Tunnel establishment for non-seamless WLAN offload

Abstract

Devices, methods, and systems for tunnel establishment for non-seamless WLAN offload are disclosed. An apparatus (400) includes a processor (405) coupled to a transceiver (425), the processor (405) configured to receive (505) a first message indicating that a remote unit (105) requests to connect to a WLAN AN (120) and determine (510) that the remote unit (105) is authorized to connect to the WLAN AN (120). The processor (405) retrieves (515) an allowed service identity of the remote unit (105) and determines (520) a set of tunnel attributes associated with the allowed service identity. Via the transceiver (425), the processor (405) provides (525) the set of tunnel attributes and an indication to the WLAN AN (120) to establish a forced tunnel (130) to a particular data network (150). The WLAN AN (120) then relays all traffic of the remote unit (105) via the forced tunnel (130).

Description

Technical Field

[0001] The subject matter disclosed herein relates generally to wireless communications, and more particularly, to establishing a mandatory tunnel at a wireless local area network ("WLAN") for routing traffic during non-seamless WLAN offload ("NSWO"). Background Art

[0002] In some wireless communication networks, multiple services may be used in the wireless system. In such networks, the network devices may not know which user devices are authorized for such services. Summary of the invention

[0003] Disclosed is a procedure for establishing a compulsory tunnel for NSWO. The procedure may be implemented by a device, a system, a method, or a computer program product.

[0004] A method of NSWO functionality includes receiving a first message indicating that a remote unit requests to connect to the WLAN access network ("WLAN AN") using credentials associated with the mobile communication network, and determining that an authentication server authorizes the remote unit to connect to the WLAN AN. The method includes, in response to determining that the authentication server authorizes the remote unit to connect to the WLAN AN, retrieving an allowed service identity for the remote unit, wherein the allowed service identity identifies a first set of services reachable via the WLAN AN. The method includes determining a set of tunnel attributes associated with the allowed service identity, and providing the set of tunnel attributes to the WLAN AN along with an indication to establish a compulsory tunnel to a first data network and to relay all traffic of the remote unit via the compulsory tunnel, wherein the first data network supports access to the first set of services.

[0005] A method of a WLAN AN includes initiating a NSWO authentication procedure with a remote unit and receiving a network access identifier ("NAI") from the remote unit during the NSWO authentication procedure. Here, the NAI includes a subscriber concealed identity ("SUCI") of the remote unit and an indication of a first set of requested services that will be reachable via the WLAN AN. The method includes sending a first message to an authentication agent in a mobile communication network indicating that the remote unit requests to connect to the WLAN AN using credentials associated with the mobile communication network, wherein the first message includes the SUCI and the indication of the first set of requested services. The method includes receiving a set of tunnel attributes from the authentication agent and establishing a compulsory tunnel using the set of tunnel attributes. The method includes relaying all traffic for the remote unit via the compulsory tunnel.

[0006] A method of a subscriber data management server includes receiving an authentication request including an NSWO indicator and an identity of a remote unit from an authentication server in a mobile communication network. Here, the authentication request indicates that the remote unit attempts to connect to a WLAN AN using a certificate associated with the mobile communication network. The method includes sending an authentication vector of the remote unit to the authentication server. The method includes receiving a subscription data request from an NSWO function and in response to a successful authentication of the remote unit. The method includes sending a subscription data response containing an allowed service identity of the remote unit to the NSWO function, wherein the allowed service identity identifies a first set of services that the remote unit can reach via the WLAN AN. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] A more particular description of the embodiments briefly described above will be presented by reference to specific embodiments illustrated in the accompanying drawings. Understanding that these drawings depict only some embodiments and are therefore not to be considered limiting in scope, the embodiments will be described and explained with additional specificity and detail through the use of the accompanying drawings, in which:

[0008] Figure 1 is a block diagram illustrating one embodiment of a wireless communication system for establishing a compulsory tunnel for NSWO;

[0009] Figure 2A is a call flow diagram illustrating one embodiment of a procedure for a NSWO authentication procedure for data network connectivity;

[0010] Figure 2B yes Figure 2A Continuation of the call flow diagram;

[0011] Figure 2C yes Figure 2A and 2B Continuation of the call flow diagram;

[0012] Figure 3 is a block diagram illustrating one embodiment of a user equipment device that may be used to establish a compulsory tunnel for NSWO;

[0013] Figure 4 is a block diagram illustrating one embodiment of a network device that may be used to establish a compulsory tunnel for NSWO; and

[0014] Figure 5 is a flow chart illustrating one embodiment of a first method for establishing a compulsory tunnel for NSWO;

[0015] Figure 6 is a flow chart illustrating one embodiment of a second method for establishing a compulsory tunnel for NSWO; and

[0016] Figure 7 is a flow chart illustrating one embodiment of a third method for establishing a compulsory tunnel for NSWO. DETAILED DESCRIPTION

[0017] As will be appreciated by those skilled in the art, aspects of the embodiments may be embodied as systems, devices, methods, or program products. Thus, the embodiments may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, microcode, etc.), or an embodiment combining software and hardware aspects.

[0018] For example, the disclosed embodiments may be implemented as hardware circuits including custom very large scale integration ("VLSI") circuits or gate arrays, off-the-shelf semiconductors such as logic chips, transistors, or other discrete components. The disclosed embodiments may also be implemented in programmable hardware devices such as field programmable gate arrays, programmable array logic, programmable logic devices, or the like. As another example, the disclosed embodiments may include one or more physical or logical blocks of executable code that may be organized, for example, as an object, procedure, or function.

[0019] In addition, embodiments may take the form of a program product embodied in one or more computer-readable storage devices storing machine-readable code, computer-readable code, and / or program code (hereinafter referred to as code). The storage device may be tangible, non-transitory, and / or non-transmitting. The storage device may not embody a signal. In some embodiments, the storage device only uses signals to access the code.

[0020] Any combination of one or more computer readable media may be utilized. The computer readable medium may be a computer readable storage medium. The computer readable storage medium may be a storage device storing the code. For example, the storage device may be, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, holographic, micromechanical or semiconductor system, apparatus or device, or any suitable combination of the foregoing.

[0021] More specific examples of storage devices (a non-exhaustive list) would include the following: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory ("RAM"), a read-only memory ("ROM"), an erasable programmable read-only memory ("EPROM" or flash memory), a portable compact disk read-only memory ("CD-ROM"), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a computer-readable storage medium may be any tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device.

[0022] The code for carrying out the operations of the embodiments may be any number of lines and may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Python, Ruby, Java, Smalltalk, C++, or the like, as well as conventional procedural programming languages ​​such as the "C" programming language or the like, and / or machine languages ​​such as assembly languages. The code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter case, the remote computer may be connected to the user's computer through any type of network, including a local area network ("LAN"), a wireless LAN ("WLAN"), or a wide area network ("WAN"), or may be connected to an external computer (e.g., through the Internet using an Internet Service Provider ("ISP")).

[0023] In addition, the described features, structures or characteristics of the embodiments may be combined in any suitable manner. In the following description, numerous specific details, such as examples of programming, software modules, user selections, network transactions, database queries, database structures, hardware modules, hardware circuits, hardware chips, etc., are provided to provide a thorough understanding of the embodiments. However, those skilled in the relevant art will recognize that the embodiments may be practiced without one or more of the specific details, or with other methods, components, materials, etc. In other cases, well-known structures, materials, or operations are not shown or described in detail to avoid confusing aspects of the embodiments.

[0024] In this specification, reference to "one embodiment", "embodiment" or similar language means that a particular feature, structure or characteristic described in conjunction with the embodiment is included in at least one embodiment. Therefore, unless otherwise expressly provided, the phrases "in one embodiment", "in an embodiment" and similar language appearing throughout this specification may but do not necessarily refer to the same embodiment, but rather mean "one or more but not all embodiments". Unless otherwise expressly provided, the terms "comprising", "including", "having" and their variations mean "including but not limited to". Unless otherwise expressly provided, a list of enumerated items does not mean that any or all items are mutually exclusive. Unless otherwise expressly provided, the terms "a / an" and "said" also mean "one or more".

[0025] As used herein, a list with the conjunction "and / or" includes any single item in the list or a combination of items in the list. For example, a list of A, B, and / or C includes only A, only B, only C, a combination of A and B, a combination of B and C, a combination of A and C, or a combination of A, B, and C. As used herein, a list using the term "one or more of..." includes any single item in the list or a combination of items in the list. For example, one or more of A, B, and C includes only A, only B, only C, a combination of A and B, a combination of B and C, a combination of A and C, or a combination of A, B, and C. As used herein, a list using the term "one of..." includes one and only one of any single item in the list. For example, "one of A, B, and C" includes only A, only B, or only C, and does not include a combination of A, B, and C. As used herein, "a member selected from a group consisting of A, B, and C" includes one and only one of A, B, or C, and does not include a combination of A, B, and C. As used herein, "a member selected from the group consisting of A, B and C and combinations thereof" includes only A, only B, only C, a combination of A and B, a combination of B and C, a combination of A and C, or a combination of A, B and C.

[0026] Aspects of the embodiments are described below with reference to schematic flow charts and / or schematic block diagrams of the methods, devices, systems, and program products according to the embodiments. It will be understood that each block of the schematic flow charts and / or schematic block diagrams and the combination of blocks in the schematic flow charts and / or schematic block diagrams can be implemented by code. This code can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine, so that instructions executed by the processor of the computer or other programmable data processing device create a way to implement the functions / actions specified in the flow charts and / or block diagrams.

[0027] The code may also be stored in a storage device that can direct a computer, other programmable data processing apparatus or other apparatus to function in a specific manner so that the instructions stored in the storage device produce an article of manufacture containing instructions for implementing the functions / actions specified in the flowchart and / or block diagram.

[0028] The code may also be loaded onto a computer, other programmable data processing device or other apparatus to cause a series of operational steps to be executed on the computer, other programmable device or other apparatus to produce a computer-implemented process, so that the code executed on the computer or other programmable device provides a process for implementing the functions / actions specified in the flowchart and / or block diagram.

[0029] The call flow diagrams, flowcharts, and / or block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of devices, systems, methods, and program products according to various embodiments. In this regard, each box in the flowcharts and / or block diagrams may represent a code module, code segment, or code portion, which includes one or more executable instructions of code for implementing a specified logical function.

[0030] It should also be noted that in some alternative implementations, the functions noted in the blocks may not occur in the order noted in the drawings. For example, two blocks shown in succession may in fact be executed substantially simultaneously, or the blocks may sometimes be executed in the reverse order, depending on the functionality involved. Other steps and methods are contemplated that are equivalent in function, logic, or effect to one or more blocks, or portions thereof, of the illustrated drawings.

[0031] Although various arrow types and line types may be used in call flow diagrams, flow charts, and / or block diagrams, it should be understood that they do not limit the scope of the corresponding embodiments. In fact, some arrows or other connectors may be used to indicate only the logical flow of the depicted embodiments. For example, arrows may indicate waiting or monitoring periods of unspecified duration between enumerated steps of the depicted embodiments. It will also be noted that each module of the block diagram and / or flow chart and the combination of blocks in the block diagram and / or flow chart may be implemented by a dedicated hardware-based system or a combination of dedicated hardware and code that performs a specified function or action.

[0032] The description of an element in each figure may refer to an element in a previous figure. Like numbers refer to like elements in all figures, including alternative embodiments of like elements.

[0033] In general, the present disclosure describes systems, methods, and devices for establishing a compulsory tunnel for NSWO. In some embodiments, the methods may be performed using computer code embedded on a computer-readable medium. In some embodiments, a device or system may include a computer-readable medium containing computer-readable code, which, when executed by a processor, causes the device or system to perform at least a portion of the solution described below.

[0034] A user device (e.g., user equipment ("UE")) may connect to a WLAN AN for NSWO using credentials of a mobile core network (e.g., a fifth generation core network ("5GC network")). The UE's IP traffic is offloaded directly to the WLAN AN and does not traverse the mobile core network. However, currently, the mobile core network—which authenticates the user device—is unable to define services and / or networks that are available to the user device via the WLAN AN.

[0035] Disclosed herein are enhancements to the NSWO authentication procedure that enable the 5GC network to specify services that should be reachable by the UE after the NSWO authentication procedure, and to provide tunneling information to the AN for creating a mandatory tunnel to a data network that provides these services. These enhancements may further enable the UE to provide a "hint" to the 5GC network indicating the services that the UE wishes to access after NSWO authentication. By using the novel enhancements disclosed herein, the 5GC network may not only authenticate the UE and authorize its connection to the WLAN AN, but it may also configure the WLAN AN to tunnel the UE traffic to the data network that provides the services that the UE should access via the WLAN AN.

[0036] Figure 1 A wireless communication system 100 for establishing a compulsory tunnel for NSWO according to an embodiment of the present disclosure is depicted. In one embodiment, the wireless communication system 100 includes at least one remote unit 105, a WLAN access network 120 including at least one access point 121, and a mobile core network 140. The WLAN access network 120 and the mobile core network 140 may form a mobile communication network. In some embodiments, the mobile communication network may further include a third generation partnership project ("3GPP") access network (not depicted) including at least one cellular base unit. The remote unit communicates with the WLAN access network 120 using a wireless communication link 123.

[0037] although Figure 1 Although a specific number of remote units 105, WLAN access networks 120, access points 121, wireless communication links 123, and mobile core networks 140 are depicted in the figure, technicians in the field will recognize that any number of remote units 105, WLAN access networks 120, access points 121, wireless communication links 123, and mobile core networks 140 may be included in the wireless communication system 100.

[0038] In one embodiment, the WLAN access network 120 complies with or the Institute of Electrical and Electronics Engineers ("IEEE") 802.11 family of standards. However, more generally, the wireless communication system 100 may implement some other open or proprietary communication network, such as the Worldwide Interoperability for Microwave Access ("WiMAX") or other networks such as the IEEE 802.16 family of standards. The present disclosure is not intended to be limited to implementation of any particular wireless communication system architecture or protocol.

[0039] In one embodiment, the remote unit 105 may include a computing device, such as a desktop computer, a laptop computer, a personal digital assistant ("PDA"), a tablet computer, a smart phone, a smart TV (e.g., a TV connected to the Internet), a smart appliance (e.g., an appliance connected to the Internet), a set-top box, a game console, a security system (including a security camera), a car computer, a network device (e.g., a router, a switch, a modem), or the like. In some embodiments, the remote unit 105 includes a wearable device, such as a smart watch, a fitness band, an optical head-mounted display, or the like.

[0040] In addition, the remote unit 105 may be referred to as a UE, a subscriber unit, a mobile device, a mobile station, a user, a terminal, a mobile terminal, a fixed terminal, a subscriber station, a user terminal, a wireless transmit / receive unit ("WTRU"), a device, or other terms used in the art. In various embodiments, the remote unit 105 includes a subscriber identity and / or identification module ("SIM") and a mobile equipment ("ME") that provides mobile terminal functions (e.g., radio transmission, switching, speech encoding and decoding, error detection and correction, signaling, and access to the SIM). In certain embodiments, the remote unit 105 may include terminal equipment ("TE") and / or be embedded in an appliance or device (e.g., a computing device, as described above).

[0041] The remote unit 105 may communicate directly with one or more of the access points 121 in the WLAN access network 120 via uplink (“UL”) and downlink (“DL”) communication signals. The UL and DL communication signals may be carried via the wireless communication link 123. In addition, the UL communication signals may include one or more uplink channels, such as a physical uplink control channel (“PUCCH”) and / or a physical uplink shared channel (“PUSCH”), and the DL communication signals may include one or more downlink channels, such as a physical downlink control channel (“PDCCH”) and / or a physical downlink shared channel (“PDSCH”). Here, the WLAN access network 120 is an intermediate network that provides the remote unit 105 with access to the data network 150, such as via non-seamless WLAN offload. In other embodiments, the WLAN access network 120 may provide the remote unit 105 with access to the mobile core network 140.

[0042] In some embodiments, the remote unit 105 communicates with a host (e.g., an application server) in the data network 150 by offloading directly to the WLAN access network 120 without registering with the mobile core network 140 and without establishing a network connection with the mobile core network 140. In various embodiments, the WLAN access network 120 establishes a compulsory tunnel 130 to an endpoint in the data network 150 to provide the remote unit 105 with an allowed set of services, as described in more detail below.

[0043] However, in other embodiments, the remote unit 105 may communicate with a host in the data network 150 via a network connection with the mobile core network 140. For example, an application in the remote unit 105 (e.g., a web browser, a media client, a telephone / Voice over Internet Protocol (“VoIP”) application) may trigger the remote unit 105 to establish a protocol data unit (“PDU”) session (or other data connection) with the mobile core network 140 via an access network in the WLAN access network 120. The mobile core network 140 then relays traffic between the remote unit 105 and the remote host using, for example, the PDU session. The PDU session represents a logical connection between the remote unit 105 and a user plane function (“UPF”) 141.

[0044] The access points 121 may be distributed over a geographic area. In some embodiments, the access points 121 may also be referred to as access terminals, base units, base stations, relay nodes, radio access network ("RAN") nodes, or by any other terminology used in the art. The access points 121 are typically part of a RAN, such as a WLAN access network 120, which may include one or more controllers communicatively coupled to one or more corresponding access points 121. These and other elements of a radio access network are not illustrated but are well known to those of ordinary skill in the art. The access points 121 are connected to the mobile core network 140 via the WLAN access network 120.

[0045] The access point 121 can serve a number of remote units 105 within a service area via a wireless communication link 123. The access point 121 can communicate directly with one or more of the remote units 105 via communication signals. In general, the access point 121 transmits DL communication signals in the time domain, frequency domain, and / or spatial domain to serve the remote units 105. In addition, the DL communication signals can be carried by the wireless communication link 123. The wireless communication link 123 can be any suitable carrier in a licensed or unlicensed radio spectrum. The wireless communication link 123 facilitates communication between one or more of the remote units 105 and / or one or more of the access points 121.

[0046] As depicted, the WLAN access network 120 may include an authentication, authorization, and accounting ("AAA") proxy 125 for establishing a SWa connection with a NSWO network function ("NSWO NF") 145 in the mobile core network 140. The SWa interface (described in 3GPP Technical Specification ("TS") 29.273) is used for 3GPP-based access authentication and authorization for untrusted non-3GPP IP access. Thus, the remote unit 105 may authenticate to the WLAN access network 120 using a certificate (e.g., a 5G certificate) corresponding to the mobile core network 140.

[0047] In some embodiments, WLAN access network 120 may be connected to mobile core network 140 via an interworking function (not depicted) that provides interworking between remote unit 105 and mobile core network 140. For example, the interworking function may support connection to mobile core network 140 via "N2" and "N3" interfaces, and it may relay "N1" signaling between remote unit 105 and service access and mobility management function ("AMF") 143. The interworking function also communicates with UPF 141 using the "N3" interface. Examples of such an interworking function include a non-3GPP interworking function ("N3IWF") and / or a trusted non-3GPP gateway function ("TNGF") as defined in 3GPP.

[0048] In one embodiment, mobile core network 140 is a 5G core network ("5GC") or an evolved packet core ("EPC"), which may be coupled to data network 150, such as the Internet and private data networks, among other data networks. Remote unit 105 may have a subscription or other account with mobile core network 140. In various embodiments, each mobile core network 140 belongs to a single mobile network operator ("MNO") and / or public land mobile network ("PLMN"). The present disclosure is not intended to be limited to implementation of any particular wireless communication system architecture or protocol.

[0049] The mobile core network 140 includes several network functions ("NFs"). As depicted, the mobile core network 140 includes at least one UPF 141. The mobile core network 140 also includes a plurality of control plane ("CP") functions, including but not limited to an AMF 143, a session management function ("SMF") 146, an authentication server function ("AUSF") 147, a unified data management function ("UDM"), and a user data repository ("UDR"). In some embodiments, the UDM is co-located with the UDR, depicted as a combined entity "UDM / UDR" 149. Although Figure 1 Although a specific number and type of network functions are depicted in FIG. 1 , those skilled in the art will recognize that any number and type of network functions may be included in the mobile core network 140.

[0050] UPF 141 is responsible for packet routing and forwarding, packet inspection, QoS handling, and external PDU sessions for interconnected packet data networks ("PDNs") in the fifth generation ("5G") architecture. AMF 143 is responsible for terminating non-access spectrum ("NAS") signaling, NAS encryption and integrity protection, registration management, connection management, mobility management, access authentication and authorization, security context management. SMF 146 is responsible for session management (i.e., session establishment, modification, release), remote unit (i.e., UE) Internet Protocol ("IP") address allocation and management, DL data notification, and service-oriented configuration of UPF 141 for appropriate service routing.

[0051] NSWO NF 145 (also referred to as NSWO function ("NSWOF")) is a new functional element in the 5G network architecture, which interfaces with the WLAN access network 120 (via the SWa interface) and operates as an AAA proxy that interacts with the AUSF 147 in the mobile core network 140. NSWO NF 145 provides interworking functionality that enables communication between the WLAN access network 120 and the AUSF 147.

[0052] The AUSF 147 acts as an authentication server and / or authentication proxy, thereby allowing the remote unit 105 to authenticate via the AMF 143 or the WLAN access network 120. The UDM is responsible for generating authentication and key agreement ("AKA") certificates (e.g., Extensible Authentication Protocol Method for Third Generation Authentication and Key Agreement (EAP-AKA) certificates or Improved Extensible Authentication Protocol Method for Third Generation Authentication and Key Agreement (EAP-AKA) certificates), user identity handling, access authorization, subscription management. The UDR is a repository of subscriber information and can be used to serve several network functions. For example, the UDR can store subscription data, policy-related data, subscriber-related data that allows exposure to third-party applications, and the like.

[0053] In various embodiments, the mobile core network 140 may also include a network repository function ("NRF") (which provides network function ("NF") service registration and discovery, enabling NFs to identify appropriate services in each other and communicate with each other through application programming interfaces ("APIs")), a network exposure function ("NEF") (which is responsible for making it easy for customers and network partners to access network data and resources), a policy control function ("PCF") (which is responsible for unifying the policy framework, providing policy rules for CP functions, accessing subscription information for policy decisions in UDR), or other NFs defined for 5GC. In some embodiments, the mobile core network 140 may include an AAA server.

[0054] In various embodiments, the mobile core network 140 supports different types of mobile data connections and different types of network slices, where each mobile data connection utilizes a specific network slice. Here, a "network slice" refers to a portion of the mobile core network 140 that is optimized for a specific type of business or communication service. For example, one or more network slices may be optimized for an enhanced mobile broadband ("eMBB") service. As another example, one or more network slices may be optimized for an ultra-reliable low-latency communication ("URLLC") service. In other examples, network slices may be optimized for machine type communication ("MTC") services, massive MTC ("mMTC") services, Internet of Things ("IoT") services. In yet other examples, network slices may be deployed for specific application services, vertical services, specific use cases, and the like.

[0055] A network slice instance may be identified by a single network slice selection assistance information ("S-NSSAI"), while a set of network slices that a remote unit 105 is authorized to use is identified by a network slice selection assistance information ("NSSAI"). Here, "NSSAI" refers to a vector value that includes one or more S-NSSAI values. In some embodiments, various network slices may include separate instances of network functions, such as SMF 146 and UPF 141. In some embodiments, different network slices may share some common network functions, such as AMF 143. For ease of illustration, Figure 1 The different network slices are not shown in , but their support is assumed.

[0056] Although Figure 1 Components of a WLAN access network (“WLAN AN”) and a 5G core (“5GC”) network are depicted, but the described embodiments for establishing a mandatory tunnel for NSWO are applicable to other types of communication networks and RATs, including 3GPP New Radio (“NR”), 3GPP Long Term Evolution (“LTE”), Global System for Mobile Communications (“GSM”, i.e., 2G digital cellular network), General Packet Radio Service (“GPRS”), Universal Mobile Telecommunications System (“UMTS”), LTE variants, CDMA2000, Bluetooth, ZigBee, Sigfox, and the like.

[0057] Furthermore, in LTE variants where the mobile core network 140 is an EPC, the depicted network functions may be replaced with appropriate EPC entities, such as a mobility management entity ("MME"), a serving gateway ("SGW"), a PDN gateway ("PGW"), a home subscriber server ("HSS"), and the like. For example, the AMF 143 may be mapped to the MME, the SMF 146 may be mapped to the control plane portion of the PGW and / or to the MME, the UPF 141 may be mapped to the SGW and the user plane portion of the PGW, the UDM / UDR 149 may be mapped to the HSS, and the like.

[0058] In the following description, the term "AP" may be used for an access point, but it may be replaced by any other radio access node, such as a RAN node, a base station ("BS"), a transmission and reception point ("TRP"), etc. In addition, the term "UE" is used for a mobile station / remote unit, but it may be replaced by any other remote device, such as a remote unit, MS, ME, etc. In addition, the operations are mainly described in the context of a 5GC network. However, the solutions / methods described below are also applicable to other mobile communication systems for establishing a mandatory tunnel for NSWO.

[0059] The 3GPP Rel-17 specification was recently enhanced to support WLAN connections using 5G certificates without 5G system ("5GS") registration. Essentially, a new procedure is specified that enables a UE to connect to a WLAN AN using its 5G certificates without the UE registering with the 5GC network. This procedure is called the Non-Seamless WLAN Offload ("NSWO") authentication procedure.

[0060] After the NSWO authentication procedure is successfully completed, the UE is connected to the WLAN AN and can start IP communication using this WLAN AN. The UE's IP traffic is directly offloaded to the WLAN AN and does not pass through the 5GC network. The 5GC network is only used to authenticate the UE and authorize its connection to the WLAN AN.

[0061] However, in many scenarios, the 5GC network does not only want to authenticate the UE and authorize its connection to the WLAN AN. It also wants to define which data network the UE should be able to reach after a successful NSWO authentication procedure. The data network that the UE can reach determines the services available to the UE after connecting to the WLAN AN.

[0062] For example, the 5GC network may want the UE to access IP Multimedia System ("IMS") services after connecting to the WLAN AN, which are provided via the first data network. Or the 5GC network may want the UE to access edge computing services after connecting to the WLAN AN, which are provided via the second data network. Or the 5GC network may want the UE to access some IoT services after connecting to the WLAN AN, which are provided via the third data network.

[0063] Currently, there is no support for this requirement, i.e., enabling the 5GC network to specify which data network the UE should be able to reach after a successful NSWO authentication. However, by using the novel enhancements of the present disclosure, the 5GC network can not only authenticate the UE and authorize its connection to the WLAN AN, but it can also configure the WLAN AN to tunnel the UE traffic to the data network that provides the services that the UE should be able to access via the WLAN AN.

[0064] Disclosed herein are procedures and example implementations for establishing a compulsory tunnel between the WLAN access network 120 and the data network 150 for relaying all data traffic between the UE (e.g., remote unit 105) to the data network 150. The compulsory tunnel is selected by the mobile core network 140, thereby enabling the UE to reach all services accessible via the data network 150.

[0065] The UE selects and connects to a WLAN AN (e.g., WLAN access network 120) using a 5G certificate maintained in the UE (e.g., in a Universal Subscriber Identity Module (“USIM”) module) and in the mobile core network 140. After a successful NSWO authentication procedure, the UE is authorized to connect to the WLAN access network 120, wherein the UE and the AUSF 147 in the mobile core network 140 mutually authenticate each other.

[0066] It should be noted that the WLAN access network 120 must support the SWa interface with the mobile core network 140, which is used during the NSWO authentication procedure. In a typical scenario, before the UE attempts to connect to the WLAN access network 120 using its 5G certificate, the UE discovers that the WLAN access network 120 supports AAA interworking with the mobile core network 140, which means that it supports the SWa interface with the mobile core network 140.

[0067] After the UE connects to the WLAN access network 120 using its 5G certificate, a mandatory tunnel is created between the WLAN access network 120 and the data network 150 selected by the mobile core network 140. This tunnel is used to relay all data traffic between the UE to the data network 150, and thus enables the UE to reach all services accessible via the data network 150.

[0068] Figures 2A to 2CA procedure 200 is depicted for enabling a 5GC network to specify data networks that should be reachable after a UE successfully authenticates to a WLAN AN during a NSWO authentication procedure in accordance with an embodiment of the present disclosure. The procedure 200 involves a UE 201 (e.g., an embodiment of a remote unit 105) having a set of 5G credentials, a WLAN AN 203 (e.g., an embodiment of a WLAN access network 120), and a 5G core network 205 (e.g., a public or non-public network), which contains a NSWOF 207 (e.g., an embodiment of a NSWO NF 145), an AUSF 209 (e.g., an embodiment of an AUSF 147), a UDM 211 (e.g., an embodiment of a UDM / UDR 149), a N3IWF 209 (e.g., one embodiment of an interworking function 137), and an NRF 213. After successful NSWO authentication of the UE 201, the WLAN AN 203 establishes a mandatory tunnel with a data network 215 that provides allowed services for NSWO, as described in more detail below. Data network 215 contains at least a tunnel server or virtual private network ("VPN") server (depicted as "Tunnel / VPN server" 217), a dynamic host configuration program ("DHCP") server 219, and an application server (depicted as "Application server 221").

[0069] from Figure 2A Initially, the process 200 begins at step 0a (see block 225) when the UE 201 discovers an access network ("AN") and determines, using known procedures, that it supports AAA interworking with a 5G core network (aka "home" network) that holds credentials used to authenticate the UE. This 5G core network may be a public network (e.g., a PLMN) or a non-public network, such as a standalone non-public network ("SNPN"). As an example, the AN may advertise that it supports AAA interworking with one or more networks using the Access Network Query Protocol ("ANQP"). ANQP is a query and response protocol that can be used to define services provided by an access point ("AP") in a WLAN AN.

[0070] At step 0b, after deciding to connect to this access network using its 5G credentials, UE 201 proceeds to establish a layer 2 connection with WLAN AN 203 (see signaling 227). In the case where the access network is a WLAN AN, the layer 2 connection is an IEEE 802.11 association.

[0071] At step 1a, WLAN AN 203 initiates a non-seamless WLAN offload authentication procedure 229 and requests the identity of UE 201 (see signaling 231). This NSWO authentication procedure 229 applies Extensible Authentication Protocol (“EAP”) for mutual authentication of UE 201 and 5G core network 205.

[0072] At step 1b, the UE provides its Network Access Identifier (“NAI”), which contains the Subscriber Concealed Identity (“SUCI”) formatted as a network-specific identifier (see Signaling 233). In some embodiments, the UE 201 may “decorate” the NAI by including a service identity parameter (depicted as “service_ID1” in Figure 2A ), which specifies a set of services that will be reachable via the AN and requested by the UE 201.

[0073] As an example, the parameter service_ID1 may take the values “ims” or “internet” to indicate that the UE 201 requests access to the IMS service or the Internet, respectively, after connecting to the WLAN AN 203. It should be noted that service_ID1 is an optional element and provides a suggestion to the network for determining the services that the UE 201 should be reachable via the WLAN AN 203. Although Figures 2A to 2C the term “service identity” is used, alternatively, the hint / suggestion provided by the UE 201 may also be referred to as “connection capabilities”.

[0074] An example of the decorated NAI is as follows: “ims!type1.rid678.schid1.hnkey27.ecckey<ECC (Elliptic Curve Cryptography) temporary public key>.cip<user encryption 17>.mac<MAC tag value>@example.com”. It should be noted that the SUCI element of the NAI includes the concealed username (i.e., “type1.rid678.schid1.hnkey27.ecckey.cip.mac”) and the domain (i.e., “example.com”) that identifies the network (in this case, the illustrated 5G core network 205) that should participate in the NSW0 authentication procedure.

[0075] At step 3a, the WLAN AN 203 resolves the domain to an IP address (e.g., using the Domain Name System (“DNS”) procedure) and sends a SWa access request message to this IP address, which belongs to the NSW0F 207 in the 5G core network 205 (see Signaling 235). Here, the NSW0F 207 may act as a Service-Based Interface (“SBI”) AAA proxy between the AUSF 209 and the WLAN AN 203.

[0076] At step 3b, NSWOF 207 sends a first authentication request message (e.g., Nausf_UEAuthentication_Authenticate or Nausf_UEAuthentication_NSWOAuthenticate request message) to AUSF 209, which contains SUCI, serving network name, and NSWO indicator (see signaling 237). NSWO_indicator is used to indicate to AUSF 209 that the authentication request is for NSWO purposes. In some embodiments, NSWOF 207 may set the serving network name to "5G:NSWO".

[0077] At step 4a, AUSF 209 (acting as an EAP authentication server) sends a second authentication request message (eg, Nudm_UEAuthentication_Get or Nudm_UEAuthentication_GetNSWO request message) to UDM 211, which also contains the SUCI and NSWO indicator (see signaling 239).

[0078] At step 4b, upon receiving the Nudm_UEAuthentication_Get request (alternatively, Nudm_UEAuthentication_GetNSWO request), the UDM 211 selects the EAP-AKA′ authentication method based on the NSWO indicator. In some embodiments, the UDM 211 calls the Authentication Credentials Repository Processing function (“ARPF”) to select the authentication method. In some embodiments, the UDM 211 may call the Subscriber Identity De-hiding function (“SIDF”) to de-hide the SUCI to obtain the corresponding Subscriber Permanent Identity (“SUPI”) before the UDM may process the request.

[0079] In addition, UDM 211 generates an EAP-AKA' authentication vector ("AV") and may include the SUPI to the AUSF in the Nudm_UEAuthentication_Get response message. It should be noted that UDM 211 may call the ARPF to generate the EAP-AKA' AV. In various embodiments, the EAP-AKA' AV contains the following parameters: RAND (random number / random number), AUTN (authentication token), XRES (expected / correct result), CK' (cipher key), and IK' (integrity key). UDM 211 transmits a first authentication response message (e.g., Nudm_UEAuthentication_Get or Nudm_UEAuthentication_GetNSWO response message) to AUSF 209, which contains the EAP-AKA' AV and SUPI (see signaling 241). AUSF 209 stores the XRES for future authentication.

[0080] At step 5a, AUSF 209 sends an EAP-Request / AKA'-Challenge message in a Nausf_UEAuthentication_Authenticate Response message (alternatively, a Nausf_UEAuthentication_NSWOAuthenticate Response message) to NSWOF 207 (see signaling 243). Here, RAND and AUTN are delivered in the EAP-Request / AKA'-Challenge message.

[0081] At step 5b, the NSWOF 207 sends an EAP-Request / AKA'-Challenge message to the WLAN AN 203 via the SWa interface (see signaling 245).

[0082] At step 5c, the WLAN AN 207 forwards the EAP-Request / AKA'-Challenge message to the UE 201 (see signaling 247).

[0083] continue Figure 2B, at step 5d, UE 201 calculates an authentication response (see box 249). For example, upon receiving the RAND and AUTN in the EAP-Request / AKA'-Challenge message, the ME of UE 201 constructs the serving network name by setting the serving network name to "5G:NSWO", and the USIM in UE 201 verifies the freshness of AV', for example, by checking whether AUTN is acceptable, as described in TS 33.102. If so, the USIM calculates RES (response). The USIM returns RES, CK, IK to the ME, and the ME derives CK' and IK'. UE 201 can derive the master session key ("MSK") from CK' and IK', as described in Internet Engineering Task Force ("IETF") Request for Comments ("RFC") 5448. It should be noted that when UE 201 is performing NSWO authentication, the key KAUSF is not generated by UE 201.

[0084] At step 5e, UE 201 sends an EAP-Response / AKA′-Challenge message to WLAN AN 203 (see signaling 251). It should be noted that the EAP-Response / AKA′-Challenge message contains the RES generated by UE 201.

[0085] At step 5f, WLAN AN 203 forwards the EAP-Response / AKA'-Challenge message to NSWOF 207 via the SWa interface (see signaling 253).

[0086] At step 5g, the NSWOF 207 sends a Nausf_UEAuthentication_Authenticate Request with an EAP-Response / AKA'-Challenge message to the AUSF 209 (see signaling 255).

[0087] At step 5h, AUSF 209 verifies whether the received response RES matches the stored and expected response XRES (see box 255). If so, AUSF 209 has successfully authenticated UE 201, and it continues to step 6 as follows; otherwise, AUSF 209 returns an error to NSWOF 207. AUSF 209 derives the required MSK key from CK' and IK' based on the NSWO indicator received in step 5 (e.g., as described in IETF RFC 5448). It should be noted that AUSF 209 does not generate the key KAUSF when UE 201 is performing NSWO authentication.

[0088] At step 6, the AUSF 209 sends a Nausf_UEAuthentication_Authenticate response message (see signaling 257) with an EAP-Success packet and the MSK key to the NSWOF 207. The AUSF 209 may optionally provide the SUPI to the NSWOF 207. The message in step 6 indicates that the AUSF has successfully authenticated the UE 201.

[0089] NSWOF 207 does not immediately send a SWa Access Accept message, as defined in 3GPP TS 33.501 Annex S. Instead, NSWOF 207 sends this message later (in step 9a) after receiving a set of tunnel attributes that specify how WLAN AN 203 can establish a mandatory tunnel to a data network that provides a service (e.g., "ims") to be used by UE 201 via WLAN AN 203.

[0090] At step 7a, NSWOF 207 sends a request message to UDM 211 requesting "Allowed Services for NSWO" (see signaling 261) for UE 201. This message includes the identity of UE 201 (e.g., SUPI), and optionally the identity of WLAN AN 203 (e.g., AN ID) and the service identity requested by UE 201 (service_ID1), if this was provided in step 1b.

[0091] In step 7b, UDM 211 determines the "allowed services for NSWO" for UE 201 by using one or more of the following: configuration information, UE subscription data, AN ID, and the service identity requested by UE 201 (i.e., service_ID1) (see box 263). The provision of AN ID makes it possible for UDM 211 to select different "allowed services for NSWO" for different ANs.

[0092] In step 7c, NSWOF 207 receives a response message from UDM 211, the message including a parameter "NSWO's Allowed Services" (in Figure 2B 265). It should be noted that in several cases, service_ID2 will be the same as service_ID1, ie, the "allowed services for NSWO" will be the same as the "requested services for NSWO".

[0093] continue Figure 2CAt step 8, the NSWOF 207 determines a set of tunnel attributes corresponding to the received "NSWO allowed services" (service_ID2). This determination may be done using configuration information in the NSWOF 207 or by querying the network repository function ("NRF") 213 in the 5G core network 205, as described in Figure 2C As shown in .

[0094] At step 8a, in the latter case, NSWOF 207 sends a request message containing the "NSWO's allowed services" parameter (i.e., service_ID2) to NRF 213 (see signaling 267). At step 8b, NSWOF 207 receives a response message from NRF 213, the response message having the set of tunnel attributes corresponding to the "NSWO's allowed services" (see signaling 269).

[0095] The set of tunnel attributes contains parameters that can be used by the AN to establish a compulsory tunnel to the data network and then relay all UE traffic through this compulsory tunnel. Figure 2C Several such parameters are described, such as tunnel-type, tunnel-media-type, tunnel-client-endpoint, etc. In some embodiments, the types and values ​​of the tunnel attributes may include the types and values ​​defined in IETF RFC 2868 for the RADIUS protocol.

[0096] At step 9a, NSWOF 207 continues the NSWO authentication procedure and sends a SWa Access Accept message to WLAN AN 203 via the SWa interface (see signaling 271). Here, the Access Accept message includes the EAP-Success Packet and the MSK (received in step 6), and also includes the received tunnel attributes. It should be noted that the existing NSWO authentication procedure specified in 3GPP TS 33.501 does not include such tunnel attributes in the SWa Access Accept message.

[0097] At step 9b, WLAN AN 203 sends an EAP-Success message to UE 201, and UE 201 successfully completes the NSWO authentication procedure 229 (see signaling 273).

[0098] At step 9c, UE 201 and WLAN AN 203 apply the common MSK to derive keys for protecting unicast and broadcast traffic over the air interface (if not previously derived), and establish air interface security for NSWO, for example, by establishing a secure connection using the 4-way handshake specified in IEEE 802.11X (see signaling 275).

[0099] At step 10, WLAN AN 203 applies the received tunnel attributes to establish a compulsory tunnel 283 (see signaling 277), and then relays all traffic of UE 201 via this compulsory tunnel. The endpoint of this compulsory tunnel 283 is typically located at a tunnel / VPN server 217 in the data network 215, which provides the allowed services for UE 201.

[0100] At step 11, UE 201 receives IP configuration data from DHCP server 219 in data network 215, for example by using the DHCP protocol (see signaling 279).

[0101] At step 12, all data traffic of UE 201 is relayed to data network 215 via compulsory tunnel 283, thereby enabling UE 201 to reach all services accessible via this data network 215, such as the first service provided by application server 221 (see signaling 281). Procedure 200 ends.

[0102] Figure 3 One embodiment of a user equipment device 300 that can be used to establish a compulsory tunnel for NSWO according to an embodiment of the present disclosure is depicted. The user equipment device 300 can be one embodiment of the remote unit 105 and / or the UE 201. In addition, the user equipment device 300 can include a processor 305, a memory 310, an input device 315, an output device 320, and a transceiver 325.

[0103] In some embodiments, input device 315 and output device 320 are combined into a single device, such as a touch screen. In some embodiments, user equipment apparatus 300 may not include any input device 315 and / or output device 320. In various embodiments, user equipment apparatus 300 may include one or more of: processor 305, memory 310, and transceiver 325, and may not include input device 315 and / or output device 320.

[0104] As depicted, the transceiver 325 includes at least one transmitter 330 and at least one receiver 335. In some embodiments, the transceiver 325 communicates with one or more cells (or wireless coverage areas) supported by one or more satellites, cellular base units, and / or access points 121. In various embodiments, the transceiver 325 may operate on an unlicensed spectrum. In addition, the transceiver 325 may include multiple UE panels supporting one or more beams. In addition, the transceiver 325 may support at least one network interface 340 and / or an application interface 345. The application interface 345 may support one or more APIs. The network interface 340 may support 3GPP reference points, such as Uu, N1, PC5, etc. As understood by a person of ordinary skill in the art, other network interfaces 340 may be supported.

[0105] In one embodiment, the processor 305 may include any known controller capable of executing computer-readable instructions and / or capable of performing logical operations. For example, the processor 305 may be a microcontroller, a microprocessor, a central processing unit (“CPU”), a graphics processing unit (“GPU”), an auxiliary processing unit, a field programmable gate array (“FPGA”), or a similar programmable controller. In some embodiments, the processor 305 executes instructions stored in the memory 310 to perform the methods and routines described herein. The processor 305 is communicatively coupled to the memory 310, the input device 315, the output device 320, and the transceiver 325.

[0106] In various embodiments, the transceiver 325 is configured to communicate with an authentication agent in a mobile communication network via the WLAN AN. Via the transceiver 325, the processor 305 discovers a WLAN AN that supports AAA interworking with a mobile communication network (e.g., a 5GC network) and connects to the WLAN AN. In response to the identity request, the processor 305 generates a NAI including a service identity, a hidden user name, and a domain. In some embodiments, the service identity specifies a set of services requested by the device 300.

[0107] In one embodiment, memory 310 is a computer-readable storage medium. In some embodiments, memory 310 includes volatile computer storage media. For example, memory 310 may include RAM, including dynamic RAM ("DRAM"), synchronous dynamic RAM ("SDRAM"), and / or static RAM ("SRAM"). In some embodiments, memory 310 includes non-volatile computer storage media. For example, memory 310 may include a hard drive, flash memory, or any other suitable non-volatile computer storage device. In some embodiments, memory 310 includes both volatile and non-volatile computer storage media.

[0108] In some embodiments, the memory 310 stores data related to establishing a mandatory tunnel for NSWO. For example, the memory 310 may store various parameters, panel / beam configurations, resource assignments, policies, and the like, as described above. In some embodiments, the memory 310 also stores program code and related data, such as an operating system or other controller algorithm operating on the user equipment device 300.

[0109] In one embodiment, input device 315 may include any known computer input device including a touch panel, buttons, keyboard, stylus, microphone, or the like. In some embodiments, for example, input device 315 may be integrated with output device 320 as a touch screen or similar touch-sensitive display. In some embodiments, input device 315 includes a touch screen so that text can be entered using a virtual keyboard displayed on the touch screen and / or by handwriting on the touch screen. In some embodiments, input device 315 includes two or more different devices, such as a keyboard and a touch panel.

[0110] In one embodiment, the output device 320 is designed to output visual, auditory, and / or tactile signals. In some embodiments, the output device 320 includes an electronically controllable display or a display device capable of outputting visual data to a user. For example, the output device 320 may include, but is not limited to, a liquid crystal display ("LCD"), a light emitting diode ("LED") display, an organic LED ("OLED") display, a projector, or a similar display device capable of outputting images, text, or the like to a user. As another non-limiting example, the output device 320 may include a wearable display that is separate from the rest of the user equipment device 300 but communicatively coupled to the rest of the device, such as a smart watch, smart glasses, a head-up display, or the like. In addition, the output device 320 may be a component of a smartphone, a personal digital assistant, a television, a tablet computer, a notebook (laptop) computer, a personal computer, a vehicle dashboard, or the like.

[0111] In some embodiments, output device 320 includes one or more speakers for producing sounds. For example, output device 320 can produce an audible alarm or notification (e.g., a beep or buzzer). In some embodiments, output device 320 includes one or more tactile devices for producing vibration, motion, or other tactile feedback. In some embodiments, all or part of output device 320 can be integrated with input device 315. For example, input device 315 and output device 320 can form a touch screen or similar touch-sensitive display. In other embodiments, output device 320 can be located near input device 315.

[0112] The transceiver 325 communicates with one or more network functions of the mobile communication network via one or more access networks. The transceiver 325 operates under the control of the processor 305 to transmit messages, data, and other signals, and also receives messages, data, and other signals. For example, the processor 305 may selectively activate the transceiver 325 (or part thereof) at a specific time in order to send and receive messages.

[0113] The transceiver 325 includes at least a transmitter 330 and at least one receiver 335. The one or more transmitters 330 may be used to provide UL communication signals to the access point 121, such as the UL transmissions described herein. Similarly, the one or more receivers 335 may be used to receive DL communication signals from the access point 121, as described herein. Although only one transmitter 330 and one receiver 335 are illustrated, the user equipment device 300 may have any suitable number of transmitters 330 and receivers 335. Furthermore, the transmitter 330 and the receiver 335 may be any suitable type of transmitter and receiver. In one embodiment, the transceiver 325 includes a first transmitter / receiver pair for communicating with a mobile communication network via a licensed radio spectrum, and a second transmitter / receiver pair for communicating with a mobile communication network via an unlicensed radio spectrum.

[0114] In some embodiments, a first transmitter / receiver pair for communicating with a mobile communication network via a licensed radio spectrum and a second transmitter / receiver pair for communicating with a mobile communication network via an unlicensed radio spectrum may be combined into a single transceiver unit, such as a single chip that performs functions for use with both licensed and unlicensed radio spectrum. In some embodiments, the first transmitter / receiver pair and the second transmitter / receiver pair may share one or more hardware components. For example, some of the transceivers 325, transmitters 330, and receivers 335 may be implemented as physically separate components that access shared hardware resources and / or software resources, such as, for example, a network interface 340.

[0115] In various embodiments, one or more transmitters 330 and / or one or more receivers 335 may be implemented and / or integrated into a single hardware component, such as a multi-transceiver chip, a system on a chip, an application specific integrated circuit ("ASIC"), or other type of hardware component. In certain embodiments, one or more transmitters 330 and / or one or more receivers 335 may be implemented and / or integrated into a multi-chip module. In some embodiments, other components such as a network interface 340 or other hardware components / circuits may be integrated into a single chip with any number of transmitters 330 and / or receivers 335. In this embodiment, the transmitters 330 and receivers 335 may be logically configured as transceivers 325 using one or more common control signals, or as modular transmitters 330 and receivers 335 implemented in the same hardware chip or multi-chip module.

[0116] Figure 4One embodiment of a network device 400 that can be used to establish a compulsory tunnel for NSWO according to an embodiment of the present disclosure is depicted. In some embodiments, the network device 400 can implement an AMF and / or a UPF. In other embodiments, the network device 400 can implement an interworking function, such as an N3IWF and / or a TNGF. In addition, the network device 400 can include a processor 405, a memory 410, an input device 415, an output device 420, and a transceiver 425.

[0117] In some embodiments, input device 415 and output device 420 are combined into a single device, such as a touch screen. In some embodiments, network device 400 may not include any input device 415 and / or output device 420. In various embodiments, network device 400 may include one or more of the following: processor 405, memory 410, and transceiver 425, and may not include input device 415 and / or output device 420.

[0118] As depicted, the transceiver 425 includes at least one transmitter 430 and at least one receiver 435. Here, the transceiver 425 communicates with one or more remote units 105. Additionally, the transceiver 425 may support at least one network interface 440 and / or an application program interface 445. The application program interface 445 may support one or more APIs. The network interface 440 may support 3GPP reference points, such as Uu and N1, N2, and N3. Other network interfaces 440 may be supported as will be appreciated by one of ordinary skill in the art.

[0119] In one embodiment, the processor 405 may include any known controller capable of executing computer-readable instructions and / or capable of performing logical operations. For example, the processor 405 may be a microcontroller, a microprocessor, a CPU, a GPU, an auxiliary processing unit, an FPGA, or a similar programmable controller. In some embodiments, the processor 405 executes instructions stored in the memory 410 to perform the methods and routines described herein. The processor 405 is communicatively coupled to the memory 410, the input device 415, the output device 420, and the transceiver 425.

[0120] In various embodiments, network device 400 is a RAN node (e.g., a gNB) that communicates with one or more UEs, as described herein. In such embodiments, processor 405 controls network device 400 to perform the RAN behaviors described above. When operating as a RAN node, processor 405 may include an application processor (also referred to as a "main processor") that manages application domain and operating system ("OS") functions and a baseband processor (also referred to as a "baseband radio processor") that manages radio functions.

[0121] In various embodiments, the network device 400 acts as an access network entity, such as the access point 121 and / or WLAN NF 203 described above. In such embodiments, the transceiver 425 may be configured to communicate with the remote unit and one or more network functions in the mobile communication network. Via the transceiver 425, the processor 405 initiates a NSWO authentication procedure with the remote unit and receives a NAI from the remote unit during the NSWO authentication procedure. In some embodiments, the NAI includes a SUCI of the remote unit and an indication of a first set of requested services that will be reachable via the access network.

[0122] The processor 405 sends, via the transceiver 425, a first message to an authentication agent (e.g., NSWOF) in the mobile communication network indicating that the remote unit requests to connect to the access network using a certificate associated with the mobile communication network, wherein the first message includes the SUCI and an indication of a first set of requested services. In addition, the processor 405 receives a set of tunnel attributes from the authentication agent. In some embodiments, the processor receives the set of tunnel attributes by receiving an access accept message including the set of tunnel attributes, a success indication, and a session key. In some embodiments, the first message and the access accept message are SWa protocol messages exchanged during a NSWO authentication procedure.

[0123] The processor 405 establishes a compulsory tunnel using the set of tunnel attributes; and relays all traffic of the remote unit via the compulsory tunnel. In some embodiments, the processor establishes a compulsory tunnel with a server in a first data network, wherein the first data network supports access to an allowed set of services. In various embodiments, the set of tunnel attributes includes one or more of: A) tunnel type, B) tunnel media type, C) tunnel client endpoint, D) tunnel server endpoint, E) tunnel client authentication identifier, F) tunnel server authentication identifier, or G) some combination thereof.

[0124] In various embodiments, the network device 400 acts as a NSWOF entity in a mobile communication network, such as the NSWO NF 145 in the mobile core network 140 and / or the NSWOF 207 in the 5GC network 205, as described above. In such embodiments, the transceiver 425 may be configured to communicate with the WLAN AN and with one or more network functions in the mobile communication network. Via the transceiver 425, the processor 405 receives a first message indicating that the remote unit requests to connect to the WLAN AN using a certificate associated with the mobile communication network, and determines that the authentication server authorizes the remote unit to connect to the WLAN AN. In some embodiments, the first message contains the SUCI of the remote unit and an indication of a second set of services that will be reachable via the WLAN AN.

[0125] In response to determining that the authentication server authorizes the remote unit to connect to the WLAN AN, the processor 405 retrieves an allowed service identity for the remote unit, wherein the allowed service identity identifies a first set of services that are reachable via the WLAN AN. In some embodiments, to retrieve the allowed service identity, the processor sends a request message to a UDM in the mobile communication network, and A) receives a response message from the UDM. In such embodiments, the request message may include an access network identifier and a requested service identity, wherein the requested service identity identifies a second set of services that are reachable via the WLAN AN, and the response message may include the allowed service identity.

[0126] The processor 405 determines a set of tunnel attributes associated with the allowed service identity. In some embodiments, the processor 405 determines the set of tunnel attributes by using configuration information. In other embodiments, the processor 405 determines the set of tunnel attributes by querying an NRF in the mobile communication network, for example, via the transceiver 425. In some embodiments, the processor sends a request message containing the allowed service identity to the NRF, and receives a response message containing the set of tunnel attributes associated with the allowed service identity from the NRF.

[0127] Processor 405, via transceiver 425, provides the WLAN AN with the set of tunnel attributes and an indication of establishing a compulsory tunnel to a first data network and relaying all traffic of the remote unit via the compulsory tunnel, wherein the first data network supports access to the first set of services. In one embodiment, the message containing the set of tunnel attributes may include an explicit indication of establishing a compulsory tunnel to the first data network and relaying all traffic of the remote unit via the compulsory tunnel. For example, the message may include a flag or field for explicitly indicating a compulsory tunnel. In another embodiment, the message containing the set of tunnel attributes may include an implicit indication. For example, the indication may be implied by the type of message used to provide the tunnel attributes. As another example, the indication may be implied by the presence of a tunnel attribute parameter, etc.

[0128] In some embodiments, to provide the set of tunnel attributes, the processor is configured to send an access accept message to the WLAN AN containing the set of tunnel attributes, a success indication, and a session key. In some embodiments, the first message and the access accept message are SWa protocol messages exchanged during a NSWO authentication procedure. In other embodiments, to determine the set of tunnel attributes, the processor is configured to receive configuration information, wherein the set of tunnel attributes is determined from the allowed service identity using the received configuration information. In various embodiments, the set of tunnel attributes includes one or more of the following: A) tunnel type, B) tunnel media type, C) tunnel client endpoint, D) tunnel server endpoint, E) tunnel client authentication identifier, F) tunnel server authentication identifier, or G) some combination thereof.

[0129] In various embodiments, the network device 400 acts as a user data management server, such as UDM / UDR 149 and / or UDM 211, as described above. In such embodiments, the transceiver 425 can be configured to communicate with an authentication server (e.g., AUSF) and with a NSWO function in the mobile communication network. Via the transceiver 425, the processor 405 receives an authentication request including an NSWO indicator and the remote unit identity from the authentication server, and sends an authentication vector of the remote unit to the authentication server. Here, the authentication request indicates that the remote unit attempts to connect to the WLAN AN using a certificate associated with the mobile communication network.

[0130] Processor 405 receives a subscription data request from the NSWO function and in response to successful authentication of the remote unit via transceiver 425, and sends a subscription data response containing an allowed service identity of the remote unit to the NSWO function, wherein the allowed service identity identifies a first set of services reachable by the remote unit via the WLAN AN.

[0131] In some embodiments, the subscription data request message includes the SUPI of the remote unit and a requested service identity identifying a second set of services to be reachable via the WLAN. In some embodiments, the processor 405 determines the allowed service identities using: A) configuration information, B) subscription data corresponding to the remote unit, C) an access network identity of the WLAN AN, D) the requested service identity, or E) some combination thereof.

[0132] In one embodiment, memory 410 is a computer readable storage medium. In some embodiments, memory 410 includes volatile computer storage media. For example, memory 410 may include RAM, which includes DRAM, SDRAM and / or SRAM. In some embodiments, memory 410 includes non-volatile computer storage media. For example, memory 410 may include a hard drive, flash memory, or any other suitable non-volatile computer storage device. In some embodiments, memory 410 includes both volatile and non-volatile computer storage media.

[0133] In some embodiments, memory 410 stores data related to establishing a mandatory tunnel for NSWO. For example, memory 410 may store parameters, configurations, resource assignments, policies, and the like, as described above. In some embodiments, memory 410 also stores program code and related data, such as an operating system or other controller algorithm operating on network device 400.

[0134] In one embodiment, input device 415 may include any known computer input device including a touch panel, buttons, keyboard, stylus, microphone, or the like. In some embodiments, for example, input device 415 may be integrated with output device 420 as a touch screen or similar touch-sensitive display. In some embodiments, input device 415 includes a touch screen so that text can be entered using a virtual keyboard displayed on the touch screen and / or by handwriting on the touch screen. In some embodiments, input device 415 includes two or more different devices, such as a keyboard and a touch panel.

[0135] In one embodiment, the output device 420 is designed to output visual, auditory, and / or tactile signals. In some embodiments, the output device 420 includes an electronically controllable display or a display device capable of outputting visual data to a user. For example, the output device 420 may include, but is not limited to, an LCD display, an LED display, an OLED display, a projector, or a similar display device capable of outputting images, text, or the like to a user. As another non-limiting example, the output device 420 may include a wearable display that is separate from the rest of the network device 400 but communicatively coupled to the rest of the network device 400, such as a smart watch, smart glasses, a head-up display, or the like. In addition, the output device 420 may be a component of a smartphone, a personal digital assistant, a television, a tablet computer, a notebook (laptop) computer, a personal computer, a vehicle dashboard, or the like.

[0136] In some embodiments, output device 420 includes one or more speakers for producing sounds. For example, output device 420 can produce an audible alarm or notification (e.g., a beep or buzzer). In some embodiments, output device 420 includes one or more tactile devices for producing vibration, motion, or other tactile feedback. In some embodiments, all or part of output device 420 can be integrated with input device 415. For example, input device 415 and output device 420 can form a touch screen or similar touch-sensitive display. In other embodiments, output device 420 can be located near input device 415.

[0137] The transceiver 425 includes at least a transmitter 430 and at least one receiver 435. One or more transmitters 430 may be used to communicate with a UE, as described herein. Similarly, one or more receivers 435 may be used to communicate with a network function in a PLMN and / or RAN, as described herein. Although only one transmitter 430 and one receiver 435 are illustrated, the network device 400 may have any suitable number of transmitters 430 and receivers 435. Furthermore, the transmitters 430 and receivers 435 may be any suitable type of transmitters and receivers.

[0138] Figure 5One embodiment of a method 500 for establishing a compulsory tunnel for NSWO according to an embodiment of the present disclosure is depicted. In various embodiments, the method 500 is performed by a NSWOF entity, such as NSWO NF 145, NSWOF 207, and / or network device 400, as described above. In some embodiments, the method 500 is performed by a processor, such as a microcontroller, microprocessor, CPU, GPU, auxiliary processing unit, FPGA, or the like.

[0139] The method 500 starts and receives 505 a first message indicating that a remote unit requests to connect to a WLAN AN using a certificate associated with a mobile communication network. The method 500 includes determining 510 that the remote unit is authorized by an authentication server to connect to the WLAN AN. The method 500 includes retrieving 515 an allowed service identity of the remote unit in response to determining that the remote unit is authorized by the authentication server to connect to the WLAN AN, wherein the allowed service identity identifies a first set of services reachable via the WLAN AN. The method 500 includes determining 520 a set of tunnel attributes associated with the allowed service identity. The method 500 includes providing 525 the set of tunnel attributes to the WLAN AN and an indication to establish a compulsory tunnel to a first data network and relay all traffic of the remote unit via the compulsory tunnel, wherein the first data network supports access to the first set of services. The method 500 ends.

[0140] Figure 6 One embodiment of a method 600 for establishing a mandatory tunnel for NSWO according to an embodiment of the present disclosure is depicted. In various embodiments, the method 600 is performed by a WLAN AN entity, such as access point 121, WLAN AN 203, and / or network device 400, as described above. In some embodiments, the method 600 is performed by a processor, such as a microcontroller, microprocessor, CPU, GPU, auxiliary processing unit, FPGA, or the like.

[0141] The method 600 begins and initiates 605 a NSWO authentication procedure with a remote unit. The method 600 includes receiving 610 a NAI from the remote unit during the NSWO authentication procedure. Here, the NAI includes a SUCI for the remote unit and an indication of a first set of requested services that will be reachable via the WLAN AN. The method 600 includes sending 615 a first message to an authentication agent (e.g., NSWO NF) in a mobile communication network indicating that the remote unit requests to connect to the WLAN AN using a certificate associated with the mobile communication network, wherein the first message includes the SUCI and an indication of the first set of requested services. The method 600 includes receiving 620 a set of tunnel attributes from the authentication agent. The method 600 includes establishing 625 a compulsory tunnel using the set of tunnel attributes. The method 600 includes relaying 630 all traffic for the remote unit via the compulsory tunnel. The method 600 ends.

[0142] Figure 7 One embodiment of a method 700 for establishing a compulsory tunnel for NSWO according to an embodiment of the present disclosure is depicted. In various embodiments, the method 700 is performed by a user data management server in a mobile communication network, such as UDM / UDR 149, UDM 211 and / or network device 400, as described above. In some embodiments, the method 700 is performed by a processor, such as a microcontroller, microprocessor, CPU, GPU, auxiliary processing unit, FPGA, or the like.

[0143] The method 700 starts and receives 705 an authentication request including an NSWO indicator and an identity of a remote unit from an authentication server (e.g., AUSF) in a mobile communication network. Here, the authentication request indicates that the remote unit is attempting to connect to a WLAN AN using a certificate associated with the mobile communication network. The method 700 includes sending 710 an authentication vector of the remote unit to the authentication server. The method 700 includes receiving 715 a subscription data request from the NSWO function and in response to a successful authentication of the remote unit. The method 700 includes sending 720 a subscription data response containing an allowed service identity of the remote unit to the NSWO function, wherein the allowed service identity identifies a first set of services that the remote unit can reach via the WLAN AN. The method 700 ends.

[0144] Disclosed herein is a first device for establishing a compulsory tunnel for NSWO according to an embodiment of the present disclosure. The first device may be implemented by a NSWOF entity, such as the NSWO NF 145, NSWOF 207, and / or network device 400 described above. The first device includes: a transceiver configured to communicate with a WLAN AN and with one or more network functions in a mobile communication network; and a processor coupled to the transceiver, the processor configured to cause the device to: A) receive a first message indicating that a remote unit requests to connect to the WLAN AN using a certificate associated with the mobile communication network; B) determine that the remote unit is authorized by an authentication server to connect to the WLAN AN; C) retrieve an allowed service identity of the remote unit in response to determining that the remote unit is authorized by the authentication server to connect to the WLAN AN, wherein the allowed service identity identifies a first set of services that can be reached via the WLAN; D) determine a set of tunnel attributes associated with the allowed service identity; and E) provide the set of tunnel attributes and an indication to the WLAN AN to establish a compulsory tunnel to a first data network and relay all traffic of the remote unit via the compulsory tunnel, wherein the first data network supports access to the first set of services.

[0145] In some embodiments, the first message contains the SUCI of the remote unit and an indication of a second set of services that will be reachable via the WLAN AN. In some embodiments, to provide the set of tunnel attributes, the processor is configured to send an access accept message to the WLAN AN containing the set of tunnel attributes, a success indication, and a session key. In some embodiments, the first message and the access accept message are SWa protocol messages exchanged during a NSWO authentication procedure.

[0146] In some embodiments, to retrieve the allowed service identity, the processor is configured to: A) send a request message containing an access network identifier and a requested service identity to a UDM in a mobile communication network, wherein the requested service identity identifies a second set of services that can be reached via the WLAN AN; and B) receive a response message containing the allowed service identity from the UDM.

[0147] In some embodiments, to determine the set of tunnel attributes, the processor is configured to: A) send a request message containing the allowed service identity to an NRF in the mobile communication network; and B) receive a response message containing the set of tunnel attributes associated with the allowed service identity from the NRF. In other embodiments, to determine the set of tunnel attributes, the processor is configured to receive configuration information, wherein the set of tunnel attributes is determined from the allowed service identity using the received configuration information. In various embodiments, the set of tunnel attributes includes one or more of the following: A) tunnel type, B) tunnel media type, C) tunnel client endpoint, D) tunnel server endpoint, E) tunnel client authentication identifier, F) tunnel server authentication identifier, or G) some combination thereof.

[0148] Disclosed herein is a first method for establishing a compulsory tunnel for NSWO according to an embodiment of the present disclosure. The first method may be performed by an NSWOF entity, such as the NSWO NF 145, NSWOF 207, and / or network device 400 described above. The first method includes receiving a first message indicating that a remote unit requests to connect to a WLAN AN using a certificate associated with a mobile communication network, and determining that the remote unit is authorized by an authentication server to connect to the WLAN AN. The first method includes retrieving an allowed service identity of the remote unit in response to determining that the remote unit is authorized by the authentication server to connect to the WLAN AN, wherein the allowed service identity identifies a first set of services that can be reached via the WLAN. The first method includes determining a set of tunnel attributes associated with the allowed service identity, and providing the set of tunnel attributes to the WLAN AN and an indication to establish a compulsory tunnel to a first data network and relay all traffic of the remote unit via the compulsory tunnel, wherein the first data network supports access to the first set of services.

[0149] In some embodiments, the first message includes a SUCI for the remote unit and an indication of a second set of services that will be reachable via the WLAN AN. In some embodiments, providing the set of tunnel attributes includes sending an access accept message to the WLAN AN, wherein the access accept message contains the set of tunnel attributes, a success indication, and a session key. In some embodiments, the first message and the access accept message are SWa protocol messages exchanged during a NSWO authentication procedure.

[0150] In some embodiments, retrieving the allowed service identities includes sending a request message to the UDM and receiving a response message from the UDM. In such embodiments, the request message may include an access network identifier and a requested service identity, wherein the requested service identity identifies a second set of services that will be reachable via the WLAN AN, and the response message contains the allowed service identities.

[0151] In some embodiments, determining the set of tunnel attributes includes sending a request message containing the allowed service identity to an NRF in the mobile communication network, and receiving a response message containing the set of tunnel attributes associated with the allowed service identity from the NRF. In other embodiments, to determine the set of tunnel attributes, the processor is configured to receive configuration information, wherein the set of tunnel attributes is determined from the allowed service identity using the received configuration information. In various embodiments, the set of tunnel attributes includes one or more of the following: A) tunnel type, B) tunnel media type, C) tunnel client endpoint, D) tunnel server endpoint, E) tunnel client authentication identifier, F) tunnel server authentication identifier, or G) some combination thereof.

[0152] Disclosed herein is a second device for establishing a mandatory tunnel for NSWO according to an embodiment of the present disclosure. The second device may be implemented by an access network entity, such as the access point 121, WLAN NF 203, and / or network device 400 described above. The second device includes: a transceiver configured to communicate with a remote unit and a mobile communication network; a processor coupled to the transceiver, the processor configured to cause the device to: A) initiate an NSWO authentication procedure with the remote unit; B) receive an NAI from the remote unit during the NSWO authentication procedure, wherein the NAI includes a SUCI of the remote unit and an indication of a first set of requested services that will be reachable via the access network (e.g., a WLAN AN containing the second device); C) send a first message to an authentication agent (e.g., NSWO NF) in the mobile communication network, indicating that the remote unit requests to connect to the access network using a certificate associated with the mobile communication network, wherein the first message includes the SUCI and an indication of the first set of requested services; D) receive a set of tunnel attributes from the authentication agent; E) establish a mandatory tunnel using the set of tunnel attributes; and F) relay all traffic of the remote unit via the mandatory tunnel.

[0153] In some embodiments, to establish the compulsory tunnel, the processor is configured to cause the device to establish the compulsory tunnel with the first data network, wherein the first data network supports access to the allowed set of services. In various embodiments, the set of tunnel attributes includes one or more of the following: A) tunnel type, B) tunnel media type, C) tunnel client endpoint, D) tunnel server endpoint, E) tunnel client authentication identifier, F) tunnel server authentication identifier, or G) some combination thereof.

[0154] In some embodiments, to receive the set of tunnel attributes, the processor is configured to receive an access accept message including the set of tunnel attributes, a success indication, and a session key. In some embodiments, the first message and the access accept message are SWa protocol messages exchanged during a NSWO authentication procedure.

[0155] Disclosed herein is a second method for establishing a compulsory tunnel for NSWO according to an embodiment of the present disclosure. The second method may be performed by an access network entity, such as the access point 121, AAA agent 135, WLAN AN203, and / or network device 400 described above. The second method includes initiating an NSWO authentication procedure with a remote unit (e.g., UE), and receiving an NAI from the remote unit during the NSWO authentication procedure. Here, the NAI includes a SUCI of the remote unit and an indication of a first set of requested services that will be reachable via an access network (e.g., a WLAN AN containing the access network entity). The second method includes sending a first message to an authentication agent (e.g., NSWO NF) in a mobile communication network indicating that the remote unit requests to connect to the access network using a certificate associated with the mobile communication network, wherein the first message includes the SUCI and an indication of the first set of requested services. The second method includes receiving a set of tunnel attributes from the authentication agent and establishing a compulsory tunnel using the set of tunnel attributes. The second method includes relaying all traffic of the remote unit via the compulsory tunnel.

[0156] In some embodiments, establishing the compulsory tunnel comprises establishing the compulsory tunnel with the first data network, wherein the first data network supports access to the allowed set of services. In various embodiments, the set of tunnel attributes comprises one or more of: A) tunnel type, B) tunnel media type, C) tunnel client endpoint, D) tunnel server endpoint, E) tunnel client authentication identifier, F) tunnel server authentication identifier, or G) some combination thereof.

[0157] In some embodiments, receiving the set of tunnel attributes comprises receiving an access accept message containing the set of tunnel attributes, a success indication, and a session key.In some embodiments, the first message and the access accept message are SWa protocol messages exchanged during a NSWO authentication procedure.

[0158] Disclosed herein is a third apparatus for establishing a compulsory tunnel for NSWO according to an embodiment of the present disclosure. The third apparatus may be implemented by a user data management server, such as the UDM / UDR 149, UDM 211, and / or network apparatus 400 described above. The third apparatus includes: a transceiver configured to communicate with one or more network functions in a mobile communication network; and a processor coupled to the transceiver, the processor configured to cause the apparatus to: A) receive an authentication request including an NSWO indicator and an identity of a remote unit from an authentication server (e.g., AUSF) in the mobile communication network, wherein the authentication request indicates that the remote unit attempts to connect to a WLAN using a certificate associated with the mobile communication network; B) send an authentication vector of the remote unit to the authentication server; C) receive a subscription data request from the NSWO function and in response to a successful authentication of the remote unit; and D) send a subscription data response containing an allowed service identity of the remote unit to the NSWO function (e.g., NSWOF 145 and / or NSWOF 207), wherein the allowed service identity identifies a first set of services that the remote unit can reach via the WLAN.

[0159] In some embodiments, the subscription data request message includes the SUPI of the remote unit and a requested service identity identifying a second set of services to be reachable via the WLAN. In some embodiments, the allowed service identities are determined using: A) configuration information, B) subscription data corresponding to the remote unit, C) an access network identity of the WLAN, D) the requested service identity, or E) some combination thereof.

[0160] Disclosed herein is a third method for establishing a compulsory tunnel for NSWO according to an embodiment of the present disclosure. The third method may be performed by a network function, such as the UDM / UDR 149, the UDM 211, and / or the network device 400 described above. The third method includes receiving an authentication request including an NSWO indicator and an identity of a remote unit from an authentication server (e.g., AUSF) in a mobile communication network. Here, the authentication request indicates that the remote unit attempts to connect to a WLAN using a certificate associated with the mobile communication network. The third method includes sending an authentication vector of the remote unit to the authentication server, and in response to a successful authentication of the remote unit, receiving a subscription data request from the NSWO function. The third method includes sending a subscription data response containing an allowed service identity of the remote unit to the NSWO function, wherein the allowed service identity identifies a first set of services that the remote unit can reach via the WLAN.

[0161] In some embodiments, the subscription data request message includes the SUPI of the remote unit and a requested service identity identifying a second set of services to be reachable via the WLAN. In some embodiments, the allowed service identities are determined using: A) configuration information, B) subscription data corresponding to the remote unit, C) an access network identity of the WLAN, D) the requested service identity, or E) some combination thereof.

[0162] Embodiments may be practiced in other specific forms. The described embodiments will be considered in all respects as illustrative only and not restrictive. Therefore, the scope of the present invention is indicated by the appended claims rather than by the foregoing description. All changes within the equivalent meaning and scope of the claims should be included within their scope.

Claims

1. A network device in a mobile communication network, comprising: a transceiver configured to communicate with a wireless local area network "WLAN" and with one or more network functions in said mobile communication network; and a processor coupled to the transceiver, the processor configured to cause the apparatus to: receiving a first message indicating that a remote unit is requesting to connect to the WLAN access network using credentials associated with the mobile communications network; determining that the remote unit is authorized by an authentication server to connect to the WLAN access network; in response to determining that the remote unit is authorized by the authentication server to connect to the WLAN access network, retrieving an allowed service identity for the remote unit, wherein the allowed service identity identifies a first set of services reachable via the WLAN; determining a set of tunnel attributes associated with the allowed service identity; as well as The set of tunnel attributes is provided to the WLAN access network along with an indication to establish a compulsory tunnel to a first data network and to relay all traffic for the remote unit via the compulsory tunnel, wherein the first data network supports access to the first set of services.

2. The apparatus of claim 1, wherein the first message includes a Subscriber Hidden Identity (SUCI) of the remote unit and an indication of a second set of services that will be reachable via the WLAN access network.

3. The apparatus of claim 1 or 2, wherein to retrieve the allowed service identity, the processor is configured to: sending a request message including an access network identifier and a requested service identity to a unified data management function (UDM) in the mobile communications network, wherein the requested service identity identifies a second set of services that will be reachable via the WLAN access network; and A response message containing the allowed service identity is received from the UDM.

4. Apparatus according to any preceding claim, wherein: To determine the set of tunnel attributes, the processor is configured to: sending a request message including the allowed service identity to a network repository function "NRF" in the mobile communication network; as well as receiving a response message from the NRF containing the set of tunnel attributes associated with the allowed service identity, The set of tunnel attributes includes: Tunnel type, Tunnel medium type, Tunnel client endpoint, Tunnel server endpoint, Tunnel client authentication identifier, Tunnel server authentication identifier, or a combination thereof.

5. Apparatus according to any preceding claim, wherein: To determine the set of tunnel attributes, the processor is configured to: receiving configuration information, wherein the set of tunnel attributes is determined from the allowed service identity using the received configuration information, The set of tunnel attributes includes: Tunnel type, Tunnel medium type, Tunnel client endpoint, Tunnel server endpoint, Tunnel client authentication identifier, Tunnel server authentication identifier, or a combination thereof.

6. Apparatus according to any preceding claim, wherein: To provide the set of tunnel attributes, the processor is configured to: sending an access accept message including the set of tunnel attributes, a success indication and a session key to the WLAN AN, The first message and the access accept message are SWa protocol messages exchanged during a non-seamless WLAN offload "NSWO" authentication procedure.

7. A device in an access network, the device comprising: a transceiver configured to communicate with a remote unit and a mobile communication network; and a processor coupled to the transceiver, the processor configured to cause the apparatus to: initiating a non-seamless WLAN offload (NSWO) authentication procedure with the remote unit; receiving a network access identifier from the remote unit during the NSWO authentication procedure, wherein the network access identifier includes a subscriber concealed identity (SUCI) of the remote unit and an indication of a first set of requested services to be reachable via the access network; sending a first message to an authentication agent in the mobile communications network indicating that the remote unit is requesting to connect to the access network using credentials associated with the mobile communications network, wherein the first message includes the SUCI and the indication of the first set of requested services; receiving a set of tunnel attributes from the authentication agent; establishing a compulsory tunnel using the set of tunnel attributes; as well as All traffic for the remote unit is relayed via the compulsory tunnel.

8. The device according to claim 7, in, To establish the compulsory tunnel, the processor is configured to cause the device to establish the compulsory tunnel with a first data network, The first data network supports access to a set of allowed data networks. The set of tunnel attributes includes: Tunnel type, Tunnel medium type, Tunnel client endpoint, Tunnel server endpoint, Tunnel client authentication identifier, Tunnel server authentication identifier, or a combination thereof.

9. The apparatus of claim 7 or 8, wherein to receive the set of tunnel attributes, the processor is configured to: receiving an access accept message including the set of tunnel attributes, a success indication, and a session key, The first message and the access accept message are SWa protocol messages exchanged during the NSWO authentication procedure.

10. A network device, comprising: a transceiver configured to communicate with one or more network functions in a mobile communications network; and a processor coupled to the transceiver, the processor configured to cause the apparatus to: receiving, from an authentication server in the mobile communications network, an authentication request including a non-seamless wireless local area network offload (NSWO) indicator and an identity of a remote unit, wherein the authentication request indicates that the remote unit attempts to connect to a wireless local area network (WLAN) using credentials associated with the mobile communications network; sending an authentication vector of the remote unit to the authentication server; receiving a subscription data request from the NSWO function and in response to successful authentication of the remote unit; as well as A subscription data response containing an allowed service identity of the remote unit is sent to the NSWO function, wherein the allowed service identity identifies a first set of services reachable by the remote unit via the WLAN.

11. The apparatus of claim 10, wherein the subscription data request comprises a Subscriber Permanent Identity (SUPI) of the remote unit and a requested service identity, the requested service identity identifying a second set of services to be reachable via the WLAN.

12. The apparatus of claim 10 or 11, wherein the allowed identities are determined using: Configuration information, subscription data corresponding to the remote unit, the access network identity of the WLAN, The requested service identity, or a combination thereof.

Images