 may facilitate communications with other networks. For example, the CN 115 may include or may communicate with an IP gateway (e.g., an IP Multimedia Subsystem (IMS) server) that acts as an interface between the CN 115 and the PSTN 108. In addition, the CN 115 may provide the WTRUs 102a, 102b, 102c with access to other networks 112, which may include other wired networks and / or wireless networks owned and / or operated by other service providers. In one embodiment, the WTRUs 102a, 102b, 102c may be connected to local data networks (DNs) 185a, 185b via the UPF 184a, 184b via the N3 interface to the UPF 184a, 184b and the N6 interface between the UPF 184a, 184b and the DN 185a, 185b.

[0067] Given that Figures 1A to 1D as well as Figures 1A to 1D , one or more or all of the functions described herein for one or more of the following may be performed by one or more simulation devices (not shown): WTRU 102a-102d, base station 114a-114b, evolved Node B 160a-160c, MME 162, SGW 164, PGW 166, gNB 180a-180c, AMF 182a-182ab, UPF 184a-184b, SMF 183a-183b, DN 185a-185b and / or any other device described herein. The simulation device may be one or more devices configured to mimic one or more or all of the functions described herein. For example, the simulation device may be used to test other devices and / or simulate network and / or WTRU functions.

[0068] The simulation device may be designed to implement one or more tests of other devices in a laboratory environment and / or in an operator network environment. For example, one or more simulation devices may perform one or more functions or all functions while being fully or partially implemented and / or deployed as part of a wired and / or wireless communication network in order to test other devices within the communication network. One or more simulation devices may perform one or more functions or all functions while being temporarily implemented / deployed as part of a wired and / or wireless communication network. The simulation device may be directly coupled to another device for testing purposes and / or may use over-the-air wireless communications to perform testing.

[0069] One or more simulation devices can perform one or more (including all) functions without being implemented / deployed as part of a wired and / or wireless communication network. For example, the simulation device can be used in a test scenario in a test laboratory and / or a non-deployed (e.g., testing) wired and / or wireless communication network to implement testing of one or more components. One or more simulation devices can be test equipment. Direct RF coupling and / or wireless communication via RF circuitry (e.g., which can include one or more antennas) can be used by the simulation device to send and / or receive data.

[0070] Auxiliary authentication and authorization for a protocol data unit (PDU) session and slice-specific authentication and authorization may be performed, for example, using a layer 3 WTRU to network relay. A remote WTRU and a relay WTRU may establish a PC5 link. For example, the PC5 link may be established via a security procedure (e.g., through a user plane or through a control plane). The relay WTRU may receive and store a security key identifier associated with the remote WTRU. For example, the security key identifier may be received from the network or from the remote WTRU, for example, during a security procedure. The relay WTRU may send a remote WTRU report message to a layer 3 WTRU to network relay (e.g., to an access and mobility function (AMF) associated with the layer 3 WTRU to network relay). In some scenarios, the relay WTRU may send a remote WTRU report message to the network after the PC5 link with the remote WTRU is established. For example, the remote WTRU report message may include a security key identifier associated with the remote WTRU and / or one or more identifiers associated with the established PC5 link.

[0071] The layer 3 WTRU to network relay may determine whether the remote WTRU is authorized and / or authenticated to communicate via the established PC5 link (e.g., via a network function). For example, an AMF associated with the relay may retrieve a second identifier associated with the remote WTRU (e.g., a subscription permanent identifier (SUPI)) based on a key identifier of the remote WTRU. The AMF may send the second identifier associated with the remote WTRU and / or the key identifier of the remote WTRU to a session management function (SMF) associated with the layer 3 WTRU to network relay. Alternatively or additionally, the SMF associated with the relay may retrieve a second identifier associated with the remote WTRU (e.g., a subscription permanent identifier (SUPI)) based on a key identifier of the remote WTRU, for example. The SMF may transmit a security key identifier associated with the remote WTRU to a PAnF or a PKMF and / or receive a second identifier associated with the remote WTRU in response. The SMF may determine whether the remote WTRU is authorized and / or authenticated to communicate via the established PC5 link. For example, the SMF may determine whether the remote WTRU is authorized and / or authenticated to communicate via the established PC5 link based on a second identifier associated with the remote WTRU. The SMF may initiate and / or perform auxiliary authentication and authorization procedures for the remote WTRU. For example, the SMF may initiate and / or perform auxiliary authentication and authorization procedures for the remote WTRU via a WTRU to network relay. For example, the auxiliary authentication and authorization procedures may include transmitting a key identifier of the remote WTRU to the WTRU to the network relay. The SMF may send the result of the authentication and authorization procedure to the WTRU to the network relay. Additionally or alternatively, the SMF may send a security key identifier of the remote WTRU to the WTRU to the network relay. If the remote WTRU is authorized and / or authenticated to communicate via the PC5 link, the layer 3 WTRU to network relay may send an indication to the relay WTRU that the remote WTRU is authorized and / or authenticated to communicate via the established PC5 link. The remote WTRU may communicate via the established PC5 link. In some scenarios, if the remote WTRU is not authorized or authenticated to communicate over the PC5 link, the layer 3 WTRU to network relay may release the established PC5 link.

[0072] A first wireless transmit / receive unit (WTRU) may be configured to receive a key identifier. The key identifier may be associated with a second WTRU. The key identifier may point to a key and / or be generated as random bits. For example, the key identifier may be used to determine an identifier associated with a remote WTRU, such as a SUPI of the remote WTRU (e.g., via a lookup table maintained by a network and / or relay). The key identifier may be used and / or sent by the network without using and / or sending the SUPI of the remote WTRU, for example, to maintain security across the network and / or network relays. In certain scenarios, for example, the key identifier may include a 5G ProSe Remote User Key (5GPRUK) identifier (ID). The first WTRU may be configured as a WTRU to network relay for the second WTRU. The key identifier may be received during a key request procedure. The key request procedure may be performed by the first WTRU on behalf of the second WTRU.

[0073] The first WTRU may be configured to transmit the key identifier to a network function. The key identifier may be transmitted to the network function to initiate a secondary authentication procedure. For example, the key identifier may be transmitted to the network function to initiate a secondary authentication procedure on behalf of the second WTRU. The first WTRU may be configured to receive an authentication message. The authentication message may include the key identifier. Additionally or alternatively, the first WTRU may be configured to transmit the authentication message to the second WTRU. For example, the first WTRU may be configured to transmit the authentication message to the second WTRU based on the authentication message including the key identifier. The network function may be identified by an access and mobility function (AMF) and / or a session management function (SMF). The AMF may send the key identifier to the SMF. The SMF may send the key identifier to a ProSe anchor function (PAnF) and / or a ProSe key management function (PKMF).

[0074] The first WTRU may be configured to receive an authentication response message from the second WTRU. The authentication response message may include the key identifier. Additionally or alternatively, the first WTRU may be configured to receive a response from the network function. The response may include the key identifier. Additionally or alternatively, the response may indicate the result of the auxiliary authentication procedure. The key identifier may be transmitted to the network function in a remote WTRU report message. The response may include a remote WTRU report response message. The first WTRU may be configured to send an indication that the second WTRU is authorized to communicate via a link or release the link. For example, the first WTRU may be configured to send an indication that the second WTRU is authorized to communicate via a link or release the link based on the remote WTRU report response message. The link may be a PC5 link.

[0075] A base station may be configured to receive a key identifier. The key identifier may be received from a first WTRU. The key identifier may be associated with a second WTRU. The first WTRU may be configured as a WTRU-to-network relay for the second WTRU. The key identifier may be received during a key request procedure. The key request procedure may be performed by the first WTRU on behalf of the second WTRU. The key identifier may be received to initiate a secondary authentication procedure on behalf of the second WTRU. The base station may be configured to send an authentication message. For example, the base station may be configured to send the authentication message to the second WTRU. The authentication message may include the key identifier. The authentication message may be transmitted to the second WTRU via the first WTRU. For example, the authentication message may be transmitted to the second WTRU via the first WTRU based on the authentication message including the key identifier. The base station may be configured to send a response to the first WTRU. The response may include the key identifier. Additionally or alternatively, the response may indicate a result of the secondary authentication procedure. The WTRU may release a link with the second WTRU based on the result of the secondary authentication procedure. Distinguished Name (DN) information may be retrieved from the second WTRU.For example, a secondary authentication may be triggered based on a determination that the DN is authorized, that the DN requires a secondary authentication, and one or more of a previous authentication.

[0076] Security procedures associated with 5G Proximity Services (ProSe) communications may be implemented. For example, security procedures associated with 5G ProSe communications may be implemented via 5G ProSe (e.g., such as a 5G ProSe layer 3 WTRU to network relay). For example, security procedures may be implemented through a control plane.

[0077] Specific security procedures performed over the control plane may be specified for 5G ProSe. The security procedures may be associated with one or more of remote WTRU (e.g., out-of-coverage WTRU), relay WTRU (e.g., in-coverage WRU) authorization, and PC5 link security. For example, remote WTRU and relay WTRU authorization and / or PC5 link security may be based on remote WTRU authentication (e.g., performed by the network via the relay WTRU during PC5 link establishment).

[0078] A relay WTRU may receive a protected permanent identifier (e.g., a subscription permanent identifier (SUCI)). The relay WTRU may receive the protected permanent identifier in a direct communication request (DCR) message. The relay WTRU may forward the SUCI in a key request message. The key request message may be used to obtain a key from the network. The network may trigger remote WTRU authentication via a relay link (e.g., a PC5 link). Triggering remote WTRU authentication via a relay link may be similar to the main authentication procedure performed over the Uu interface. The remote WTRU and / or the network may establish a 5G ProSe remote user key (5GPRUK) / 5GPRUK identifier based on the authentication. The 5GPRUK ID may be used for (e.g., used as) an authentication mechanism, such as for a data network. Additionally or alternatively, the 5GPRUK ID may be used to route one or more messages for the relay WTRU. The relay WTRU may receive a shared key derived from the 5GPRUK from the network and / or may establish security for a PC5 link with the remote WTRU based on the shared key.

[0079] The remote WTRU may provide a key identifier (e.g., 5GPRUK ID) via the DCR. In some implementations, the remote WTRU may provide the 5GPRUK ID instead of the SUCI (e.g., as a possible optimization so that the remote WTRU authentication procedure is not performed), for example, via the DCR (e.g., if available). For example, the 5GPRUK may be located and / or retrieved based on the provided 5GPRUK ID.

[0080] Security procedures (e.g., specific security procedures) may be implemented through the user plane. For example, the security procedures implemented through the user plane may be specified in 5G ProSe and / or may include procedures for one or more of remote WTRU, relay WTRU authorization, and PC5 link security. The security procedures may be based on, for example, the remote WTRU sending a 5GPRUK ID (e.g., via a DCR). The remote WTRU may obtain the 5GPRUK / 5GPRUK ID from the ProSe Key Management Function (PKMF). For example, the remote WTRU may obtain the 5GPRUK / 5GPRUK ID from the PKMF through a user plane connection (e.g., before PC5 link establishment and / or during PC5 link establishment using a generic bootstrapping architecture (GBA) push mechanism).

[0081] The relay WTRU may receive a 5GPRUK ID and / or SUCI. For example, the relay WTRU may receive the 5GPRUK ID and / or SUCI via a DCR message. The relay WTRU may forward the 5GPRUK ID and / or SUCI to a PKMF associated with the remote WTRU (e.g., via the relay WTRU's PKMF over the user plane), for example, in a Key Request message. The relay WTRU may receive a shared key. The shared key may be derived from the 5GPRUK received from the remote WTRU's PKMF (e.g., via the relay WTRU's associated PKMF). The relay WTRU may establish security of the PC5 link with the remote WTRU based on the shared key.

[0082] In certain scenarios, a remote WTRU assisted authentication procedure may be performed. In some examples, the assisted authentication procedure may be associated with (e.g., specific to) a DN. The remote WTRU assisted procedure may be performed via a 5G ProSe Layer 3 WTRU to network relay (e.g., without a non-3GPP interworking function (N3IWF)). For example, certain organizations (e.g., 3GPP) may define procedures for a remote WTRU to access a data network (DN) that may require assisted authentication. For example, based on a remote WTRU authentication performed by the network via a relay WTRU (e.g., as described herein), a assisted authentication may be performed via a L3 WTRU to network relay. The remote authentication performed by the network via the relay WTRU may be followed by a PDU session assisted authentication and / or authorization performed by the DN (e.g., as part of a PC5 link establishment).

[0083] The remote WTRU may perform network slice specific authentication and / or authorization (NSSAA). For example, the remote WTRU may perform NSSAA via a 5G ProSe layer 3 WTRU to network relay (e.g., without an N3 IWF). Certain organizations (e.g., 3GPP) have studied procedures for the remote WTRU to access single network slice selection assistance information (S-NSSAI) undergoing NSSAA. For example, the remote WTRU accesses the S-NSSAI via an L3 WTRU to network relay based on remote WTRU authentication by the network via the relay (as described herein). Additionally or alternatively, the remote WTRU may access the NSSAA procedure as part of PC5 link establishment after accessing the S-NSSAI.

[0084] Assisted authentication and / or NSSAA may be implemented, for example, using the control plane. For example, certain implementations support access to a DN. Access to the DN may require auxiliary authentication (e.g., auxiliary authentication of an S-NSSAI undergoing NSSAA). The auxiliary authentication may be performed via an L3 WTRU to a network relay. In some implementations, the remote WTRU may provide a SUCI and / or a 5G Globally Unique Temporary ID (GUTI). The SUCI and / or GUTI may be provided via a DCR message. For example, the SUCI or 5G-GUTI WTRU may be used by a serving network associated with the relay WTRU. For example, the SUCI or 5G-GUTI WTRU may be used by a serving network associated with the relay WTRU to access subscription information associated with the remote WTRU (e.g., the subscription information may be used for assisted authentication and / or NSSAA procedures).

[0085] The remote WTRU may transmit the SUCI in the DCR. For example, if the remote WTRU is preparing to connect for a relay service (RSC) (e.g., for the first time), the remote WTRU may transmit the SCI in the DCR. In some scenarios, the remote WTRU may perform authentication with the network. The remote WTRU may be enabled to (re)connect to the relay service (e.g., if the (re)connection was already authorized from a previous connection, which may avoid potential signaling overhead associated with re-running authentication procedures with the network).

[0086] In some scenarios, the 5G-GUTI may be used by the network (e.g., an AMF associated with the remote WTRU). For example, the 5G-GUTI may be used by the network to determine the remote WTRU context. The remote WTRU context may include a remote WTRU subscription permanent identifier (SUPI). When the remote WTRU is registered in the same public land mobile network (PLMN) as the relay WTRU, the 5G-GUTI may be used (e.g., so that context information associated with the remote WTRU can be exchanged with the AMF associated with the relay WTRU).

[0087] A remote WTRU may (re)connect to a given relay service. For example, a remote WTRU may (re)connect to a given relay service without performing authentication procedures. The connection may enable the network (e.g., AMF, SMF) to access subscription information associated with the remote WTRU (e.g., without transmitting the SUCI associated with the remote WTRU in the DCR). The techniques described herein may enable access to a DN that implements secondary authentication (e.g., via a relay). These techniques may enable access to an S-NSSAI (e.g., via a relay). For example, for a remote WTRU, access to the S-NSSAI may be subject to NSSAA (e.g., a remote WTRU that does not have the ability to perform authentication procedures with the network and / or SUPI hiding / de-hiding processing).

[0088] A user plane may be used to implement secondary authentication and / or NSSAA. Access to a DN may be provided to a remote WTRU. The DN may implement secondary authentication and / or S-NSSAI that undergoes NSSAA. For example, a specific implementation of secondary authentication and / or S-NSSAI may undergo NSSAA via an L3 WTRU to network relay (e.g., when the use of the user plane is not supported). Some security procedures performed through the user plane may rely on the remote WTRU (e.g., using a user plane connection) obtaining a 5GPRUK / 5GPRUK ID from the PKMF. These security procedures may not use remote WTRU authentication performed by the network (e.g., as in the case of a control plane based approach). Additionally or alternatively, some security procedures may not define a mechanism for enabling a serving network associated with a relay WTRU to access subscription information associated with the remote WTRU and / or a mechanism for performing remote WTRU PDU session assisted authentication and / or NSSAA via an L3 relay (e.g., without an N3IWF). The techniques described herein may enable access to a DN that implements secondary authentication (e.g., via a relay). For example, when security procedures are used over the user plane, assisted authentication may be implemented. Some techniques described herein may enable access to the S-NSSAI (e.g., via a relay). The access may be through NSSAA for the remote WTRU (e.g., when security procedures are used over the user plane).

[0089] A layer 3 WTRU to network relay may be provided. One or more of the following may apply. A layer 3 WTRU to network relay may enable access to a DN requiring secondary authentication and / or access to the S-NSSAI. For example, the secondary authentication and / or access to the S-NSSAI may undergo NSSAA during PC5 link establishment. A layer 3 WTRU to network relay may receive and / or store a 5GPRUK ID associated with a remote WTRU and / or a network. For example, a layer 3 WTRU to network relay may receive and / or store a 5GPRUK ID associated with a remote WTRU and / or a network during PC5 link establishment. For example, a relay WTRU may send a 5GPRUK ID in a remote WTRU report message. A layer 3 WTRU to network relay may exchange one or more authentication messages for a remote WTRU with the network. For example, the one or more authentication messages may include a 5GPRUK ID associated with the remote WTRU. A relay WTRU may receive a remote WTRU report response message. For example, a report response may include a 5GPRUK ID. Additionally or alternatively, the report response may include authentication and / or authorization results for the remote WTRU.The relay WTRU may provide access to the PDU session with the remote WTRU (eg, based on the results in the response message).

[0090] A session management function (SMF) associated with a relay WTRU may perform auxiliary authentication of a remote WTRU. For example, auxiliary authentication of a remote WTRU may be performed via a relay WTRU. One or more of the following may apply. The SMF may initiate a remote WTRU auxiliary authentication procedure (e.g., via a relay). For example, the remote WTRU auxiliary authentication procedure may be performed in response to receiving a remote WTRU report message. The remote WTRU report message may include a SUPI and / or a 5GPRUK ID. The SMF may exchange one or more PDU session auxiliary authentication messages. The one or more PDU session auxiliary authentication messages may be associated with a remote WTRU connected to the relay WTRU. For example, a PDU session auxiliary authentication message associated with a remote WTRU may include a 5GPRUKID associated with the remote WTRU. The SMF may store the authentication result (e.g., the final authentication result) in a relay context / unified data management (UDM). The SMF may send a remote WTRU report response message to the relay WTRU. The report response message may include a 5GPRUK ID and / or an authentication result. Additionally or alternatively, the Report Response message may include one or more authorization results for the remote WTRU.

[0091] An access and mobility function (AMF) associated with an NSSAA procedure may be provided. One or more of the following may apply. The AMF may initiate NSSAA for a remote WTRU authentication procedure (e.g., via a relay). For example, NSSAA may be initiated for a remote WTRU authentication procedure in response to receiving a remote WTRU report message. The remote WTRU report message may include a 5GPRUK ID associated with the remote WTRU. The AMF may receive a SUPI associated with the remote WTRU. For example, the retrieval of the SUPI associated with the remote WTRU may be based on the 5GPRUK ID from a network function (e.g., ProSe Anchor Function (PAnF), UDM). The AMF may exchange slice-specific authentication messages with the relay WTRU. For example, the slice-specific authentication message may include a 5GPRUK ID associated with the remote WTRU. The 5GPRUK ID associated with the remote WTRU may be used for remote WTRU authentication. The AMF may store the authentication result (e.g., the final authentication result) in the relay context / UDM. The AMF may, for example, transmit (e.g., forward) the remote WTRU report message to the serving SMF. The Remote WTRU Report message may include an indication of the NSSAA associated with the Remote WTRU results to the SMF.

[0092] The remote WTRU may transmit the 5GPRUK ID in the DCR message. For example, when connecting and / or reconnecting via a layer 3 WTRU to a network relay, the remote WTRU may transmit the 5GPRUK ID in the DCR message. The relay WTRU and / or the relay WTRU's serving network may use the 5GPRUK ID to identify the remote WTRU in the network. The relay WTRU's serving network may use the 5GPRUK ID to access subscription information associated with the remote WTRU. The relay WTRU and / or the relay WTRU's serving network may use the 5GPRUK ID to perform PDU session assisted authentication and / or authorization procedures. Additionally or alternatively, the relay WTRU and / or the serving network associated with the relay WTRU may use the 5GPRUK ID to perform NSSAA procedures.

[0093] The remote WTRU may be identified by the serving network of the relay WTRU. For example, the remote WTRU may be identified based on the 5GPRUK ID by the serving network associated with the relay WTRU. The remote WTRU may be identified based on the 5GPRUK ID (e.g., by the relay WTRU and / or the serving network of the relay WTRU). For example, the relay WTRU may receive the 5GPRUK ID from the remote WTRU in a DCR message. Additionally or alternatively, the relay WTRU may receive the 5GPRUK ID from the network during PC5 link establishment. The 5GPRUK ID may be generated by a network function. For example, if the relay WTRU receives the 5GPRUK ID from the network, the 5GPRUK ID may be generated by a network function (e.g., a network function in the home network of the remote WTRU). The 5GPRUK ID may be stored by the network. For example, the 5GPRUK ID may be stored by the network together with one or more other parameters associated with the ProSe context associated with the remote WTRU (e.g., 5GPRUK, RSC, SUPI). The 5GPRUK / 5GPRUK ID may be generated (e.g., by an authentication function (AUSF) associated with the remote WTRU) as part of the remote WTRU authentication procedure, as described herein. For example, if security procedures conducted over the control plane are used, the 5GPRUK / 5GPRUK ID may be generated (e.g., by an AUSF associated with the remote WTRU) as part of the remote WTRU authentication procedure, as described herein. The 5GPRUK / 5GPRUK ID may be generated (e.g., by a PKMF associated with the remote WTRU) as part of a key request procedure conducted over the user plane (e.g., before PC5 link establishment) and / or during PC5 link establishment (e.g., using a GBA push mechanism), as described herein. If security procedures conducted over the user plane are used, the 5GPRUK / 5GPRUK ID may be generated (e.g., by a PKMF associated with the remote WTRU) as part of a key request procedure conducted over the user plane (e.g., before PC5 link establishment) and / or during PC5 link establishment (e.g., using a GBA push mechanism), as described herein. The relay may store the 5GPRUK ID. The relay may associate the 5GPRUK ID with the PC5 link established with the remote WTRU. The relay may subsequently use the 5GPRUK ID (e.g., for remote WTRU-assisted authentication and / or NSSAA procedures).

[0094] One or more security procedures may be enforced by the control plane. Figure 2 An example 200 is depicted associated with a key identifier (e.g., 5GPRUK / 5GPRUK ID) exchange between a remote WTRU, a relay WTRU, and a network using a control plane (e.g., a control plane method). Figure 2 As illustrated, the remote WTRU and / or the relay WTRU may perform a discovery procedure 202. At 204, the remote WTRU may send a direct communication request (DCR) message to the relay WTRU. The DCR may include the SUCI and / or the 5GPRUK ID. For example, additionally or alternatively, the DCR message sent by the remote WTRU to the relay WTRU may include other parameters (e.g., RSC, random number). At 206, the relay WTRU may send a relay key request message to the AMF. The relay key request message may include the information received from the remote WTRU (e.g., SUCI, 5GPRUK ID, RSC, and / or random number).

[0095] like Figure 2 As shown, the AMF may determine whether the relay WTRU is authorized to provide relay services. At 208, the AMF may utilize the AUSF associated with the remote WTRU to initiate the remote WTRU authentication procedure. For example, if the SUCI is provided in the relay key request, the AMF may utilize the AUSF associated with the remote WTRU to initiate the remote WTRU authentication procedure. Additionally or alternatively, at 210, the AMF may not utilize the AUSF associated with the remote WTRU to initiate the remote WTRU authentication procedure. For example, if a 5GPRUK ID is provided in the relay key request, the AMF may not utilize the AUSF associated with the remote WTRU to initiate the remote WTRU authentication procedure. For example, at 216, a new 5GPRUK / 5GPRUKID (e.g., a new 5GPRUK / 5GPRUK ID) may be generated by the remote WTRU and / or the AUSF associated with the remote WTRU. The AUSF associated with the remote WTRU may store the resulting 5GPRUK / 5GPRUK ID in the network function (e.g., PAnF, UDM) and / or send the 5GPRUK ID to the AMF. For example, after completing the authentication procedure, the AUSF associated with the remote WTRU may store the resulting 5GPRUK / 5GPRUK ID in the network function (e.g., PAnF, UDM) and / or send the 5GPRUK ID to the AMF.

[0096] like Figure 2As illustrated, at 212, the AMF may send a request message to a ProSe anchor network function (PAnF). For example, the request message may include the 5GPRUK ID and / or other parameters included in the relay key request received from the relay WTRU. At 214, the AMF may receive a response to the request message (e.g., from the PAnF). The response request message may include ProSe key material (e.g., ProSe key, random number). At 218, the relay WTRU may receive a relay key response message from the AMF. The relay key response message may be subsequent to the response request message. For example, the relay key response message may include the ProSe key material and / or a new 5GPRUK ID (e.g., as previously generated). For example, at 222, the remote WTRU may generate a key.

[0097] At 220, the WTRU to network relay may perform a security procedure. The security procedure may be a direct security mode command (DSMC). Alternatively or additionally, the remote WTRU may use the ProSe key material received via a relay key response message. The direct security procedure may be completed, for example, at 224. At 226, the WTRU to network relay may store the 5GPRUK ID (e.g., received as described herein) and / or associate the 5GPRUK ID with the PC5 link established with the remote WTRU. At 228, the WTRU to network relay may send a direct communication acceptance (DCA) message. The DCA message may be sent to the remote WTRU. The DCA message may be used to complete the PC5 link establishment. As described herein, for example, at 230, the WTRU to network relay may use the 5GPRUK ID when initiating subsequent procedures (e.g., auxiliary authentication and authorization procedures and / or NSAA).

[0098] FIG. 3A to FIG. 3B , FIG. 4A to FIG. 4B and FIG. 5A to FIG. 5B Example authentication procedures associated with a WTRU to a network relay and a remote WTRU are illustrated. For example, FIG. 3A to FIG. 3B , FIG. 4A to FIG. 4B and FIG. 5A to FIG. 5B Can be used to perform PDU session-assisted authentication and authorization for WTRU to network relay as well as slice-specific authentication and authorization. FIG. 3A to FIG. 3B , FIG. 4A to FIG. 4B and FIG. 5A to FIG. 5B An example is given in which 5GPRUK ID is used as a key identifier, but it should be understood that the techniques described herein are not limited to this example. For example, other suitable identifiers that can be used to verify and / or determine the identity of the remote WTRU may also be used or alternatively used. Similarly, although FIG. 3A to FIG. 3B , FIG. 4A to FIG. 4B and FIG. 5A to FIG. 5BThe examples illustrated in contemplate specific network functions (e.g., SMF, AMF), but any suitable network functions may also or alternatively be used. FIG. 3A to FIG. 3B , FIG. 4A to FIG. 4B and FIG. 5A to FIG. 5B The illustrated examples show a WTRU to network relay communicating with a single remote WTRU, but it will be appreciated that these techniques are equally applicable to situations where the WTRU to network relay communicates with multiple remote WTRUs and / or the remote WTRU communicates with multiple WTRU to network relays.

[0099] One or more security procedures may be implemented on the user plane. Figure 3A and Figure 3B An example 300 associated with a key identifier (e.g., 5GPRUK / 5GPRUK ID) exchange between a remote WTRU, a WTRU-to-network relay, and / or a network via a user plane method is illustrated. At 302, the remote WTRU may transmit a ProSe remote user key request to a ProSe key management function (PKMF) associated with the remote WTRU (e.g., via a user plane). At 304, the remote WTRU may receive a response to the ProSe remote user key request. For example, the response may include a 5GPRUK / 5GPRUK ID (e.g., a new 5GPRUK / 5GPRUK ID) from the PKMF associated with the remote WTRU via the user plane. At 306, the remote WTRU and the WTRU-to-network relay may perform a discovery procedure. At 308, the remote WTRU may send a DCR message (e.g., which includes information associated with the remote WTRU and / or may be used to authenticate the remote WTRU) to the WTRU-to-network relay. For example, the DCR message may include one or more of a SUCI (e.g., associated with the remote WTRU), a key identifier (e.g., a 5GPRUK ID associated with the remote WTRU), and / or one or more other parameters (e.g., an RSC associated with the remote WTRU, a random number).

[0100] At 310, the WTRU-to-network relay may send a relay key request message to a PKMF associated with the WTRU-to-network relay. The relay key request may include one or more of a SUCI, a 5GPRUK ID, and / or other parameters (e.g., RSC, KNRP, etc., as described herein). At 312, the PKMF associated with the WTRU-to-network relay may forward the relay key request message to a PKMF associated with the remote WTRU. At 314, the GPI and / or AV for the WTRU may be transmitted from the UDM / BSF / HSS of the remote WTRU to the PKMF of the remote WTRU. At 316, the WTRU-to-network relay may receive a response message. The response message may include a new 5GPRUK ID. For example, if the SUCI was included in the relay key request message, the WTRU-to-network relay may receive a response message including a new 5GPRUK ID. Additionally or alternatively, the response message received by the WTRU-to-network relay may include ProSe key material from its PKMF (e.g., which may be forwarded from a PKMF associated with a remote WTRU). At 318, the PKMF of the WTRU-to-network relay may transmit (e.g., forward) the response message to the WTRU-to-network relay.

[0101] like Figure 3B As shown, at 320, the WTRU to network relay may, for example, use the received ProSe key material to transmit a direct security mode command (DSMC) procedure with the remote WTRU. At 322, the remote WTRU may verify the WTRU to network relay authorization. At 324, the direct security mode may be completed. Additionally or alternatively, at 326, the WTRU to network relay may verify the remote WTRU authorization. For example, at 328, the WTRU to network relay may store the 5GPRUK ID. The WTRU to network relay may associate the 5GPRUK ID with the PC5 link established with the remote WTRU. At 330, the WTRU to network relay may send a direct connection acceptance (DCA) message to the remote WTRU. The DCA message may be used to complete the PC5 link establishment. As described herein, for example, at 332, the WTRU to network relay may use the 5GPRUK ID when initiating subsequent procedures 316 (e.g., auxiliary authentication and authorization procedures and / or NSAA).

[0102] Secondary authentication and authorization (A&A) procedures associated with the PDU session may be performed. For example, secondary A&A procedures associated with the PDU session may be performed via a WTRU to network relay. Figure 4A and Figure 4B An example 400 is illustrated associated with a PDU Session Assisted A&A procedure performed via a WTRU to network relay. One or more of the following may apply. Figure 4A and Figure 4B As illustrated, a session assisted A&A procedure may be performed for a remote WTRU during a remote WTRU reporting procedure. Figure 4A and Figure 4B The illustrated example supports both control plane security procedures and user plane security procedures.

[0103] like Figure 4A and Figure 4B As shown, the remote WTRU and / or WTRU to network relay may (e.g., using methods as described herein for example Figure 2 and / or Figure 3A and Figure 3B The control plane security procedures and / or user plane security procedures described in 402) establish a PC5 link associated with an exchange of key identifiers (e.g., 5GPRUK / 5GPRUK ID). The WTRU-to-network relay may store the 5GPRUK ID for the remote WTRU, as described herein. At 404, the remote WTRU and / or the WTRU-to-network relay may perform IP configuration for communication over the PC5 link.

[0104] At 406, the WTRU-to-network relay may send a remote WTRU report message. The WTRU-to-network relay may send the remote WTRU report message to the SMF (e.g., via the AMF). For example, the remote WTRU report message may include one or more of the 5G PRUC ID, the PDU session ID, and / or other parameters.

[0105] At 408, the AMF may send a request message to the network function (e.g., PAnF, UDM, PKMF). The request message may include the 5GPRUK ID. At 410, the AMF may receive a response message from the network function. The response message may include one or more of a key identifier (e.g., a 5GPRUK ID associated with the remote WTRU), a SUPI associated with the remote WTRU, and / or one or more other parameters (e.g., associated with the remote WTRU).

[0106] like Figure 4AAs illustrated, at 412, the AMF may forward a SUPI (e.g., associated with a remote WTRU), a 5GPRUK ID (e.g., associated with a remote WTRU), and / or a report message (e.g., associated with a remote WTRU) to the SMF. Additionally or alternatively, the AMF may identify a network function (NF). For example, the AMF may identify the NF from which information associated with a remote WTRU (e.g., SUPI) is retrieved and / or information associated with a WTRU (e.g., 5GPRUK ID) is forwarded to the SMF. The SMF may query the identified NF (e.g., provide the 5GPRUK ID of the remote WTRU). For example, in response to receiving the information from the AMF, the SMF may query the identified NF (e.g., provide the 5GPRUK ID associated with the remote WTRU). Querying the identified NF may be to obtain a SUPI associated with the remote WTRU. At 414, the SMF may check the DN authorization of the remote WTRU. For example, the SMF may check the DN authorization of the remote WTRU using the SUPI associated with the remote WTRU. Additionally or alternatively, the SMF may retrieve DN subscription information for the remote WTRU from the UDM. The SMF may determine (e.g., based on information received from the UDM) one or more of whether the DN is authorized for the remote WTRU, whether the DN requires secondary authentication for the remote WTRU, and whether the remote WTRU has a valid authentication and / or authorization result (e.g., from a previous authentication procedure). The SMF may trigger the remote WTRU secondary authentication via the DN. Based on these determinations, for example, the SMF may trigger the remote WTRU secondary authentication via the DN. The SMF may store the WTRU secondary authentication result in the WTRU-to-network relay context and / or in the UDM associated with the remote WTRU.

[0107] like Figure 4BAs shown, at 416, the SMF may send a PDU session authentication command. The PDU session authentication command may be sent to a WTRU to network relay (e.g., a layer 3 WTRU to network relay). For example, the PDU session authentication command may include a 5GPRUK ID. The 5GPRUK ID may be used to identify the remote WTRU to be authenticated. At 418, the layer 3 WTRU to network relay may transmit a PC5-S message to the remote WTRU. At 420, the remote WTRU may transmit a PC5-S response message to the layer 3 WTRU to network relay. The layer 3 WTRU to network relay may determine that the PDU session authentication command is for the remote WTRU (e.g., based on the 5GPRUK ID and sending the 5GPRUK ID over an associated PC5 link). At 422, the layer 3 WTRU to network relay may forward an authentication response (e.g., an authentication response received from the remote WTRU). For example, the authentication response may be forwarded to the SMF. For example, the authentication response may include a 5GPRUKID. At 424, the SMF may initiate remote WTRU authentication by the DN, for example, by transmitting an Extensible Authentication Protocol (EAP) Response / Identity to a Data Network Authentication Authorization and Accounting (DN-AAA). The DN-AAA and the remote WTRU may exchange authentication messages (e.g., as defined by the relevant authentication method). The SMF and the Layer 3 WTRU to Network Relay may exchange authentication messages via NAS, for example, by including a 5G PRUC ID in the NAS message. At 428, the SMF may receive a final authentication result from the DN-AAA. At 426, when the authentication procedure is complete, the final authentication result may be received. At 430, the SMF may store the authentication result in the context of the WTRU to Network Relay and / or in the UDM associated with the remote WTRU.

[0108] At 432, the SMF may send a remote WTRU report response message. The report response message may include a 5GPRUK ID and / or authentication and authorization results. Additionally or alternatively, the 5GPRUK ID and / or authentication and authorization results may be sent to a layer 3 WTRU to network relay. The layer 3 WTRU to network relay may provide the remote WTRU with access to the PDU session (e.g., based on the authentication and authorization results in the remote WTRU report response message). At 434, the layer 3 WTRU to network relay may store authorization information associated with the remote WTRU and / or forward the authentication and authorization results to the remote WTRU. The layer 3 WTRU to network relay may perform communication establishment procedures. For example, if the PDU session assisted A&A for the remote WTRU is successful, the layer 3 WTRU to network relay may perform communication establishment procedures. The layer 3 WTRU to network relay may release the PC5 link with the remote WTRU. For example, if the PDU Session Assisted A&A for the remote WTRU is unsuccessful, the Layer 3 WTRU to Network Relay may release the PC5 link with the remote WTRU.

[0109] NSSAA procedures may be performed via a layer 3 WTRU to network relay.One or more of the following may apply. Figure 5A and Figure 5B Example 500 is illustrated in association with NSSAA procedures performed via a layer 3 WTRU to network relay. As illustrated in example 500, the NSSAA procedures may be associated with a remote WTRU and / or a remote WTRU reporting procedure. The remote WTRU may be associated with a remote WTRU key identifier (e.g., 5GPRUK / 5GPRUK ID), which may be used (e.g., exchanged) during the NSSAA procedure. Figure 5A and Figure 5B The illustrated examples may be used with control plane security procedures and / or user plane security procedures.

[0110] like Figure 5A As shown, the remote WTRU and / or WTRU to network relay may (e.g., using, for example, Figure 2 3) establishes a PC5 link 500. As described herein, the layer 3 WTRU to network relay may store a 5GPRUK ID associated with the remote WTRU. At 504, the remote WTRU and / or the WTRU to network relay may perform IP configuration for PC5 link communications.

[0111] The WTRU-to-network relay may send a remote WTRU report message to the SMF (e.g., via the AMF) at 506. For example, the remote WTRU report message may include one or more of a key identifier (e.g., a 5GPRUK ID associated with the remote WTRU), a PDU session ID (e.g., associated with the remote WTRU), and / or other parameters (e.g., remote WTRU information, a procedure transaction ID (PTI) associated with the remote WTRU).

[0112] At 508, the AMF may send a request (e.g., a Prose Get Request) to the NF (e.g., PAnF, UDM, PKMF). The request sent at 508 may, for example, include a key identifier (e.g., 5GPRUK ID). At 510, the AMF may receive a response (e.g., a Prose Get Response) to the request message from the NF. For example, the response received from the NF may include one or more of a key identifier (e.g., 5GPRUK ID associated with the remote WTRU), a SUPI associated with the remote WTRU, and / or one or more other parameters (e.g., an RSC associated with the remote WTRU). At 512, the AMF may check the S-NSSAI authorization of the remote WTRU (e.g., using the SUPI and S-NSSAI information of the remote WTRU). For example, the AMF may retrieve the S-NSSAI information from the PDU session context relayed by the WTRU to the network (e.g., using the PDU Session ID). The AMF may retrieve the S-NSSAI subscription information for the remote WTRU. The S-NSSAI subscription information for the remote WTRU may be retrieved from the UDM. For example, the AMF may determine (e.g., based on information received from the UDM) one or more of the following: whether the S-NSSAI is authorized; whether the S-NSSAI requires NSSAA for the remote WTRU; and / or whether the remote WTRU has a valid authentication and authorization result (e.g., from a previous NSSAA procedure). The AMF may trigger NSSAA for the remote WTRU. For example, based on these determinations, the AMF may trigger NSSAA for the remote WTRU. The AMF may forward the SUPI associated with the remote WTRU and / or a report message associated with the remote WTRU to the SMF.

[0113] like Figure 5BAs illustrated, at 514, the AMF may send a network slice specific authentication command to the layer 3 WTRU to network relay. The network slice specific authentication command may include a key identifier (e.g., 5GPRUK ID). For example, the key identifier (e.g., 5GPRUK ID) may be used to identify / authenticate the remote WTRU to be authenticated. For example, the layer 3 WTRU to network relay (e.g., relay WTRU) may determine that the request is associated with the remote WTRU based on the key identifier (e.g., 5GPRUK ID) because the layer 3 WTRU to network relay may communicate with multiple remote WTRUs. At 516, the layer 3 WTRU to network relay may send the request over a PC5 link associated with the remote WTRU, for example, based on the key identifier. At 518, the remote WTRU may transmit an authentication response to the layer 3 WTRU to network relay. At 520, the layer 3 WTRU to network relay may transmit an authentication response from the remote WTRU. In some examples, the WTRU to network relay may forward the authentication response from the remote WTRU. The authentication response may be forwarded to the remote SMF. For example, the authentication response may include a 5GPRUK ID associated with the remote WTRU. The SMF may initiate the NSSAA procedure for the remote WTRU, for example, by sending an EAP response / identity to an authentication authorization and accounting server (AAA-S) at 522. At 524, the AAA-S and the remote WTRU may exchange authentication messages (e.g., as defined by the relevant authentication method). The AMF and the layer 3 WTRU to network relay may exchange authentication messages via NAS. For example, the AMF and the layer 3 WTRU to network relay may exchange authentication messages via NAS by including the 5GPRUK ID in the NAS message. At 526, the AMF may receive an authentication result from the AAA-S (e.g., when the authentication procedure is complete). At 528, the AMF may store the authentication result in a context associated with the WTRU to network relay and / or in a UDM associated with the remote WTRU (e.g., using a relevant key identifier). At 530, the AMF may send an authentication result message to the layer 3 WTRU to network relay. For example, the authentication result message may include the 5GPRUK ID and / or authorization information (eg, whether the S-NSSAI is authorized). The layer 3 WTRU to network relay may forward the authentication and / or authorization results to the remote WTRU.

[0114] The AMF may perform a remote WTRU reporting procedure. At 534, for example, the AMF may perform a remote WTRU reporting procedure by forwarding a SUPI associated with the remote WTRU and / or a remote WTRU reporting message to the SMF. The AMF may include an indication of whether the remote WTRU is successfully authenticated and / or authorized for the S-NSSAI associated with the PDU session. The indication of whether the remote WTRU is successfully authenticated and / or authorized for the S-NSSAI associated with the PDU session may be included in the message forwarded to the SMF.

[0115] The SMF may send a Remote WTRU Report Response message to the WTRU to Network Relay at 536. For example, the Remote WTRU Report Response message may include a 5G RUK ID and / or authentication and authorization results.

[0116] At 538, the layer 3 WTRU to network relay may provide the remote WTRU with access to the PDU session (e.g., based on the authentication and authorization results included in the remote WTRU report response message). The layer 3 WTRU to network relay may store authorization information for the remote WTRU. For example, if the response message indicates successful authentication and authorization, the layer 3 WTRU to network relay may store authorization information for the remote WTRU. The layer 3 WTRU to network relay may release the PC5 link with the remote. For example, if the response message indicates unsuccessful authentication and authorization, the layer 3 WTRU to network relay may release the PC5 link with the remote.

Claims

1. A wireless transmit / receive unit (WTRU), the wireless transmit / receive unit configured to: receiving a key identifier associated with a second WTRU, wherein the WTRU is configured as a WTRU-to-network relay for the second WTRU, and the key identifier is received during a key request procedure performed by the WTRU on behalf of the second WTRU; communicating the key identifier to a network function, wherein the key identifier is communicated to the network function to initiate a secondary authentication procedure on behalf of the second WTRU; receiving an authentication message including the key identifier; transmitting the authentication message to the second WTRU based on the authentication message including the key identifier; as well as receiving an authentication response message from the second WTRU, the authentication response message including the key identifier; as well as A response is received from the network function, the response including the key identifier and indicating a result of the secondary authentication procedure.

2. The WTRU of claim 1, wherein the key identifier comprises a 5G ProSe Remote User Key (5GPRUK) identifier (ID).

3. The WTRU of claim 1 , wherein the key identifier is transmitted to the network function in a Remote WTRU Report message and the response comprises a Remote WTRU Report Response message.

4. The WTRU of claim 4, wherein the WTRU is configured to send an indication that the second WTRU is authorized to communicate via a link or to release the link based on the remote WTRU report response message.

5. The WTRU of claim 5, wherein the link is a PC5 link.

6. The WTRU of claim 1, wherein the network function is identified by an access and mobility function (AMF) or a session management function (SMF).

7. The WTRU of claim 6, wherein the AMF sends the key identifier to a session management function (SMF).

8. The WTRU of claim 1, wherein data network (DN) information is retrieved from the second WTRU, and wherein secondary authentication is triggered based on a determination that the DN is authorized, that the DN requires secondary authentication, and one or more of a previous authentication.

9. The WTRU of claim 1 , wherein the WTRU is configured to release the link with the second WTRU if the result of the secondary authentication procedure is unsuccessful.

10. A method performed by a wireless transmit / receive unit (WTRU), the method comprising: receiving a key identifier associated with a second WTRU, wherein the WTRU is configured as a WTRU-to-network relay for the second WTRU, and the key identifier is received during a key request procedure performed by the WTRU on behalf of the second WTRU; communicating the key identifier to a network function, wherein the key identifier is communicated to the network function to initiate a secondary authentication procedure on behalf of the second WTRU; receiving an authentication message including the key identifier; transmitting the authentication message to the second WTRU based on the authentication message including the key identifier; as well as receiving an authentication response message from the second WTRU, the authentication response message including the key identifier; as well as A response is received from the network function, the response including the key identifier and indicating a result of the secondary authentication procedure.

11. The method of claim 10, wherein the key identifier comprises a 5G ProSe Remote User Key (5GPRUK) identifier (ID).

12. The method of claim 10, wherein the key identifier is transmitted to the network function in a Remote WTRU Report message and the response comprises a Remote WTRU Report Response message.

13. The method of claim 11, comprising sending an indication that the second WTRU is authorized to communicate via a link or releasing the link based on the remote WTRU report response message. The method of claim 13 , wherein the link is a PC5 link.

15. A method performed by a base station, the method comprising: receiving, from a wireless transmit / receive unit (WTRU), a key identifier associated with a second WTRU, wherein the WTRU is configured as a WTRU-to-network relay for the second WTRU, and the key identifier is received during a key request procedure performed by the WTRU on behalf of the second WTRU; wherein the key identifier is received to initiate a secondary authentication procedure on behalf of the second WTRU; sending an authentication message including the key identifier to the second WTRU, wherein the authentication message is transmitted to the second WTRU via the WTRU based on the authentication message including the key identifier; as well as A response is sent to the WTRU, the response including the key identifier and indicating a result of the secondary authentication procedure.

Images