Method and system for network slice authentication and authorization

Abstract

The invention relates to a method and system for network slice authentication and authorization. Embodiments herein disclose a method performed by a source access and mobility management function, AMF, entity in a wireless communication system, the method comprising: receiving, from a source new generation radio access network, NG-RAN, a handover request message for initiating an N2-based handover procedure; and transmitting, during the N2-based handover process, a message comprising a list of network slice specific authentication and authorization (NSSAA) states of at least one single network slice selection assistance information (S-NSSAI) to a target AMF entity to indicate that the NSSAA state of the at least one S-NSSAI is pending.

Description

[0001] This application is a divisional application of the invention patent application with the application date of November 2, 2020, Chinese application number 202080076389.1, and invention name “Method and system for network slice authentication and authorization”. Technical Field

[0002] The present disclosure relates to methods and apparatus for network slice authentication and authorization. Background Art

[0003] In order to meet the increased demand for wireless data services since the deployment of 4G communication systems, efforts have been made to develop improved 5G or pre-5G communication systems. Therefore, 5G or pre-5G communication systems are also referred to as "super 4G networks" or "post-LTE systems". 5G communication systems are considered to be implemented in higher frequency (millimeter wave) bands (e.g., 60GHz bands) in order to achieve higher data rates. In order to reduce the propagation loss of radio waves and increase the transmission distance, beamforming, massive multiple input multiple output (MIMO), full-dimensional MIMO (FD-MIMO), array antennas, analog beamforming, and massive antenna technology are discussed in 5G communication systems. In addition, in 5G communication systems, system network improvements are being developed based on advanced small cells, cloud radio access networks (RANs), ultra-dense networks, device-to-device (D2D) communications, wireless backhaul, mobile networks, collaborative communications, collaborative multi-point (CoMP), receiving-end interference elimination, etc. In 5G systems, hybrid FSK and QAM modulation (FQAM) and sliding window superposition coding (SWSC) have been developed as advanced coded modulation (ACM), and filter bank multi-carrier (FBMC), non-orthogonal multiple access (NOMA) and sparse code multiple access (SCMA) as advanced access technologies.

[0004] The Internet, as a human-centered connected network in which humans generate and consume information, is now developing toward the Internet of Things (IoT) in which distributed entities (such as things) exchange and process information without human intervention. The Internet of Everything (IoE) has emerged as a combination of IoT technology and big data processing technology through connection with a cloud server. As IoT implementation requires technical elements such as "sensing technology", "wired / wireless communication and network infrastructure", "service interface technology" and "security technology", sensor networks, machine-to-machine (M2M) communication, machine type communication (MTC), etc. have been studied recently. Such an IoT environment can provide intelligent Internet technology services that create new value for human life by collecting and analyzing data generated between connected things. Through the integration and combination between existing information technology (IT) and various industrial applications, IoT can be applied to various fields including smart homes, smart buildings, smart cities, smart cars or connected cars, smart grids, healthcare, smart appliances, and advanced medical services.

[0005] In line with this, various attempts have been made to apply 5G communication systems to IoT networks. For example, technologies such as sensor networks, machine type communications (MTC), and machine-to-machine (M2M) communications can be implemented through beamforming, MIMO, and array antennas. Cloud radio access networks (RANs) as an application of the above-mentioned big data processing technologies can also be considered as an example of the fusion between 5G technologies and IoT technologies. Summary of the invention

[0006] Problem Solution

[0007] Therefore, an embodiment of this document discloses a method for processing a network slice specific authentication and authorization (NSSAA) process in a wireless network system.

[0008] The method includes detecting, by a source access and mobility function (AMF) device, that an NSSAA process for at least one single network slice selection assistance information (S-NSSAI) is in progress, and that an inter-AMF handover process from the source AMF device to a target AMF is triggered during the NSSAA process. The method includes storing, by the source AMF device, an NSSAA state of an NSSAA process of at least one S-NSSAI as pending; and upon detecting completion or termination of the NSSAA process, transmitting, by the source AMF device, the stored NSSAA state of at least one S-NSSAI to the target AMF device.

[0009] In an embodiment, the method further comprises receiving, by the target AMF device, an NSSAA status of an NSSAA procedure for at least one S-NSSAI marked as pending, and initiating, by the target AMF device, an NSSAA procedure for at least one S-NSSAI. The method further comprises detecting, by the source AMF device, that the NSSAA procedure is completed or aborted, and marking, by the source AMF device, at least one S-NSSAI as part of one of an allowed NSSAI list or a rejected S-NSSAI list.

[0010] In an embodiment, the target AMF device supports the NSSAA procedure.

[0011] In an embodiment, the method further includes updating, by the target AMF device, the NSSAA status of the NSSAA process of at least one S-NSSAI from pending to completed when the initiated NSSAA process is completed.

[0012] In an embodiment, the method includes updating, by the target AMF device, the state of at least one S-NSSAI from a requested S-NSSAI to an allowed S-NSSAI upon successful completion of the NSSAA procedure for at least one S-NSSAI. The method also includes sending, by the target AMF device, the updated state of at least one S-NSSAI to a user equipment (UE).

[0013] In an embodiment, the ongoing NSSAA procedure corresponds to not allocating a protocol data unit (PDU) session to a user equipment (UE) for at least one S-NSSAI.

[0014] Therefore, an embodiment of the present invention discloses a wireless network system for processing a network slice specific authentication and authorization (NSSAA) process. The system includes a source AMF device and a target AMF device. The source AMF device includes a memory, a processor, and a source NSSAA process controller communicatively connected to the memory and the processor. The source NSSAA process controller is configured to detect that an NSSAA process for at least one single network slice selection assistance information (S-NSSAI) is in progress, and an inter-AMF handover process from the source AMF to the target AMF is triggered during the NSSAA process. In addition, the source NSSAA process controller is configured to store the NSSAA status of the NSSAA process of at least one S-NSSAI as pending. The source NSSAA controller is also configured to transmit the stored NSSAA status of the NSSAA process of at least one S-NSSAI to the target AMF upon detecting one of the completion or termination of the NSSAA process.

[0015] An embodiment of the present invention discloses a method performed by a source access and mobility management function (AMF) entity in a wireless communication system, the method comprising: receiving a handover requirement message for initiating an N2-based handover process from a source new generation radio access network (NG-RAN); and during the N2-based handover process, transmitting a message including a network slice specific authentication and authorization NSSAA state list of at least one single network slice selection assistance information (S-NSSAI) to a target AMF entity to indicate that the NSSAA state of the at least one S-NSSAI is pending.

[0016] An embodiment of the present invention discloses a source access and mobility management function AMF entity, the source AMF entity comprising: a transceiver; and a controller coupled to the transceiver and configured to: receive a switching requirement message for initiating an N2-based switching process from a source new generation radio access network NG-RAN, and during the N2-based switching process, transmit a message including a network slice specific authentication and authorization NSSAA state list of at least one single network slice selection assistance information S-NSSAI to a target AMF entity to indicate that the NSSAA state of the at least one S-NSSAI is pending.

[0017] An embodiment of the present invention discloses a method performed by a target access and mobility management function AMF entity in a wireless communication system, the method comprising: during an N2-based handover process, receiving a message including a network slice-specific authentication and authorization NSSAA state list of at least one single network slice selection assistance information S-NSSAI from a source AMF entity to indicate that the NSSAA state of the at least one S-NSSAI is pending; and determining whether to perform an NSSAA process for at least one S-NSSAI based on the NSSAA state list, and wherein, in the case where the NSSAA process is being performed for the at least one S-NSSAI, the NSSAA state list indicates that the NSSAA state of the at least one S-NSSAI is pending.

[0018] An embodiment of the present invention discloses a target access and mobility management function AMF entity, the target AMF entity comprising: a transceiver; and a controller coupled to the transceiver and configured to: during an N2-based switching process, receive a message including a network slice-specific authentication and authorization NSSAA state list of at least one single network slice selection assistance information S-NSSAI from a source AMF entity to indicate that the NSSAA state of the at least one S-NSSAI is pending, and determine whether to perform an NSSAA process for at least one S-NSSAI based on the NSSAA state list, and wherein, in the case where the NSSAA process is being performed for the at least one S-NSSAI, the NSSAA state list indicates that the NSSAA state of the at least one S-NSSAI is pending.

[0019] These and other aspects of the embodiments herein will be better understood and appreciated when considered in conjunction with the following description and accompanying drawings. However, it should be understood that although the following description points out preferred embodiments and many of their specific details, these descriptions are given in an illustrative manner, rather than restrictive. Without departing from the spirit of the embodiments herein, many changes and modifications may be made within the scope of the embodiments herein, and the embodiments herein include all such modifications.

[0020] Before proceeding to the following detailed description, it may be helpful to set forth definitions of certain words and phrases used throughout this patent document: the terms "include" and "comprising" and their derivatives mean inclusion without limitation; the term "or" is inclusive, meaning and / or; the phrases "associated with" and "associated with" and their derivatives may mean including, included within, interconnected with, containing, contained within, connected to or connected with, coupled to or coupled with, communicable with, cooperating with, interleaved, juxtaposed, proximate, incorporated into or incorporated with, having, having the characteristics of, and the like; the term "controller" refers to any device, system, or part thereof that controls at least one operation, such device being implemented in hardware, firmware, or software, or some combination of at least the two. It should be noted that the functionality associated with any particular controller may be centralized or distributed, whether local or remote.

[0021] In addition, the various functions described below can be implemented or supported by one or more computer programs, each of which is formed by a computer-readable program code and embodied in a computer-readable medium. The terms "application" and "program" refer to one or more computer programs, software components, instruction sets, processes, functions, objects, classes, instances, related data or a part thereof suitable for implementation with a suitable computer-readable program code. The phrase "computer-readable program code" includes any type of computer code, including source code, object code and executable code. The phrase "computer-readable medium" includes any type of medium that can be accessed by a computer, such as a read-only memory (ROM), a random access memory (RAM), a hard drive, a compact disk (CD), a digital video disk (DVD) or any other type of memory. "Non-transitory" computer-readable media does not include wired, wireless, optical or other communication links that transmit temporary electrical signals or other signals. Non-transitory computer-readable media include media that can permanently store data and media that can store data and rewrite it later, such as rewritable optical disks or erasable memory devices.

[0022] Definitions for certain words and phrases are provided in this patent document, those of ordinary skill in the art should understand that in many, if not most instances, such definitions apply to prior, as well as future uses of such defined words and phrases. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] For a more complete understanding of the present disclosure and its advantages, reference is now made to the following description taken in conjunction with the accompanying drawings, wherein like reference numerals represent like parts:

[0024] Figure 1 A wireless communication system for network slice authentication according to an embodiment disclosed herein is shown;

[0025] Figure 2 The network architecture of a wireless network system for network slice authentication according to an embodiment disclosed herein is shown;

[0026] Figure 3A and Figure 3B A sequence diagram showing a network slice authentication and authorization process according to an embodiment disclosed herein is shown together;

[0027] Figure 4A and Figure 4B A sequence diagram showing a handover process of a UE from a source NG_RAN to a target NG_RAN according to the embodiments disclosed herein is shown together;

[0028] Figure 5 A flow chart showing the NSSAA process handling process during handover of a UE according to an embodiment disclosed herein is shown;

[0029] Fig. 6A A table indicating authentication state types of NSSAA procedures associated with S-NSSAI slices according to embodiments disclosed herein is shown;

[0030] Figure 6B A table showing the NSSAA state of a specific S-NSSAI slice in a UE context message according to an embodiment disclosed herein is shown;

[0031] Figure 7 A component diagram of a source AMF for implementing NSAA procedure handling during handover of a UE according to embodiments disclosed herein is shown;

[0032] Figure 8 A component diagram of a target AMF for implementing an NSAA procedure processing procedure after handover of a UE according to an embodiment disclosed herein; and

[0033] Fig. 9 A flow chart illustrating a method for handling an ongoing or pending NSSAA procedure during handover of a UE according to embodiments disclosed herein is shown.

[0034] Fig.10 is a block diagram illustrating a UE according to an embodiment disclosed herein.

[0035] Fig.11 is a block diagram illustrating a base station according to an embodiment disclosed herein.

[0036] Fig.12 is a block diagram illustrating network entities according to embodiments disclosed herein. DETAILED DESCRIPTION

[0037] Discussed below Figures 1 to 9The various embodiments used to describe the principles of the present disclosure in this patent document are merely exemplary and should not be interpreted in any way as limiting the scope of the present disclosure. Those skilled in the art will appreciate that the principles of the present disclosure can be implemented in any appropriately arranged system or device.

[0038] The embodiments of the present invention and their various features and advantageous details are explained more fully with reference to the non-limiting embodiments shown in the accompanying drawings and described in detail in the following description. The description of known components and processing techniques is omitted so as not to unnecessarily obscure the embodiments of the present invention. In addition, the various embodiments described herein are not necessarily mutually exclusive, because some embodiments can be combined with one or more other embodiments to form new embodiments. Unless otherwise stated, the term "or" used herein refers to a non-exclusive or. The examples used herein are merely to facilitate understanding of the manner in which the embodiments of the present invention can be practiced, and further enable those skilled in the art to practice the embodiments of the present invention. Therefore, these examples should not be interpreted as limiting the scope of the embodiments of the present invention.

[0039] According to the tradition of this area, embodiments can be described and illustrated according to the block of performing one or more functions described.These blocks may be referred to as units or modules, etc. in this article, and are physically implemented by analog or digital circuits (such as logic gates, integrated circuits, microprocessors, microcontrollers, memory circuits, passive electronic components, active electronic components, optical components, hard-wired circuits, etc.), and may be optionally driven by firmware.Circuit may be, for example, embodied in one or more semiconductor chips, or on substrate supports such as printed circuit boards, etc.The circuit constituting the block may be implemented by dedicated hardware, or by a processor (for example, one or more programmed microprocessors and associated circuit systems), or by a combination of dedicated hardware for executing some functions of the block and a processor for executing other functions of the block.Without departing from the scope of the present invention, each block of the embodiment may be physically divided into two or more interacting and discrete blocks.Equally, without departing from the scope of the present invention, the block of the embodiment may be physically combined into more complex blocks.

[0040] The accompanying drawings are used to help easily understand various technical features, and it should be understood that the embodiments presented herein are not limited by the accompanying drawings. Therefore, the present disclosure should be interpreted as extending to any changes, equivalents and substitutes other than those specifically set forth in the accompanying drawings. Although the terms first, second, etc. can be used to describe various elements in this article, these elements should not be limited by these terms. These terms are usually only used to distinguish one element from another element.

[0041] Network slicing is developed as an important feature of the fifth generation (5G) wireless communication network. Network slicing is a method of designing unique logical and virtualized networks on a common physical network infrastructure. Network slicing supports new services with different network capability requirements such as latency, throughput, bandwidth, and reliability. For example, an Internet of Things (IoT) system may require low latency and low bandwidth, while a broadband system requires high bandwidth and high throughput. Therefore, by selecting and combining network functions of the 5G system according to services or users, network services that are independent of each type of application service or user and more flexible can be provided.

[0042] In addition, as the bandwidth capabilities of 4G / 5G wireless network systems continue to increase, it is expected that mobile network operators will manage hundreds or thousands of network slices, and each slice may have its own architecture, management, and security to support specific usage scenarios. Therefore, authentication becomes a key component of network slicing. Therefore, the Network Slice Specific Authentication and Authorization (NSSAA) process is defined in the 3rd Generation Partnership Project (3GPP) standard protocol process. The NSSAA process is performed to access the network slice for any application service.

[0043] Although the NSSAA procedure is defined in the 3GPP standard, there is no procedure for handling a pending or ongoing NSSAA procedure during a handover procedure from a source Access and Mobility Management Function (AMF) to a target AMF.

[0044] In view of the foregoing, a system or method is needed to provide a step-by-step process for handling an ongoing or pending NSSAA procedure during handover of a user equipment (UE) from a source radio access network (RAN) to a target radio access network (RAN).

[0045] The main purpose of the embodiments of this document is to provide a method and system for processing NSSAA procedures related to at least one single network slice selection authentication information (S-NSSAI) during a handover process of a UE from a source AMF to a target AMF without skipping any ongoing or pending NSSAA procedures.

[0046] Another object of the embodiments herein is to enable an Access and Mobility Function (AMF) associated with a source New Generation RAN (NG_RAN) to prioritize a handover procedure or one of an ongoing or pending NSSAA procedure based on the NSSAA capabilities of a target AMF associated with a target NG_RAN.

[0047] Therefore, the embodiments of the present invention implement a method for processing a network slice specific authentication and authorization (NSSAA) process in a wireless network system. The method includes detecting, by a source access and mobility function (AMF) device, that an NSSAA process for single network slice selection assistance information (S-NSSAI) is in progress, and that an inter-AMF handover process from the source AMF device to a target AMF device is triggered during the NSSAA process. The method includes storing, by the source AMF device, the NSSAA state of the S-NSSAI as pending; and upon detecting completion or termination of the NSSAA process, transmitting, by the source AMF device, the stored NSSAA state of the S-NSSAI to the target AMF device.

[0048] In existing methods, there is a lack of information about handling ongoing or pending NSSAA procedures during handover of a User Equipment (UE) from a source AMF device associated with a source New Generation Radio Access Network (NG_RAN) to a target AMF device associated with a target NG_RAN. Currently, the Access and Mobility Function is not configured to handle ongoing or pending NSSAA procedures during handover of a UE.

[0049] Unlike conventional methods and systems, the proposed method can be used to handle ongoing or pending NSSAA procedures for each network slice selection authentication information (NSSAI) during a handover process of a UE from a source NG_RAN to a target NG_RAN. Thus, the problem of missing any ongoing or pending NSSAA procedures after handover, or any errors in the implementation of ongoing or pending NSSAA procedures due to handover, is eliminated.

[0050] In the proposed method, during the handover procedure of the UE from the source AMF to the target AMF, the ongoing or pending NSSAA procedure of the S-NSSAI is handled in a meticulous manner by prioritizing the handover procedure or the ongoing or pending NSSAA procedure according to the target AMF capabilities. Thus, the defined procedure for handling the ongoing or pending NSSAA procedure during the handover procedure ensures a smooth handover without degrading the execution of the ongoing or pending NSSAA procedure.

[0051] Referring now to the drawings, and more particularly to the Figure 1-Figure 9 , wherein like reference numerals indicate corresponding features throughout the several views, there is shown a preferred embodiment.

[0052] Figure 1 A wireless communication system (100) for network slice authentication according to an embodiment of the present disclosure is shown.

[0053] The wireless communication system (100) includes at least one user equipment (UE) (102), an application (104) installed in the UE (102), an access network (106) including at least one radio access network node (i.e., a new generation radio access network (NG_RAN) (108)), and a mobile core network (112). The access network (106) and the mobile core network (112) form a mobile communication network. The access network (106) may include a 3GPP access network and / or a non-3GPP access network (e.g., Wi-Fi).

[0054] The UE (102) communicates with the access network (106) using a wireless communication link (110). Figure 1 A single UE (102), access network (106), a single NG_RAN (108), a single wireless communication link (110), and a single mobile core network (112) are depicted in the figure, but those skilled in the art will recognize that the wireless communication system (100) may include any number of UEs (102), access networks (106), NG_RAN (108), wireless communication links (110), and mobile core networks (112).

[0055] In one embodiment, the wireless communication system (100) complies with the 5G system (and beyond 5G system) specified in the 3GPP specification. The present disclosure is not intended to be limited to the implementation of any particular wireless communication system architecture or protocol.

[0056] The UE (102) may be, for example, but not limited to, a cellular phone, a tablet computer, a virtual reality device, a smart phone, a laptop computer, a personal digital assistant (PDA), a global positioning system, a multimedia device, a video device, an IoT device, and a smart watch. In an embodiment, the 3GPP network maintains communication standards according to protocols defined in the Third Generation Partnership Project.

[0057] The UE (102) may communicate directly with one or more NG_RANs (108) in the access network (106) via uplink ("UL") and downlink ("DL") communication signals. In addition, the UL and DL communication signals may be carried on a communication link (110). Here, the access network (106) may act as an intermediate network that provides the UE (102) with access to the mobile core network (112).

[0058] In some embodiments, the UE (102) communicates with an application function (AF) device (118) via a network connection with a mobile core network (112). For example, an application (104) in the UE (102) (e.g., a web browser, a media client, a phone / VoIP application) can trigger the UE (102) to establish a data connection (i.e., a protocol data unit (PDU) session) with the mobile core network (112) via the NG_RAN (108). The mobile core network (112) relays traffic between the UE (102) and the AF device (118) using the established PDU session. Note that the UE (102) can establish one or more PDU sessions with the mobile core network (112). The UE (102) can establish additional PDU sessions for communicating with other data networks and / or other remote hosts.

[0059] The NG_RAN (108) may be distributed over a geographic area. The NG_RAN (108) may also be referred to as an access point, access point, base station, Node B, eNB, gNB, Home Node B, relay node, device, or any other term used in the art. The NG_RAN (108) is typically part of a radio access network, such as an access network (106), which may include one or more controllers communicatively coupled to one or more corresponding NG_RANs (108). These and other elements of a radio access network are not shown, but are well known to those of ordinary skill in the art. The NG_RAN (108) is connected to a mobile core network (112) via the access network (106).

[0060] The NG_RAN (108) can serve multiple UEs (102) within a service area (e.g., a cell or cell sector) via a wireless communication link (110). The NG_RAN (108) can communicate directly with the UE (102) via uplink and downlink communication signals. Typically, the NG_RAN (108) sends DL communication signals to serve the UE (102) in the time, frequency, and / or spatial domain. The wireless communication link (110) can be any suitable carrier in a licensed or unlicensed radio spectrum. The wireless communication link (110) facilitates communication between one or more UEs (102) and / or one or more NG_RANs (108).

[0061] In an embodiment, the mobile core network (106) is a 5G core ("5GC") that can be coupled to a data network (120), such as the Internet and private data networks and other data networks. In some embodiments, the UE (102) communicates with an application function (118) (external to the mobile core network (112)) via the data network (120) and the mobile core network (112). The UE (102) can have a subscription or other account with the mobile core network (112). Each mobile core network (112) belongs to a single public land mobile network ("PLMN"). The present disclosure is not intended to be limited to any particular wireless communication system architecture or protocol implementation. For example, other embodiments of the mobile core network (112) may include an enhanced packet core ("EPC") or a multi-service core described by the Broadband Forum ("BBF").

[0062] The mobile core network (112) includes several network functions ("NFs") (114) and multiple network slices (124).

[0063] The NF (114) includes user plane functions and control plane network functions for exchanging control and data packets with the UE (102) for specific applications.

[0064] The plurality of network slices (116) are logical networks within the mobile core network (112). A network slice (116) is a partitioning of resources and / or services of the mobile core network (112). Different network slices (116) may be used to meet different service requirements (e.g., latency, reliability, and capacity). In certain embodiments, each of the plurality of network slices (116) includes its own dedicated network functions (not shown), such as independent control plane network function devices and user plane function devices.

[0065] Examples of different types of network slices (116) include enhanced mobile broadband ("eMBB"), massive machine type communications ("mMTC"), and ultra-reliability and low latency communications ("URLLC"). The mobile core network (112) may include multiple network slice instances of the same network slice type, which may be distinguished using a slice "distinguisher" associated with the slice instance.

[0066] According to an example embodiment, an application (104) running on a UE (102) communicates with an AF device (118) via a data path (122) that passes through a network slice (116) of a mobile core network (112). In addition, the AF device (118) may send information to the mobile core network (112) that may be used to optimize network internal configuration or network behavior. In a specific embodiment, the AF device (118) is an application server ("AS"), enabling the application (104) to access and use functions provided by the application server through a standardized interface (e.g., API).

[0067] As described above, the wireless communication system (100) is capable of authenticating a user to a network slice, in particular, using a user identity and credentials different from a 3GPP subscription permanent identifier (SUPI) to provide network slice access authentication and authorization. Although the secondary authentication of the PDU session (i.e., network slice access authentication) is performed during the PDU establishment process, the user identity authentication is performed during the registration process.

[0068] In addition, various components of the mobile core network (112) and different functions of the components of the mobile core network (112) for the NSSAA process are described in Figure 2 Shown in detail.

[0069] Figure 2 An architectural diagram (200) of a wireless network system (100) for network slice specific authentication according to an embodiment disclosed herein is shown.

[0070] like Figure 2 As shown, the network architecture (200) depicts an NSSAA-capable UE (102) in communication with a mobile core network (112).

[0071] The mobile core network (112) includes a NF device (114) and a network slice (116). The NF device (114) includes a user plane function (UPF) device (202), a user data management (UDM) device (204), an access and management function (AMF) device (206), a session management function (SMF) device (208), an authentication server function (AUSF) device (210), a protocol data unit (PDU) (212), a user plane function (UPF)-PDU ​​session anchor (UPF_PSA) device (214), a network exposure function (NEF) device (216) and a network slice selection function (NSSF) device (218). The UDM device (204), the AMF device (206), the SMF device (208), the AUSF device (210), the PDU (212), the UPF_PSA device (214), the NEF device (216) and the NSSF device (218) constitute the control plane network function of the NF device (114). The control plane network function provides services such as UE registration, UE connection management, UE mobility management, session management, etc. In contrast, the UPF device (202) provides data transmission services to the UE (102).

[0072] The UE (102) uses the mobile core network (112) to access services in a service provider network (220). Depicted within the service provider network (220) are application server / application function ("AS / AF") devices (118) and a service provider authentication, authorization and accounting (AAA) server (222) (also interchangeably referred to as ("AAA-S (222)").

[0073] The UDM device (204) includes unified data of users associated with each UE (102) and maintains a user data repository ("UDR"). The UDM device (204) stores subscription data including policy data. Specifically, the policy data stored by the UDM device (204) includes a network slice selection policy (NSSP).

[0074] The NEF device (216) implements "front-end" services that interface with external application functions and exposes the capabilities of the mobile core network (112) to these functions. For example, the NEF device (216) can be used by the AF device (118) to communicate with the UDM device (204), for example to provide network slice authentication information as described herein. Thus, the NEF device (216) provides a single point of contact for external applications that want to utilize services provided by internal network functions of the mobile core network (112) (e.g., services of the UDM device (204), AMF device (206), SMF device (208), etc.). The AUSF device (210) performs authentication of the UE (102). The NSSF device (218) selects a network slice instance (NSI) based on information provided during the connection with the UE (102). Based on the network slice (116) to which the UE (102) accesses, a set of AMF devices (206), SMF devices (208) or UPF devices (202) are provided to the UE (102). The SMF device (208) manages the allocation of IP addresses for the UE (102) and controls the selection of the UPF device (202) for the PDU session of the UE (102).

[0075] In addition, according to an embodiment, it can be assumed that the service provider network (220) (including the application server (AS) or application function (AF) (118) and AAA-S (222)) is located outside the mobile core network (112) and communicates with the UDM device (204), for example via the NEF device (216). Note that the AAA-S (222) can be located within or outside the mobile core network (112) domain. In some embodiments, if the service provider network (220) is located inside the mobile core network (112), the AS / AF device (118) and SP-AAA (222) can communicate directly with the UDM device (204). The UDM (204) performs the binding of UE subscriptions to user identities (IDs), and the binding of subscribed services to information about the service provider. As used herein, a user ID uniquely identifies a UE (102) registration / subscription to a specific service at the service provider network (220). Note that the UE (102) also stores an association between the S-NSSAI and the corresponding credentials for network slice authentication, as discussed in further detail below. For example, the UE (102) may store network slice information (e.g., including user ID and security credentials) at an application module.

[0076] During the network slice authentication process, authentication messages encapsulated in NAS messages are exchanged between the UE (102) and the AAA-S (222). One or more applications (104) may be registered at the AAA-S (222), so the AAA-S (222) should forward the authentication message to the appropriate application (104). In addition, there may be one or more application modules at the UE (102). The application module may be an extensible authentication protocol (EAP) client in the UE (102). The EAP client may store different authentication information for each S-NSSAI. The EAP client may be a different application from the application (104) that sends / receives real data. Note that information related to the application (104) is identified in the NSSP in the UDM device (204). Furthermore, according to an embodiment, the AMF device (206) is configured to receive all connection and session related information from the UE (102), but is only responsible for handling connection and mobility management tasks, such as the connection of the UE (102) to the NG_RAN (108), the connection of the UE (102) to the AAA-S (222), or handling the NSSAA procedure for the S-NSSAAI.

[0077] According to an example embodiment, the application (104) may be a media streaming client application, for example, providing a video streaming service to a subscriber. Via the application (104), a user may access a (multiple) server of a video streaming service provider to subscribe to and receive S-NSSAI associated with the video streaming client application. In some embodiments, the S-NSSAI is stored in the application (104). For example, the application (104) may include network slice authentication information stored in the UE (102). In other embodiments, the S-NSSAI is stored in an application module different from the application (104), for example, the application module may be an EAP client, which is a different application from the media streaming application. Here, the application module performs authentication (222) with the AAA-S while the media streaming application sends / receives data from the AS / AF (118).

[0078] Despite Figure 1 Although a specific number and type of network functions are described in the mobile core network (112), one of ordinary skill in the art will recognize that any number and type of network functions may be included in the mobile core network (112).

[0079] Figure 3A and Figure 3B A sequence diagram representing a network slice authentication and authorization process (300) according to an embodiment disclosed herein is collectively shown.

[0080] In an embodiment, the UE (102) has registered with the AMF device (206). The AMF device (206) has UE subscription details related to subscribed services and associated network slices (116). At step 302, the UE (102) sends a request to the AMF device (206) to access at least one S-NSSAI slice (116a) of a plurality of network slices (116) associated with an application (104) running on the UE (102). At step 304, the AMF device (206) determines whether the requested S-NSSAI slice (116a) requires a Network Slice Specific Authentication and Authorization (NSSAA) procedure. For example, but not limited to, if a request to access an S-NSSAI slice (116a) is received for the first time from the UE (102), or if there is any change in the subscription ID, user login credentials, or user ID of the account associated with the requested S-NSSAI slice (116a), the AMF device (206) may decide to perform an NSSAA procedure on the requested S-NSSAI slice (116a).

[0081] At step 306, the AMF device (206) sends a request to the UE (102) to share the authentication ID (i.e., EAP ID) associated with the requested S-NSSAI slice (116a). When the UE (102) successfully registers / subscribes to the service provider network (220) for the requested S-NSSAI slice (116a), the authentication ID details are stored in the UE (102). At step 308, the UE (102) sends a response to the AMF device (206) to share the requested EAP ID associated with the requested S-NSSAI slice (116a). Steps 306 and 308 are part of the main authentication of the user subscription details at the AMF device (206) and do not constitute the NSSAA process. At step 310, the AMF device (206) sends an authentication message to the NSSF device (218). The authentication message includes the EAP ID of the S-NSSAI and the generic public subscription identifier (GPSI) of the third-party service provider subscribed by the UE (102). The GPSI is used as a means of addressing a 3GPP subscription in a data network outside the 3GPP system domain, for example, if the service is associated with a third-party provider and the third-party service provider uses the S-NSSAI slice (116a), the GPSI is the global ID of the third-party service provider. The NSSF device (218) is a device that communicates with an external service provider network (220). The NSSF device (218) receives the IP address of the AAA-S (222) of the service provider network (220) from the AMF device (206).

[0082] At step 312, the NSSF device (218) forwards the authentication message as an AAA protocol message to the AAA-S (222). The AAA protocol message indicates a request to authenticate the requested S-NSSAI (i.e., to perform the NSSAA procedure on the requested S-NSSAI slice). At step 314, the AAA-S (222) identifies the user details and services subscribed by the UE (102) and initiates the NSSAA procedure for the requested S-NSSAI slice (116a).

[0083] At step 316, upon completing the NSSAA process for the requested S-NSSAI slice (116a), the AAA-S (222) sends a response to the received AAA protocol message to the NSSF device (218), indicating the success or failure of the NSSAA process for the requested S-NSSAI slice (116a). At step 318, the NSSF device (218) forwards the received response from the AAA-S (222) to the AMF device (206) as an authentication response to the authentication message received at step 310. Steps 320-332 illustrate a similar process sequence as described in steps 302-318 for another requested S-NSSAI slice (116); therefore, explanation of these steps is omitted for brevity of the specification.

[0084] At step 334, the AMF device (206) sends a response to the UE (102) indicating the success or failure of the request initiated by the UE (102) to access the S_NSSAI slice (116a).

[0085] At step 336, the AMF device (206) may initiate a UE configuration update procedure to the UE (102) to update the UE configuration for access and mobility management related parameters, allowed NSSAI, configured NSSAI, and NSSAA state. For example, when a successful grant of the access request for the S-NSSAI is received, the requested S-NSSAI slice (116a) is stored in the UE (102) as an allowed S-NSSAI. However, if the access request for the S-NSSAI slice (116a) is unsuccessful, the requested S-NSSAI slice (116a) is stored in the UE (102) as a rejected S-NSSAI. In addition, the requested S-NSSAI slice waiting for a response thereto from the AMF device (206) is stored in the UE (102) as a pending S-NSSAI slice. At step 338, if the network slice specific authentication and authorization fails for all S-NSSAIs in the existing allowed NSSAIs (if any) and for all S-NSSAIs in the requested NSSAIs (if any) for the UE (102), the AMF (206) shall perform the network initiated deregistration procedure described in clause 4.2.2.3.3 and the AMF (206) shall include a list of rejected S-NSSAIs, each with an appropriate rejection cause value, in the explicit deregistration request.

[0086] Figure 4A and Figure 4B A sequence diagram is shown together representing a handover process (400) of a UE (102) from a source NG_RAN (108a) to a target NG_RAN (108b) according to embodiments disclosed herein. Figure 4A and Figure 4B The UE (102) is shown connected to a source NG_RAN (S-NG_RAN) (108a) for network connectivity and network services. The S-NG_RAN (108a) is connected to a source AMF (S-AMF) device (206a) of a mobile core network (112) and a source UPF (S-UPF) device (202a) of the mobile core network (112). In an embodiment, the UE (102) traverses from the geographical area of ​​the S-NG_RAN (108a) to the geographical area of ​​the target NG_RAN (T-NG_RAN) (108b), so the handover process of the UE (102) is triggered by the S-NG_RAN (108a), as shown in step 402. The T-NG_RAN (108b) can be considered as the NG_RAN (108) closest to the UE (102). In an embodiment, the T-NG_RAN (108b) is connected to a target AMF (T-AMF) device (206b) and a target UPF (T-UPF) device (202b).

[0087] In an embodiment, the SMF device (208) of the mobile core network (112) is connected to the S-NG_RAN (108a) and the T-NG_RAN (108b) via the AMF (206), and manages the connection of the UE (102) with the S-NG_RAN (108a) and the T-NG_RAN (108b). In an embodiment, the UPF_PSA device (214) manages the PDU session of the UE (102) with the S-NG_RAN (108a) and the T-NG_RAN (108b) together with the SMF device (208). The UPF_PSA device (214) is configured to provide mobility within and between access networks (106), including sending one or more end marker packets to the corresponding NG_RAN (108) during a handover process of the UE (102).

[0088] In an embodiment, upon triggering a handover procedure of the UE (102) from the S-NG_RAN (108a) to the T-NG_RAN (108b), the method proceeds to step 404. At step 404, the S-NG_RAN (108a) sends a handover initiation request to the S-AMF device (206a). At step 406, upon receiving the handover initiation request, the S-AMF device (206a) selects the T-AMF device (206b), and at step 408, the S-AMF device (206a) initiates the transfer of contexts associated with ongoing communications with the UE (102) to the T-AMF device (206b). The S-AMF device (206a) creates a UEcontext_message request and sends a UEcontext_message request to the target AMF (206b), indicating the handover request from the source AMF device (206a).

[0089] At step 410, the T-AMF device (206b) sends a session update request message (i.e., PDUsession_UpdateSMContext request) to the SMF device (208), requesting to modify the PDU session establishment according to the initiation of the handover process of the UE (102). At step 412, the SMF device (208) selects the T-UPF device (202b) based on the received session update request message.

[0090] At step 414, the SMF device (208) sends a session modification request to the UPF_PSA device (214), and upon receiving the session modification request, the UPF_PSA device (214) switches the PDU session of the UE (102) from the S-UPF device (202a) to the T-UPF device (202b), and at step 416, the UPF_PSA device (214) sends a session modification response to the SMF device (208), indicating that the PDU session is linked to the T-UPF device (202b). At step 418, the SMF device (208) sends a session establishment request to the T-UPF device (202b), indicating a new PDU session connection with the UE (102). At step 420, the T-UPF device (202b) sends a session establishment response indicating confirmation and acceptance of the session establishment request. At step 422, upon receiving the session establishment response, the SMF device (208) sends a session update request response (i.e., a PDUsession_UpdateSMContext response) to the T-AMF device (206b) for the session update request message received from the T-AMF (206b). At step 424, the T-AMF device (206b) supervises the PDU session switching based on the response message received from the SMF device (208) and the UEcontext_message request received from the S-AMF device (206a), and further at step 426, the T-AMF device (206b) sends a switching request to the T-NG_RAN (108b). At step 428, the T-NG_RAN (108b) sends a switching request confirmation indicating acceptance of the switching of the UE (102). Steps 430-440 are similar to steps 410-422; therefore, for the sake of brevity of the specification, the explanation of these steps is omitted. At step 422, the T-AMF device (206b) shares a UEcontext_message response to the S-AMF device (206a) as a response to the received UEcontext_message request, and further indicates the successful transfer of the UE context and PDU session from the S-AMF device (206a) to the T-AMF device (206b).

[0091] exist Figure 4A and Figure 4BIn the method (400) shown, there may be two situations: 1) Consider that one or more network slices (S-NSSAI slices (116)) that have established a PDU session for the UE (102) have been authenticated using the NSSAA procedure and are stored as allowed NSSAA, and no NSSAA procedure is ongoing or pending. 2) Consider that when a handover request is triggered, several NSSAA procedures for one or more S-NSSAI slices (116) are ongoing or pending at the S-AMF device (206a). In the latter case, it is very important to handle the ongoing or pending NSSAA procedures for one or more S-NSSAI slices (116) during the handover process. Figure 5 The steps associated with an ongoing or pending NSSAA process for processing one or more S-NSSAI slices (116) are explained in FIG.

[0092] Figure 5 A flow chart representing the steps of a method (500) for handling an NSSAA procedure during handover of a UE (102) according to an embodiment disclosed herein is shown.

[0093] At step 502, the S-AMF device (206a) receives a trigger for the UE (102) to handover from the S-NG_RAN (108a), indicating that the UE (102) is relocated from the geographical area of ​​the S-NG_RAN (108a) to the geographical area of ​​the T-NG_RAN (108b). At step 504, the S-AMF device (206a) determines whether the handover procedure is an inter-NG_RAN handover procedure. In an inter-NG_RAN procedure, the target NG_RAN (108b) belongs to a different registration area and is associated with different AMF devices and UPF devices.

[0094] At step 506, upon determining that the handover procedure is an inter-NG_RAN handover procedure (also interchangeably referred to as an "inter-AMF handover procedure"), the source AMF device (206a) determines a first list of a plurality of requested NSSAIs (116) having ongoing NSSAA procedures during the handover procedure of the UE (102). In an embodiment, the ongoing or pending NSSAA procedures may indicate that an NSSAA procedure is initiated for the requested NSSAI (116) but a PDU session establishment may be pending for the requested NSSAI (116), or that an NSSAA procedure is not initiated for the requested NSSAI (116).

[0095] At step 508, the S-AMF device (206a) determines whether the T_AMF device (206b) selected for the handover process supports the NSSAA process. If the T_AMF device (206b) supports the NSSAA process, the method (500) follows the steps from (510-514), otherwise the method (500) follows the steps from (516-520).

[0096] At step 510, the S-AMF device (206a) aborts the ongoing NSSAA procedure for the determined first list of multiple requested NSSAI (116). At step 512, the S-AMF device (206a) assigns a pending status to the determined first list of multiple requested NSSAI (116). In an example embodiment, the S-AMF device (206a) may indicate to the AUSF device (210) that the NSSAA procedure for the requested S-NSSAI slice (116a) is aborted by sending a message. The S-AMF device (206a) may also indicate to the AUSF device (210) or the NSSAAF (218) that the NSSAA procedure for the requested S-NSSAI slice (116a) is aborted due to a handover procedure of the UE (102). Upon receiving the message from the S-AMF device (206a), the AUSF device (210) or the NSSAAF (218) sends a message to the AAA-S (222) and indicates that the aborted NSSAA process of the requested S-NSSAI slice (116a) is aborted due to the handover process of the UE (102).

[0097] At step 514, the S-AMF device (206a) sends a UEcontext_message to the target AMF device (206b), which includes the determined first list of the plurality of requested NSSAIs and the pending status of the plurality of requested NSSAIs (116). The pending status of the NSSAA procedure for the plurality of requested NSSAIs (116) is included in the UEcontext_message shared with the T-AMF device (206b). The format of the authentication status of the NSSAA procedure in the UEcontext_message is as follows: Fig. 6A and Figure 6B shown.

[0098] At step 516, the method includes holding, by the source AMF, the handover procedure. At step 518, the method includes completing the NSSAA procedure for a plurality of requested NSSAA I in the first list. At step 520, the method includes initiating and completing the handover procedure.

[0099] Fig. 6AA table (600) of different types indicating authentication states of NSSAA procedures associated with an S-NSSAI slice (116a) according to an embodiment disclosed herein is shown. In an embodiment, row 602 of table 600 shows an "EAP Success" authentication state of an NSSAA procedure performed for an S_NSSAI slice (116a), indicating that the NSSAA procedure was successful, so the S-NSSAI slice (116a) can be included in the UE (102) as an allowed S-NSSAI slice, and the UE (102) can start a PDU session with the service provider via the allowed S-NSSAI slice (116a). Row 604 shows an "EAP Failed" authentication state of an NSSAA procedure performed for an S_NSSAI slice (116a), indicating that the NSSAA procedure was unsuccessful, so the S-NSSAI slice (116a) can be included in the UE (102) as a rejected S-NSSAI slice. Additionally, row 606 illustrates a “pending” authentication status for the NSSAA procedure performed for the S_NSSAI slice (116a), indicating that the NSSAA procedure for the S-NSSAI slice (116a) is still in progress.

[0100] Figure 6B A table (605) is shown representing the NSSAA status of a particular S-NSSAI slice in a UE context message according to an embodiment disclosed herein. In an embodiment, row (608) of table (605) indicates a slice attribute name of an S-NSSAI slice (116a), and row (610) indicates the status of the NSSAA process for the corresponding S-NSSAI (116a).

[0101] Figure 7 A component diagram of an S-AMF device (206a) for handling an ongoing or pending NSSAA procedure during a handover procedure of a UE (102) according to embodiments disclosed herein is shown.

[0102] The S-AMF device (206a) includes a processor (710), a communication interface (720), a memory (730), a database (740), a network slice specific authentication and authorization (NSSAA) controller (750), and a user authentication controller (760). The components of the S-AMF device (206a) provided herein may not be exhaustive, and the S-AMF device (206a) may include more than Figure 7 In addition, two or more components may be embodied in a single component, and / or a component may be configured using multiple subcomponents to achieve the desired functionality. Some components of the S-AMF device (206a) may be configured using hardware elements.

[0103] The processor (710) is coupled to the memory (730), the communication interface (720), the NSSAA controller (750), the user authentication controller (760), and the database (740). The processor (710) is configured to execute instructions stored in the memory (730) and perform various processes. The communication interface (720) is configured to communicate internally between internal hardware components and to communicate with external devices via one or more networks.

[0104] The processor (710) and the NSSAA controller (750) may include one or more processing units (e.g., in a multi-core configuration). The S-AMF device (206a) interacts with external units such as the AUSF device (210), the T-AMF device (206b), the UPF device (202), the AAA-S (222), etc. via a communication interface (720).

[0105] The memory (730) stores instructions to be executed by the processor (710). The memory (730) may include a non-volatile storage element. Examples of such non-volatile storage elements may include a magnetic hard disk, an optical disk, a floppy disk, a flash memory, or a form of an electrically programmable memory (EPROM) or an electrically erasable programmable (EEPROM) memory. In addition, in some examples, the memory (730) may be considered to be a non-transitory storage medium. The term "non-transitory" may indicate that the storage medium is not embodied in a carrier or propagating signal. However, the term "non-transitory" should not be interpreted as meaning that the memory (730) is non-removable. In a specific example, a non-transitory storage medium may store data that may change over time (e.g., in a random access memory (RAM) or a cache). The S-AMF device (206a) is configured to implement the following: Figure 5 A method (500) for handling an ongoing or pending NSSAA procedure during a handover procedure of a UE (102) is provided.

[0106] The processor (710) may also be operably coupled to a database (740). The database (740) is any computer-operated hardware suitable for storing and / or retrieving data. The database (740) may include, but is not limited to, a storage area network (SAN) and / or a network attached storage (NAS) system. In other embodiments, the database (740) may be external to the S-AMF device (206a) and may be accessed by the S-AMF device (206a) using a storage interface. The storage interface is any component capable of providing access to the database (740) to the processor (710).

[0107] In an embodiment, the processor (710) is configured to receive an S-NSSAI slice (116a) access request from a UE (102) and is further configured to authenticate the UE (102) via a user authentication controller (760) to verify user subscription details stored in a database (740) of the S-AMF device (206a).

[0108] In an embodiment, the processor (710) is configured to receive a trigger for a handover procedure for the UE (102) from the S-NG_RAN (108a) via the communication interface (720). The processor (710) is also configured to determine whether the handover procedure is an inter-NG_RAN handover procedure. The processor (710) manages ongoing or pending NSSAA procedures using an NSSAA procedure controller (750) when determining that the handover procedure is an inter-NG_RAN handover procedure. The NSSAA procedure controller (750) includes an NSSAA procedure state tracker (752), an NSSAA procedure management controller (754), and an NSSAA procedure state database (756). When the handover procedure is determined to be an inter-NG_RAN handover procedure, the NSSAA procedure management controller (754) obtains from the NSSAA procedure state tracker (752) a plurality of first lists of a plurality of requested NSSAIs (116) having ongoing NSSAA procedures during the handover procedure of the UE (102). The NSSAA process state tracker (752) is configured to maintain the authentication state of the NSSAA process of the requested NSSAI (116). The requested S-NSSAIs are stored in the NSSAA process state database (756) along with the authentication of their respective NSSAA processes.

[0109] The NSSAA process management controller (754) is further configured to determine whether the T-AMF device (206b) supports the NSSAA process. The NSSAA process management controller (754) is further configured to prioritize one of the handover process or the ongoing NSSAA process based on whether the T-AMF device (206b) supports the NSSAA process. The NSSAA process management controller (754) is configured to give priority to the handover process over the ongoing NSSAA process if the T-AMF device (206b) supports the NSSAA process, otherwise the NSSAA process management controller (754) is configured to hold the handover process and complete the ongoing NSSAA process of the requested S-NSSAI (124). When the T-AMF device (206b) supports the NSSAA process, the NSSAA process management controller (754) maintains the ongoing NSSAA process of the requested S-NSSAI (116) and assigns a pending status to the ongoing NSSAA process of the requested S-NSSAI (116). The list of ongoing NSSAA processes of the requested S-NSSAI (116) with a pending status is updated using the NSSAA process status tracker (752) and the NSSAA process status database (756). The NSSAA process management controller (754) is also configured to generate a UEcontext_message (wherein the UEcontext_message includes a list of ongoing NSSAA processes of the requested S-NSSAI (116) with a pending status) and send the UEcontext_message to the T-AMF device (206b).

[0110] In an example embodiment, the processor (710) of the S-AMF device (206a) may also be configured to indicate to the AUSF device (210) that the NSSAA procedure for the requested S-NSSAI slice (116) is aborted by sending a message. The S-AMF device (206a) may also indicate to the AUSF device (210) that the reason for aborting the NSSAA procedure for the requested S-NSSAI slice (116) is a handover procedure of the UE (102).

[0111] Figure 8 A component diagram of a T-AMF device (206b) for handling an ongoing or pending NSSAA procedure during a handover procedure of a UE (102) according to embodiments disclosed herein is shown.

[0112] The T-AMF device (206b) includes a processor (810), a communication interface (820), a memory (830), a database (840), and a target network slice specific authentication and authorization (NSSAA) controller (850). The components of the T-AMF device (206b) provided herein may not be exhaustive, and the T-AMF device (206b) may include more than Figure 8 In addition, two or more components may be embodied in a single component, and / or a component may be configured using multiple subcomponents to achieve the desired functionality. Some components of the T-AMF device (206b) may be configured using hardware elements.

[0113] The processor (810) is coupled to the memory (830), the communication interface (820), the target NSSAA controller (850), and the database (840). The processor (810) is configured to execute instructions stored in the memory (830) and perform various processes. The communication interface (820) is configured to communicate internally between internal hardware components and to communicate with external devices via one or more networks.

[0114] The processor (810) and the NSSAA controller (850) may include one or more processing units (e.g., in a multi-core configuration). The T-AMF device (206b) interacts with external units such as the AUSF device (210), the S-AMF device (206a), the UPF device (202), the AAA-S (222), etc. via a communication interface (820).

[0115] The memory (830) stores instructions to be executed by the processor (810). The memory (830) may include a non-volatile storage element. Examples of such non-volatile storage elements may include a magnetic hard disk, an optical disk, a floppy disk, a flash memory, or an electrically programmable memory (EPROM) or an electrically erasable programmable (EEPROM) memory. In addition, in some examples, the memory (830) may be considered a non-transitory storage medium. The term "non-transitory" may indicate that the storage medium is not embodied in a carrier or propagation signal. However, the term "non-transitory" should not be interpreted as the memory (830) being non-removable. In some examples, the memory (830) may be configured to store a larger amount of information than memory. In a specific example, a non-transitory storage medium may store data that may change over time (e.g., in a random access memory (RAM) or a cache). The T-AMF device (206b) is configured to implement a method for processing an ongoing or pending NSSAA process after the handover process of the UE (102) is completed.

[0116] The processor (810) may also be operably coupled to a database (840). The database (840) is any computer-operated hardware suitable for storing and / or retrieving data. The database (840) may include, but is not limited to, a storage area network (SAN) and / or a network attached storage (NAS) system. In other embodiments, the database (840) may be external to the T-AMF device (206b) and may be accessed by the T-AMF device (206b) using a storage interface. The storage interface is any component that can provide access to the database (840) to the processor (810).

[0117] In an embodiment, the processor (810) is configured to receive a UEcontext_message from the S-AMF device (206a) and extract a list of pending or ongoing NSSAA procedures for the received S-NSSAI slice (116). The processor (810) initiates the NSSAA procedure for the received S-NSSAI slice (116) that was aborted during the handover procedure of the UE (102) via the target NSSAA procedure controller (850).

[0118] In an embodiment, the processor (810) is further configured to update the status of the NSSAA process based on the authentication result of the NSSAA process after completion via the target NSSAA process controller (850). For example, if the NSSAA process is successful, the authentication status of the NSSAA process is marked as "EAP-Success", and if the NSSAA process is unsuccessful, the authentication status of the NSSAA process is marked as "EAP-Failure". The processor (810) is further configured to update the status of the requested one or more S-NSSAI slices (116) according to the authentication status of their respective NSSAA processes via the target NSSAA process controller (850). For example, for "EAP-Success" of the NSSAA process, the S-NSSAI slice (116a) among the one or more S-NSSAI slices (116) is marked as an allowed S-NSSAI, and for "EAP-Failure" of the NSSAA process, the S-NSSAI slice (116a) among the one or more S-NSSAI slices (116) is marked as a rejected S-NSSAI.

[0119] In an embodiment, the updated status of the NSSAA process and the one or more requested S-NSSAI slices (116) are stored in a database (840). In an embodiment, the updated status of the S-NSSAI is shared with the UE (102) and the S-AMF (206a) via the communication interface (820).

[0120] In an example embodiment, in a case where the authentication status of the NSSAA process of at least one NSSAI is "EAP-Success" or "EAP-Failure", the processor (810) may be further configured to skip the NSSAA process of at least one NSSAI. For example, in a case where the authentication status of the NSSAA process associated with the S-NSSAI slice is "EAP-Success" or "EAP-Failure", the processor (810) may be configured to skip the NSSAA process during the registration process.

[0121] The embodiments disclosed herein may be implemented using at least one hardware device and performing a network management function to control elements.

[0122] Fig. 9 is a flow chart illustrating a method (900) for handling an ongoing or pending NSSAA procedure during handover of a UE (102) according to embodiments disclosed herein. Steps (S902-S908) are performed by a processor (710).

[0123] At S902, the method (900) includes determining a first list of a plurality of requested network slice selection assistance information (NSSAI) (116) having an ongoing NSSAA procedure during a handover procedure of the UE (102).

[0124] At S904, the method (900) includes aborting an ongoing NSSAA procedure of the determined first list of the plurality of requested NSSAA I's due to the handover procedure initiation of the UE (102).

[0125] At S906, the method (900) includes assigning a pending status to the determined plurality of requested NSSAIs of the first list.

[0126] At S908, the method (900) includes sending a message context to the target AMF device (206b), wherein the message context includes the determined first list of the plurality of requested NSSAIs (116) and the pending status of the plurality of requested NSSAIs.

[0127] Fig.10 is a block diagram illustrating a UE according to an embodiment disclosed herein.

[0128] refer to Fig.10 , the UE may include a transceiver 1010, a controller 1020, and a storage unit 1030. In the present disclosure, the controller 1020 may be defined as a circuit, an application specific integrated circuit, or at least one processor.

[0129] The transceiver 1010 may transmit / receive a signal to / from another network entity. For example, the transceiver 1010 may receive a synchronization signal or a reference signal from a base station.

[0130] The controller 1020 can control the overall operation of the UE according to the embodiments of the present disclosure. For example, the controller 1020 can control the signal flow to perform the above Figures 1 to 9 operation of the process.

[0131] The storage unit 1030 may store at least one piece of information transmitted and received by the transceiver 1010 and information generated by the controller 1020. For example, the storage unit 1030 may store information for processing the reference Figures 1 to 9 Information and data describing the NSSAA process.

[0132] Fig.11 is a block diagram illustrating a base station according to an embodiment disclosed herein. The base station may be a NG-RAN (eg, S-NG-RAN, T-NG-RAN).

[0133] refer to Fig.11 , the base station may include a transceiver 1110, a controller 1120, and a storage unit 1130. In the present disclosure, the controller 1120 may be defined as a circuit, an application specific integrated circuit, or at least one processor.

[0134] The transceiver 1110 may transmit / receive a signal to / from another network entity. For example, the transceiver 1110 may transmit a synchronization signal or a reference signal to the UE.

[0135] The controller 1120 can control the overall operation of the base station according to the embodiments of the present disclosure. For example, the controller 1120 can control the signal flow to perform the above Figures 1 to 9 operation of the process.

[0136] The storage unit 1130 may store at least one piece of information transmitted and received by the transceiver 1110 and information generated by the controller 1120. For example, the storage unit 1130 may store information for processing a reference Figures 1 to 9 Information and data describing the NSSAA process.

[0137] Fig.12 is a block diagram illustrating a network entity according to an embodiment disclosed herein. The network entity (function) may be AMF, UPF, SMF, NSSF, NSSAAF, NEF, UDM, AUSF, AAA and / or AS / AF.

[0138] refer to Fig.12, the base station may include a transceiver 1210, a controller 1220, and a storage unit 1230. In the present disclosure, the controller 1220 may be defined as a circuit, an application specific integrated circuit, or at least one processor.

[0139] The transceiver 1210 may transmit / receive a signal to / from another network entity. For example, the transceiver 1210 may transmit / receive data for processing an NSSAA procedure.

[0140] The controller 1220 can control the overall operation of the base station according to the embodiments of the present disclosure. For example, the controller 1220 can control the signal flow to perform the above Figures 1 to 9 operation of the process.

[0141] The storage unit 1230 may store at least one piece of information transmitted and received by the transceiver 1210 and information generated by the controller 1220. For example, the storage unit 1230 may store information for processing the reference Figures 1 to 9 Information and data describing the NSSAA process.

[0142] The various actions, behaviors, blocks, steps, etc. in the flow chart (S900) can be performed in the order presented, in a different order, or simultaneously. In addition, in some embodiments, some actions, behaviors, blocks, steps, etc. can be omitted, added, modified, or skipped without departing from the scope of the present invention.

[0143] Although the present disclosure has been described with various embodiments, various changes and modifications may occur to those skilled in the art. The present disclosure is intended to encompass such changes and modifications as fall within the scope of the appended claims.

Claims

1. A method performed by a source access and mobility management function (AMF) entity in a wireless communication system, the method comprising: receiving a handover required message for initiating an N2-based handover procedure from a source new generation radio access network, NG-RAN; as well as During the N2-based handover process, a message including a network slice specific authentication and authorization NSSAA state list of at least one single network slice selection assistance information S-NSSAI is transmitted to the target AMF entity to indicate that the NSSAA state of the at least one S-NSSAI is pending.

2. The method according to claim 1, in, The NSSAA status list is used by the target AMF entity to determine whether to perform the NSSAA procedure for the at least one S-NSSAI, and Wherein, in a case where the NSSAA process is being performed for the at least one S-NSSAI, the NSSAA status list indicates that the NSSAA status of the at least one S-NSSAI is pending.

3. The method according to claim 2, in, Upon completion of the NSSAA procedure, the at least one S-NSSAI becomes part of one of an allowed NSSAI list or a denied S-NSSAI list.

4. The method of claim 2, wherein: The target AMF entity supports the NSSAA procedure.

5. The method of claim 1, wherein: The NSSAA status list is included in a CreateUEContext request message transmitted from the source AMF to the target AMF entity, and the CreateUEContext request message is used to create a user equipment UE context in the target AMF entity.

6. A source access and mobility management function AMF entity, the source AMF entity comprising: Transceiver; and A controller is coupled to the transceiver and is configured to: receiving a handover required message for initiating an N2 based handover procedure from a source new generation radio access network NG-RAN, and During the N2-based handover process, a message including a network slice specific authentication and authorization NSSAA state list of at least one single network slice selection assistance information S-NSSAI is transmitted to the target AMF entity to indicate that the NSSAA state of the at least one S-NSSAI is pending.

7. The source AMF entity according to claim 6, wherein: The NSSAA status list is used by the target AMF entity to determine whether to perform the NSSAA procedure for the at least one S-NSSAI, and Wherein, in a case where the NSSAA process is being performed for the at least one S-NSSAI, the NSSAA status list indicates that the NSSAA status of the at least one S-NSSAI is pending.

8. The source AMF entity according to claim 7, wherein: Upon completion of the NSSAA procedure, the at least one S-NSSAI becomes part of one of an allowed NSSAI list or a denied S-NSSAI list.

9. The source AMF entity according to claim 7, wherein: The target AMF entity supports the NSSAA procedure.

10. The source AMF entity according to claim 6, wherein: The NSSAA status list is included in a CreateUEContext request message transmitted from the source AMF entity to the target AMF entity, and the CreateUEContext request message is used to create a user equipment UE context in the target AMF entity.

11. A method performed by a target access and mobility management function (AMF) entity in a wireless communication system, the method comprising: receiving, during an N2-based handover procedure, from a source AMF entity a message including a network slice specific authentication and authorization NSSAA state list of at least one single network slice selection assistance information S-NSSAI, to indicate that the NSSAA state of the at least one S-NSSAI is pending; and determining whether to perform an NSSAA procedure for at least one S-NSSAI based on the NSSAA status list, and Wherein, in a case where the NSSAA process is being performed for the at least one S-NSSAI, the NSSAA status list indicates that the NSSAA status of the at least one S-NSSAI is pending.

12. The method of claim 11, wherein: Upon completion of the NSSAA procedure, the at least one S-NSSAI becomes part of one of an allowed NSSAI list or a denied S-NSSAI list.

13. The method of claim 11, wherein: The NSSAA status list is included in a CreateUEContext request message transmitted from the source AMF entity to the target AMF entity, and the CreateUEContext request message is used to create a user equipment UE context in the target AMF entity.

14. A target access and mobility management function AMF entity, the target AMF entity comprising: Transceiver; and A controller is coupled to the transceiver and is configured to: receiving, during an N2-based handover procedure, from a source AMF entity a message including a network slice specific authentication and authorization NSSAA state list of at least one single network slice selection assistance information S-NSSAI to indicate that the NSSAA state of the at least one S-NSSAI is pending, and determining whether to perform an NSSAA procedure for at least one S-NSSAI based on the NSSAA status list, and Wherein, in a case where the NSSAA process is being performed for the at least one S-NSSAI, the NSSAA status list indicates that the NSSAA status of the at least one S-NSSAI is pending.

15. The target AMF entity according to claim 14, wherein: Upon completion of the NSSAA procedure, the at least one S-NSSAI becomes part of one of an allowed NSSAI list or a denied S-NSSAI list.

16. The target AMF entity according to claim 11, wherein: The NSSAA status list is included in a CreateUEContext request message transmitted from the source AMF entity to the target AMF entity, and the CreateUEContext request message is used to create a user equipment UE context in the target AMF entity.

Images