Network slice security for non-3GPP access

Abstract

Various example embodiments relate to methods and apparatus for network slice security for non-3GPP access. An apparatus is configured to send a request message to an access network device, the request message comprising network slice group information corresponding to network slice identification information of a terminal device; and receiving, from the access network device, an identifier of a non-3GPP access network device capable of serving at least one network slice indicated in the network slice identifier information in response to the request message.

Description

Technical Field

[0001] Various example embodiments described herein relate generally to communication technology, and more particularly to methods and apparatus for network slicing security for non-3GPP access. Background Art

[0002] Certain abbreviations that may be found in the specification and / or drawings are defined as follows:

[0003] AMF Access and Mobility Management Function

[0004] AN Access Network

[0005] AN NRF Access Network Repository Function

[0006] AP Access Point

[0007] CN Core Network

[0008] MITM Man-in-the-Middle Attack

[0009] NAS Non-Access Stratum

[0010] NSSAI Network Slicing Selection Assistance Information

[0011] NSASG Network Slicing Access Layer Group

[0012] N3IWF Non-3GPP Interworking Function

[0013] NRF Network Repository Features

[0014] OAM Operations Management and Maintenance

[0015] SBA Service-Based Architecture

[0016] S-NSSAI Single Network Slice Selection Auxiliary Information

[0017] TNAP Trusted Non-3GPP Access Point

[0018] TNGF Trusted Non-3GPP Gateway Function

[0019] UDM Unified Data Management

[0020] UE User Equipment

[0021] The 3rd Generation Partnership Project 3GPP provides an architecture that allows user equipment (UE) to connect to the core network using not only 3GPP radio access networks but also non-3GPP access networks. For example, access network gateways such as non-3GPP interworking functions (N3IWF), trusted non-3GPP gateway functions (TNGF), etc. can be configured to enable access to the core network. It is desirable to provide security protection for the UE to protect the privacy of the user. Summary of the invention

[0022] The following provides a brief summary of exemplary embodiments to provide a basic understanding of some aspects of various embodiments. It should be noted that this summary is not intended to identify key features of essential elements or to limit the scope of the embodiments, and its sole purpose is to introduce some concepts in a simplified form as a prelude to the more detailed description provided below.

[0023] In a first aspect, an example embodiment of a terminal device is provided. The terminal device may include at least one processor and at least one memory. The at least one memory may store instructions, which, when executed by the at least one processor, may cause the terminal device to at least send a request message to an access network device, the request message including network slice group information corresponding to the network slice identification information of the terminal device; and receive from the access network device an identification of a non-3GPP access network device capable of serving at least one network slice indicated in the network slice identification information in response to the request message.

[0024] In a second aspect, an example embodiment of an access network device is provided. The access network device may include at least one processor and at least one memory. The at least one memory may store instructions, which, when executed by the at least one processor, may enable the access network device to at least receive a request message from a terminal device, the request message including network slice group information corresponding to the network slice identification information of the terminal device; and in response to the request message, send to the terminal device an identification of a non-3GPP access network device capable of serving at least one network slice indicated in the network slice identification information.

[0025] In a third aspect, an example embodiment of a core network device is provided. The core network device may include at least one processor and at least one memory. The at least one memory may store instructions, which, when executed by the at least one processor, may enable the core network device to at least determine network slice group information corresponding to network slice identification information of a terminal device; and send configuration information indicating a mapping between the network slice group information and the network slice identification information to an access network device in a non-3GPP access network configured to provide access to the terminal device.

[0026] Example embodiments of methods, apparatuses, and computer program products are also provided. These example embodiments generally correspond to the example embodiments in the above aspects, and for convenience, repeated descriptions thereof are omitted here.

[0027] Other features and advantages of example embodiments of the present application will also be apparent from the following description of specific embodiments when read in conjunction with the accompanying drawings, which illustrate, by way of example, the principles of example embodiments of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Some example embodiments will now be described, by way of non-limiting examples, with reference to the accompanying drawings.

[0029] Figure 1A and 1B An example communication network is illustrated in which example embodiments of the present application may be implemented.

[0030] Figure 2 is a high-level message flow diagram illustrating a discovery process for non-3GPP access network devices according to an example embodiment of the present application.

[0031] Figure 3 is a schematic message flow diagram illustrating a discovery process for a non-3GPP access network device according to an example embodiment of the present application.

[0032] Figure 4 is a schematic diagram illustrating a mapping configuration related to network slicing according to an example embodiment of the present application.

[0033] Figure 5 is a schematic message flow diagram illustrating a discovery process for a non-3GPP access network device according to an example embodiment of the present application.

[0034] Figure 6 is a schematic message flow diagram illustrating a discovery process for a non-3GPP access network device according to an example embodiment of the present application.

[0035] Figure 7 is a schematic message flow diagram illustrating a discovery process for a non-3GPP access network device according to an example embodiment of the present application.

[0036] Figure 8 It is a schematic flow chart illustrating an operation for implementing a discovery operation of a non-3GPP access network device at a terminal device according to an exemplary embodiment of the present application.

[0037] Fig. 9 is a schematic flow chart illustrating a discovery operation of a non-3GPP access network device implemented at an access network device according to an example embodiment of the present application.

[0038] Fig.10 is a schematic flow chart illustrating a discovery operation of a non-3GPP access network device implemented at a core network device according to an example embodiment of the present application.

[0039] Fig.11 It is a schematic structural block diagram illustrating a device in a communication system in which an exemplary embodiment of the present application can be implemented.

[0040] Fig.12 is a schematic functional block diagram illustrating an apparatus according to an exemplary embodiment of the present application.

[0041] Fig.13 is a schematic functional block diagram illustrating an apparatus according to an exemplary embodiment of the present application.

[0042] Fig.14 is a schematic functional block diagram illustrating an apparatus according to an exemplary embodiment of the present application.

[0043] In all the drawings, the same or similar reference numerals represent the same or similar elements, and repeated description of the same elements will be omitted. DETAILED DESCRIPTION

[0044] Some example embodiments will be described in detail below with reference to the accompanying drawings. The following description includes specific details for the purpose of providing a thorough understanding of the various concepts. However, it is apparent to those skilled in the art that these concepts can be practiced without these specific details. In some cases, well-known circuits, techniques, and components are shown in block diagram form to avoid obscuring the concepts and features described.

[0045] As used herein, the term "terminal device" or "user equipment" (UE) refers to any entity or device that can communicate with access network equipment or each other. Examples of terminal devices may include mobile phones, mobile terminals (MT), mobile stations (MS), subscriber stations (SS), portable subscriber stations (PSS), access terminals, (AT), computers, wearable devices, vehicle-mounted communication devices, machine type communication (MTC) devices, D2D communication devices, V2X communication devices, sensors, etc. The term "terminal device" can be used interchangeably with UE, user terminal, mobile terminal, mobile station or wireless device.

[0046] The term "access network device" as used herein refers to any appropriate entity or device that can provide wireless or wired communication functions for a terminal device. For non-3GPP access, the access network device can be an access point, such as a trusted non-3GPP access point (TNAP), a network node, such as a non-3GPP interworking function (N3IWF), or a trusted non-3GPP gateway function (TNGF), or any other entity that can facilitate the terminal device to access the core network.

[0047] The term "network function" (NF) used in this article refers to a processing function in a network and defines functional behaviors and interfaces. A network function can be implemented by dedicated hardware, by running software on dedicated hardware, or in the form of a virtual function on a general-purpose hardware platform. From an implementation perspective, network functions can be divided into physical network functions and virtual network functions. From a usage perspective, network functions can be divided into dedicated network functions and shared network functions.

[0048] Figure 1A and 1B An example communication network in which an example embodiment of the present application can be implemented is illustrated. Figure 1A UE 110 can access core network 130a (e.g., 5GC) by using non-3GPP access technologies, such as WiFi access or fixed network access. Core network 130a defines a service-based architecture (SBA) based on the concepts of network slicing and virtualized network functions (NFs). Figure 1A In the example of FIG. 1 , a UE 110 may access an access and mobility management function (AMF) 132 in a core network 130a via an untrusted non-3GPP access network 120a, which may include an access point (AP) 122 and a non-3GPP interworking function (N3IWF) 124. The N3IWF 124 may relay non-access stratum (NAS) signaling between the UE 110 and the AMF 132 via an N1 interface to enable the UE to have a direct NAS signaling connection toward the AMF 132. Although the N3IWF 124 is shown as being located within the untrusted non-3GPP access network 120a, in other embodiments, the N3IWF 124 may be located outside the non-3GPP access network 120a, for example, within the core network 130a.

[0049] Figure 1AAdditional network functions are shown, such as a unified data management (UDM) 134 and a network repository function (NRF) 136, which can be coupled to the AMF 132. The UDM 134 can be configured to store subscription information of the UE 110. The NRF 136 can be configured to discover and provide candidate NFs or NF service information, for example, information about NF instances, slice information of NF instances. Although not shown, other network functions, such as a session management function (SMF), an authentication server function (AUSF), a network slice selection function (NSSF), and a policy control function (PCF) can also be included in the core network 130a. In addition, Figure 1A Additional interfaces are shown for various network elements to communicate with each other. The interface between UE 110 and AP 122 is a Y1 interface, the interface between AP 122 and N3IWF 124 is a Y2 interface, and the interface between N3IWF 124 and AMF 132 is an N2 interface.

[0050] In order to enable the UE 110 to select an access network node (e.g., N3IWF) that supports the slice information requested by the UE 110, an access network network repository function (ANNRF) 126 may be deployed in the access network 120a. The functionality of the AN NRF 126 may be similar to the NRF 136 in the core network 130a. For example, the UE 110 may perform an N3IWF discovery process on the AN NRF 126 by reusing the NF discovery service operation defined in TS23.502. In addition, one or more N3IWFs may register a set of slices, such as the single network slice selection assistance information (S-NSSAI) they support, by reusing the NF registration service operation as defined in TS23.502 or any similar service operation supported in the communication network. For security reasons, the AN NRF 126 may be a different NF hosted by a different platform than the NRF 136 in the core network 130a.

[0051] Figure 1B A trusted non-3GPP access network (TNAN) 120b is shown through which the UE 110 can access the AMF 132 in the core network 130b. The TNAN 120b may include a trusted non-3GPP access point (TNAP) 125 and a trusted non-3GPP gateway function (TNGF) 127. The TNGF 127 may relay non-access stratum (NAS) signaling between the UE 110 and the AMF 132 via an N1 interface to enable the UE to have a direct NAS signaling connection toward the AMF 132. Figure 1BAdditional interfaces are shown for various network elements to communicate with each other. The interface between UE 110 and TNAP 125 is a Yt interface, the interface between TNAP 125 and TNGF 127 is a Ta interface, and the interface between TNGF 127 and AMF 132 is an N2 interface.

[0052] In order to enable UE 110 to select an access network node (e.g., TNAP) that supports the slice information requested by UE 110, a node that is compatible with the access network 120b may be deployed in access network 120b. Figure 1A Similar AN NRF 126. For example, UE 110 can perform NF discovery process on AN NRF 126 by reusing NF discovery service operation. In addition, one or more TNAPs can register a set of slices (e.g., S-NSSAI) that they support by reusing NF registration service operation or any similar service operation supported in the communication network.

[0053] Network architecture such as Figure 1A and 1B As shown, UE 110 is able to discover the network slices (also referred to as slices for short) of the access network device (e.g., N3IWF, TNGF) and select the access network device accordingly. However, exposing the slice information (e.g., S-NSSAI) of UE 110 or the network device to other UEs may cause privacy issues. For example, UE 110 may provide the requested slice information without any protection. In this case, a man-in-the-middle (MITM) may be able to check which slices or services UE 110 is interested in. From a security perspective, this poses risks and needs to be addressed to prevent the leakage of users' privacy information.

[0054] Therefore, there is a need to provide an efficient mechanism to support discovery of access network devices (eg, in non-3GPP access networks) to be used by a UE to access a core network, while reducing or eliminating privacy issues.

[0055] Hereinafter, specific embodiments of the method and apparatus for supporting discovery of non-3GPP access network devices will be described in detail with reference to the accompanying drawings. In an example embodiment, slice group information rather than slice information itself may be used for the discovery process. The example embodiment allows the UE to discover and select an access network device without exposing slice information. Therefore, security performance may be improved. Although some example embodiments are described in the context of a 5G system, it will be appreciated that the various example embodiments described herein may also be applicable to a 4G LTE system or a beyond 5G system.

[0056] Figure 2 is a high-level message flow diagram illustrating a discovery process for non-3GPP access network devices according to an example embodiment. Figure 2The operations shown may be performed by a user device, one or more access network devices, and a core network device. Figure 1A and Figure 1B The UE 110, the access network device 120 (e.g., N3IWF 124, TNAP 125, or AN NRF 126) in the access network 120a or 120b, and the core network device 130 (e.g., AMF 132) in the core network 130a or 130b can be configured to perform a discovery process. The UE 110, the access network device 120, and the core network device 130 can each include multiple components, modules, devices, or elements to perform the operations discussed below, and these components, modules, devices, and elements can be implemented in various ways, including but not limited to, for example, software, hardware, firmware, or any combination thereof to perform these operations.

[0057] refer to Figure 2 , the network slice identification information (e.g., S-NSSAI list) to which UE 110 subscribes may be stored in a unified data management (e.g., UDM 134). The core network device 130 may then use the subscription information of UE 110 stored in UDM 134. In one example, the core network device 130 may determine the network slice group information corresponding to the network slice identification information based on the subscribed slice information of UE 110. For example, the core network device 130 may create a slice group list (e.g., a network slice access layer group (NSASG)) based on preset configuration information. At operation 210, the core network device 130 may send the network slice group information to UE 110, for example, via a NAS message in the subscription process defined in TS23.501 and TS23.502.

[0058] At operation 220, UE 110 may send a request message to access network device 120, for example, when UE 110 wants to discover a gateway associated with a UE-requested service or slice. UE 110 may include network slice group information in the request message instead of sending network slice identification information. For example, UE 110 may send an NSASG list corresponding to the S-NSSAI requested by UE 110. Since the slice identification is not exposed in the request message, privacy issues may be avoided.

[0059] After receiving the request message from UE 110, at operation 230, access network device 120 may extract the slice identification information requested by UE 110. For example, access network device 120 may be configured with configuration information indicating a mapping between network slice group information and network slice identification information by core network device 130 or an operation, administration and maintenance (OAM) server. Based on such configuration information, access network device 120 is able to derive the network slice identification information requested by UE 110.

[0060] In addition, the access network device 120 can determine at least one non-3GPP access network device (e.g., a gateway or an access point) that can serve the network slice indicated in the network slice identification information based on the received slice group information or the extracted slice identification information. For example, when the access network device 120 is an ANNRF, the access network device 120 can determine one or more N3IWFs or TNAPs that can match the network slice requirements indicated in the S-NSSAI; when the access network device 120 is an N3IWF or TNAP, the access network device 120 can determine the NSASG set or the corresponding S-NSSAI that it can support.

[0061] Then, at operation 240, the core network device 130 may send a response message to the UE 110 to indicate at least one non-3GPP access network device that can serve at least one network slice indicated in the network slice indication information. For example, the response message may include the identifiers of one or more N3IWFs or TNAPs that can serve or support the network slice requested by the UE 110, so that the UE 110 can select the corresponding N3IWF or TNAP to attach to the core network.

[0062] Figure 3 is a schematic message flow diagram illustrating a discovery process for a non-3GPP access network device according to an example embodiment. Figure 3 The process shown may be performed by, for example, UE 110, AN NRF 126 of the access network, and core network device 130. It should be understood that Figure 3 The operations shown in the above reference Figure 2 Specific examples of the processes discussed and can be incorporated into Figure 2 in the process shown in .

[0063] refer to Figure 3 At operation 210, the core network device 130 may send network slice group information to the UE 110, for example, via a NAS message. The network slice group information may include a slice group (SG) list corresponding to the S-NSSAI subscribed to by the UE 110. In an example, the SG list may be generated according to a mapping configuration between a slice group identifier and corresponding one or more network slices.

[0064] Figure 4 is a schematic diagram of a mapping configuration associated with a network slice according to an example embodiment. Figure 4 , multiple S-NSSAIs can be classified or clustered into several slice groups (SGs). That is, a slice group can correspond to one or more network slices. In one example, the S-NSSAIs can be organized based on various factors, such as the function, tenant, or region of the corresponding S-NSSAI. Figure 4 As shown, S-NSSAI 1 and S-NSSAI 2 are grouped into SG 1, S-NSSAI 3 to S-NSSAI 5 are grouped into SG 2, S-NSSAI 6 and S-NSSAI 7 are grouped into SG 3, and S-NSSAI 8 to S-NSSAI 10 are grouped into SG 4. Figure 4 It is shown that one S-NSSAI is mapped to a single slice group, but it is understood that this is just an example and not limiting. For example, in some cases, two different SGs can share one or more S-NSSAIs.

[0065] Based on the mapping configuration, the core network device 130 may create a slice group, such as a network slice access stratum group (NSASG), corresponding to the S-NSSAI subscribed to by the UE 110. For example, if the UE 110 subscribes to S-NSSAI 3, S-NSSAI 4, and S-NSSAI 7, the core network device 130 may determine the corresponding SG identification information, i.e., SG 2, SG 3, and send the information to the UE 110 via a NAS message.

[0066] Back to Figure 3 , in order to facilitate AN NRF 126 to extract the slice information of UE 110. At operation 310, core network device 130 may send configuration information to AN NRF 126. Figure 4 The configuration information may indicate a mapping between network slice group information and network slice identification information.

[0067] In an example embodiment, the core network device 130 may configure the configuration information for the AN NRF 126 via the core network process. For example, the AMF 132 may configure or update the mapping list between the SG and the S-NSSAI via the SBA interface. Alternatively or additionally, the OAM may configure the mapping list in the AN NRF 126.

[0068] Although Figure 3It is shown that the configuration information is configured by the core network device 130, but it should be noted that this is only an example and not a limitation. For example, one or more N3IWFs or TNGFs may register the mapping between SGs and S-NSSAIs supported by the corresponding N3IWFs or TNGFs with the AN NRF 126. For example, the N3IWF or TNGF may send a configuration file including a set of supported S-NSSAIs and corresponding SGs to the AN NRF 126, for example, by using an NF registration service operation.

[0069] At operation 320, when UE 110 wants to access the core network service through the non-3GPP access network, UE 110 may send a NF discovery request to AN NRF 126. In one example, UE 110 may send Nnrf_NFDiscovery_Request to AN NRF 126. The request message may include the slice group list information received from the core network device 130. Since the slice identification information is not exposed in the request message, the security performance may be improved.

[0070] In response to receiving the request message, at operation 330, the AN NRF 126 may extract slice identification information corresponding to the received slice group information. For example, based on the mapping configuration received from the core network device 130, the AN NRF 126 may determine one or more S-NSSAIs corresponding to the received SG list.

[0071] Then, at operation 340, AN NRF 126 may determine one or more access network devices (e.g., N3IWF or TNAP) that can serve or support the target S-NSSAI list. For example, an N3IWF or TNAP that can meet the requirements indicated in the S-NSSAI may be determined as a candidate access network device for UE 110 to attach to the core network.

[0072] In an example embodiment, AN NRF 126 may consider both the S-NSSAI list and the Internet Protocol (IP) address of UE 110 (e.g., the source address of the request message in operation 320) to determine the best matching N3IWF or TNAP that can serve the target S-NSSAI list requested by UE 110 and whose IP address is close to the IP address of UE 110.

[0073] At operation 350, AN NRF 126 may send a response to UE 110 to indicate the determined access network device. In one example, AN NRF 126 may send a Nnrf_NFDiscovery_Request response to UE 110. The response message may include an identification of the determined N3IWF or TNAP, such as a public IP address of the N3IWF or TNAP. Based on this information, UE 110 may select N3IWF or TNAP to access the core network.

[0074] Figure 5 is a schematic message flow diagram illustrating a discovery process for a non-3GPP access network device according to an example embodiment. Figure 5 The process shown may be performed by, for example, UE 110, N3IWF 124 or TNAP 125 of the access network, and core network device 130. It should be understood that Figure 5 The operations shown in the above reference Figure 2 Specific examples of the processes discussed and can be incorporated into Figure 2 in the process shown in .

[0075] refer to Figure 5 At operation 210, the core network device 130 may send network slice group information to the UE 110, for example, via a NAS message. The network slice group information may include a slice group (SG) list corresponding to the S-NSSAI subscribed to by the UE 110. In an example, the SG list may be generated according to a mapping configuration between a slice group identifier and one or more corresponding network slices. The details of the mapping configuration may be referred to in detail. Figure 3 and Figure 4 The description is basically the same, and redundant description is omitted here.

[0076] At operation 410, the core network device 130 may send configuration information to the N3IWF 124 or the TNAP 125. In an example, the core network device 130 may configure an SG list corresponding to the S-NSSAI supported by the N3IWF 124 or the TNGF 125. For example, the AMF 132 may configure or update the SG list via the SBA interface. Alternatively or additionally, the OAM may configure the SG list in the N3IWF 124 or the TNAP 125.

[0077] At operation 420, UE 110 may send a request message to N3IWF 124 or TNAP 125. For example, when UE 110 has selected a group of candidate N3IWFs or TNAPs including N3IWF 124 or TNAP 125, UE 110 may send a Slice Support Get request to each of these N3IWFs or TNAPs. The request message may include the slice group list information received from the core network device 130. Since the slice identification information is not exposed in the request message, the security performance may be improved.

[0078] At operation 430, N3IWF 124 or TNAP 125 may extract slice identification information corresponding to the received slice group information. For example, based on the mapping configuration received from core network device 130, N3IWF 124 or TNAP 125 may determine one or more SGs and corresponding S-NSSAIs that they may support.

[0079] Then, at operation 440, N3IWF 124 or TNAP 125 may send a response message to UE 110 to indicate which slices N3IWF 124 or TNAP 125 may support. In an example, AN NRF 126 may send a slice support acquisition response to UE 110. Similar to operation 420, the response message may include a list of SGs that N3IWF 124 or TNAP 125 may support instead of S-NSSAI, so that the slice information is exchanged under protection.

[0080] After querying all candidate N3IWFs or TNAPs, based on the identification indicated in the response message (e.g., the IP address of N3IWF 124 or TNAP 125), UE 110 may know which candidate N3IWF / TNAP can serve or support which S-NSSAIs UE 110 wishes to use. UE 110 may then consider a set of slices it wishes to use and the slices supported by the candidate N3IWF / TNAP indicated in the response message to select an N3IWF or TNAP that can best support the slices UE 110 wishes to use.

[0081] Figure 6 is a schematic message flow diagram illustrating a discovery process for a non-3GPP access network device according to an example embodiment. Figure 6 The illustrated process may be performed by, for example, UE 110, AN NRF 126 of the access network, and core network device 130.

[0082] As mentioned above, the slice group list can be organized based on the function, tenant, or region of the network slice. For example, Figure 4, SG 1, SG 2, SG 3, and SG 4 may refer to social media functions, multimedia functions, financial-related functions, and video streaming functions, respectively. In this case, the "plain text" slice group information in the discovery request sent by UE 110 may leak the user's behavior, resulting in the risk of privacy information leakage. If a malicious user (e.g., MITM) can obtain the mapping between the SG and S-NSSAI of the subscribed slice, the malicious user may even infer the behavior of the UE 110 user based on the slice group information.

[0083] In order to ensure the security of the slice group information sent by the UE 110, the core network device 130 or the OAM may generate a pair of public keys and private keys associated with the AN NRF 126. At operation 510, the core network device 130 may send the network slice group information and the public key to the UE 110. In addition, at operation 520, the core network device 130 may send the configuration information and the private key to the AN NRF 126. It can be understood that the network slice group information and the public key may be sent via different messages, and the configuration information and the private key may also be sent via different messages.

[0084] In the event that a discovery process is desired, the UE 110 may encrypt the network slice group information using a public key at operation 530. Then, at operation 540, the UE 110 may send a request message, such as Nnrf_NFDiscovery_Request, to the AN NRF 126. The request may include an encrypted slice group list. Other aspects of the request message may be similar to those described in reference 540. Figure 3 The description is basically the same and will not be repeated here.

[0085] After receiving the discovery request, the AN NRF 126 may first use a private key to decrypt the encrypted network slice group information at operation 550 to obtain a decrypted slice group list. Then, at operation 560, the AN NRF 126 may extract the network slice identification information corresponding to the decrypted slice group list information based on the configuration information. Considering the network slice identification information and other information such as the IP address of the UE 110, at operation 570, the AN NRF 126 may determine one or more candidate N3IWFs or TNAPs that can serve or support the network slice requested by the UE 110. Then, at operation 580, the AN NRF 126 may send the identification of the candidate N3IWF or TNAP to the UE 110, for example, via an NFDiscovery response message. Operations 560, 570, and 580 are similar to the above-mentioned operations 330, 340, and 350, and are not repeated here.

[0086] Figure 7is a schematic message flow diagram illustrating a discovery process of a non-3GPP access network device according to an example embodiment. Figure 7 The illustrated process may be performed by, for example, UE 110 , N3IWF 124 or TNAP 125 of the access network, and core network device 130 .

[0087] Similar to Figure 6 In the process shown in the figure, in order to ensure the security of the slice group information sent by the UE 110, the core network device 130 or the OAM may generate a pair of public keys and private keys associated with the N3IWF 124 or the TNAP 125. At operation 610, the core network device 130 may send the network slice group information and the public key to the UE 110. In addition, at operation 620, the core network device 130 may send the configuration information and the private key to the N3IWF 124 or the TNAP 125. It can be understood that the network slice group information and the public key may be sent via different messages, and the configuration information and the private key may also be sent via different messages.

[0088] In the event that a discovery process is desired, the UE 110 may encrypt the network slice group information using a public key at operation 630. Then, at operation 640, the UE 110 may select one or more candidate N3IWFs or TNAPs and send a request message to each of these N3IWFs or TNAPs (e.g., N3IWF 124 or TNAP 125). The request message may include an encrypted slice group list. Other aspects of the request message may be the same as those described in reference 6. Figure 5 The description is basically the same and will not be repeated here.

[0089] After receiving the discovery request, the N3IWF 124 or TNAP 125 may first use the private key to decrypt the encrypted network slice group information at operation 650 to obtain a decrypted slice group list. Then at operation 660, the N3IWF 124 or TNAP 125 may extract the network slice identification information corresponding to the network slice group information, and determine a set of slice groups (e.g., NSASG) and corresponding slices (e.g., S-NSSAI) that the N3IWF 124 or TNAP 125 may support based on the configuration information. Then, at operation 670, the N3IWF 124 or TNAP 125 may send a response message to the UE 110 that may include a set of slice groups.

[0090] After querying all candidate N3IWFs or TNAPs, based on the identifier of the N3IWF or TNAP indicated in the response message, the UE 110 can know which N3IWF or TNAP supports which set of network slices. Based on this information, the UE 110 can select the N3IWF or TNAP that best supports the slice set that the UE wants to use. Other aspects of operations 670 and 670 are similar to the above operations 430 and 440, and are not repeated here.

[0091] Figure 8 1 is a flowchart of an example method 700 for discovering a non-3GPP access network device according to an example embodiment of the present application. The method 700 may be implemented at a terminal device (e.g., the UE 110 discussed above). It should be understood that the steps shown in the dashed boxes represent optional steps and may be omitted in some example embodiments. In some example embodiments, the method 700 may also include one or more steps performed at the UE 110, as described above with respect to Figure 2-7 It should also be understood that the above reference Figure 2-7 Details of some of the steps in process 700 are discussed, and process 700 will be described here in a simplified manner.

[0092] At block 710, the terminal device may receive network slice group information corresponding to the network slice identification information of the terminal device from the core network device.

[0093] At block 720 , the terminal device may receive a public key associated with the access network device from the core network device.

[0094] At block 730, the terminal device may encrypt the network slice group information using a public key.

[0095] Step 740: The terminal device sends a request message to the access network device, and the request message includes network slice group information corresponding to the network slice identification information of the terminal device.

[0096] At block 750, the terminal device may receive from the access network device an identification of a non-3GPP access network device serving at least one network slice indicated in the network slice identification information in response to the request message.

[0097] In some exemplary embodiments, the identifier of the non-3GPP access network device is an address of the non-3GPP access network device.

[0098] Fig. 91 is a flowchart of an example method 800 for discovering a non-3GPP access network device according to an example embodiment of the present application. The method 800 may be implemented at an access network device (e.g., the N3IWF 124, TNAP 125, or AN NRF 126 discussed above). It should be understood that the steps shown in the dashed boxes represent optional steps and may be omitted in certain example embodiments. In some example embodiments, the method 800 may also include the steps described above with respect to Figure 2-7 The one or more steps performed at N3IWF 124, TNAP 125 or AN NRF 126. It should also be understood that the above reference has been made to Figure 2-7 Details of some of the steps in process 800 are discussed, and process 800 will be described here in a simplified manner.

[0099] At box 810, the access network device can receive configuration information indicating a mapping between network slice group information and network slice identification information from the core network device.

[0100] At block 820 , the access network device may receive a private key associated with the access network device from the core network device.

[0101] At box 830, the access network device may receive a request message from the terminal device including network slice group information corresponding to the network slice identification information of the terminal device.

[0102] At box 840, the access network device can use the private key to decrypt the network slice group information.

[0103] At box 850, the access network device can extract network slice identification information corresponding to the network slice group information based on the configuration information.

[0104] At block 860 , the access network device may send, in response to the request message, to the terminal device an identification of a non-3GPP access network device that can serve at least one network slice indicated in the network slice identification information.

[0105] In some example embodiments, the identification of the non-3GPP network node is determined based on at least the network slice identification information and the identification of the terminal device. For example, the identification of the terminal device is the IP address of the terminal device indicated in the request message.

[0106] Fig.10 1 is a flow chart showing an example method 900 for discovering a non-3GPP access network device according to an example embodiment of the present application. The method 900 may be implemented at a core network device (e.g., the AMF 132 discussed above). In some example embodiments, the method 900 may also include one or more steps performed at the core network device 130, as described above with respect to Figure 2-7It should also be understood that the above reference Figure 2-7 Details of some of the steps in process 900 are discussed, and process 900 will be described here in a simplified manner.

[0107] At box 910, the core network device can determine the network slice group information corresponding to the network slice identification information of the terminal device.

[0108] At block 920 , the core network device may send a public key associated with the access network device to the terminal device.

[0109] At block 930 , the core network device may send a private key associated with the public key to the access network device.

[0110] At box 940, the core network device can send configuration information indicating the mapping between the network slice group information and the network slice identification information to an access network device in a non-3GPP access network configured to provide access to the terminal device.

[0111] Fig.11 1 is a schematic block diagram illustrating a device in a communication system 1000 in which an exemplary embodiment of the present application may be implemented. Fig.11 As shown, the communication system 1000 may include a terminal device 1010 which may be implemented as the above-mentioned UE 110, an access network device 1020 which may be implemented as the above-mentioned N3IWF 124, TNAP 125 or AN NRF 126, and a core network device 1030 which may be implemented as the above-mentioned AMF 132.

[0112] See also Fig.11 , the terminal device 1010 may include one or more processors 1012 and one or more memories 1014 interconnected by one or more buses. The one or more buses may be address, data or control buses, and may include any interconnection mechanism, such as a series of lines on a motherboard or integrated circuit, optical fiber, optical device or other optical communication device, etc. The one or more memories 1014 may include program instructions 1016. The one or more memories 1014 and the program instructions 1016 may be configured to, when executed by one or more processors 1012, cause the terminal device 1010 to perform the processes and steps related to the UE 110 as described above. In addition, in various example embodiments, the example device 1010 may also include one or more transceivers. Each of the one or more transceivers may include a receiver and a transmitter, which are connected to one or more antennas. The terminal device 1010 may wirelessly communicate with the access network device 1020 via one or more antennas.

[0113] The access network device 1020 may include one or more processors 1022 interconnected by one or more buses, and one or more memories 1024. The one or more buses may be address, data or control buses, and may include any interconnection mechanism, such as a series of lines on a motherboard or integrated circuit, optical fibers, optical devices or other optical communication devices, etc. In addition, in various example embodiments, the example device 1020 may also include one or more network interfaces. The one or more network interfaces may provide a wired or wireless communication link through which the access network device 1020 can communicate with other network devices, entities, elements or functions. The one or more memories 1024 may include program instructions 1026. The one or more memories 1024 and the program instructions 1026 may be configured to, when executed by the one or more processors 1022, cause the access network device 1020 to perform the processes and steps related to the N3IWF 124, TNAP 125 or AN NRF 126 as described above.

[0114] The core network device 1030 may include one or more processors 1032 interconnected by one or more buses, and one or more memories 1034. The one or more buses may be address, data or control buses, and may include any interconnection mechanism, such as a series of lines on a motherboard or integrated circuit, optical fiber, optical device or other optical communication device, etc. In addition, in various example embodiments, the example device 1030 may also include one or more network interfaces. One or more network interfaces may provide a wired or wireless communication link through which the core network device 1030 can communicate with other network devices, entities, elements or functions. For example, the core network device 1030 may communicate with the terminal device 1010 via the N1 interface and communicate with the access network device 1020 via the N2 interface. One or more memories 1034 may include program instructions 1036. One or more memories 1034 and program instructions 1036 may be configured to, when executed by one or more processors 1032, cause the core network device 1030 to perform the processes and steps related to the AMF 132 as described above.

[0115] The one or more processors 1012, 1022, 1032 discussed above can be any suitable type suitable for the local technical network, and can include one or more of a general-purpose processor, a special-purpose processor, a microprocessor, a digital signal processor (DSP), one or more processors in a processor-based multi-core processor architecture, and special-purpose processors such as those developed based on field programmable gate arrays (FPGAs) and application-specific integrated circuits (ASICs). One or more processors 1012, 1022, and 1032 can be configured to control other elements of the network device / network node and operate in conjunction with them to implement the processes discussed above.

[0116] One or more memories 1014, 1024, and 1034 may include at least one storage medium in various forms, such as temporary memory and / or non-temporary memory. Temporary memory may include, but is not limited to, for example, random access memory (RAM) or cache. Non-temporary memory may include, but is not limited to, for example, read-only memory (ROM), hard disk, flash memory, etc. The term "non-temporary" as used herein is a limitation of the media itself (i.e., tangible, not a signal), rather than a limitation of data storage persistence (e.g., RAM vs. ROM). In addition, one or more memories 1014, 1024, and 1034 may include, but are not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any combination of the foregoing.

[0117] It should be understood that the blocks in the figure can be implemented in a variety of ways, including software, hardware, firmware, or any combination thereof. In some embodiments, one or more blocks can be implemented using software and / or firmware (e.g., machine executable instructions stored in a storage medium). In addition to or in place of machine executable instructions, some or all of the blocks in the figure can be implemented at least in part by one or more hardware logic components. For example, but not limited to, exemplary types of hardware logic components that can be used include field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chip (SOCs), complex programmable logic devices (CPLDs), etc.

[0118] Fig.12 1 is a schematic functional block diagram of a device 1100 according to an exemplary embodiment of the present application. The device 1100 may be implemented at a terminal device such as a UE 110 to perform operations related to the UE 110 as described above. Figure 2-7 The operations related to the UE 110 are discussed in detail, so the blocks of the device 1100 will be briefly described here, and the details thereof can be referred to the above description.

[0119] See also Fig.12 , the device 1100 may include: a first device 1110, used to send a request message including network slice group information corresponding to the network slice identification information of the terminal device to the access network device; and a second device 1120, used to receive from the access network device an identification of a non-3GPP access network device that can serve at least one network slice indicated in the network slice identification information in response to the request message.

[0120] In some example embodiments, device 1100 may also include a third device for receiving network slice group information corresponding to the network slice identification information of the terminal device from the core network device.

[0121] In some example embodiments, device 1100 may also include a fourth device for receiving a public key associated with the access network device from the core network device; and encrypting the network slice group information using the public key.

[0122] In some exemplary embodiments, the identification of the non-3GPP access network device is an address of the non-3GPP access network device.

[0123] Fig.13 1 is a schematic functional block diagram of a device 1200 according to an exemplary embodiment of the present application. The device 1200 may be implemented at an access network node (such as N3IWF 124, TNAP 125 or AN NRF 126) to perform operations related to these nodes as described above. Figure 2-7 Operations related to the N3IWF 124, the TNAP 125, or the ANRF 126 are discussed in detail, so the blocks of the device 1200 will be briefly described here and the details thereof may refer to the above description.

[0124] See also Fig.13 , the device 1200 may include: a first device 1210, used to receive a request message from a terminal device, the request message including network slice group information corresponding to the network slice identification information of the terminal device; a second device 1220, used to send, in response to the request message, to the terminal device an identifier of a non-3GPP access network device that can serve at least one network slice indicated in the network slice identification information.

[0125] In some example embodiments, the device 1200 may also include a third device for receiving configuration information indicating a mapping between network slice group information and network slice identification information from a core network device.

[0126] In some example embodiments, device 1200 may further include a fourth device for extracting network slice identification information corresponding to the network slice group information of the terminal device based on the configuration information.

[0127] In some example embodiments, the identification of the non-3GPP network node is determined based at least on the network slice identification information and the identification of the terminal device.

[0128] In some exemplary embodiments, the identifier of the terminal device is the IP address of the terminal device indicated in the request message.

[0129] In some example embodiments, device 1200 may also include a fifth device for receiving a private key associated with the access network device from the core network device; and using the private key to decrypt the network slice group information.

[0130] Fig.14 1 is a schematic functional block diagram of a device 1300 according to an exemplary embodiment of the present application. The device 1300 may be implemented at a network function such as a core network device 130 to perform operations related to the core network device 130 as described above. Figures 2 to 7 The operations related to the core network device 130 are discussed in detail, so the blocks of the device 1300 will be briefly described here, and the details can refer to the above description.

[0131] See also Fig.14 , the device 1300 may include: a first device 1310, used to determine the network slice group information corresponding to the network slice identification information of the terminal device; a second device 1320, used to send configuration information indicating the mapping relationship between the network slice group information and the network slice identification information to an access network device in a non-3GPP access network configured to provide access to the terminal device.

[0132] In some exemplary embodiments, the device 1300 may further include a third means for sending a public key associated with the access network device to the terminal device; and sending a private key associated with the public key to the access network device.

[0133] Some exemplary embodiments also provide program instructions or instructions that, when executed by one or more processors, enable the device or apparatus to perform the above-described processes. The program instructions for performing the processes of the exemplary embodiments may be written in any combination of one or more programming languages. The program instructions may be provided to one or more processors or controllers of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the processor or controller executes the program instructions, the functions / operations specified in the flow chart and / or block diagram are implemented. The program instructions may be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine, partially on a remote machine, or entirely on a remote machine or server.

[0134] Some exemplary embodiments also provide a computer program product or computer readable medium having program instructions or instructions stored therein. A computer readable medium may be any tangible medium that may include or store a program used by or in combination with an instruction execution system, device, or apparatus. A machine readable medium may be a machine readable signal medium or a machine readable storage medium. A machine readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. More specific examples of machine readable storage media include an electrical connection with one or more wires, a portable computer floppy disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0135] As used herein, “at least one of: ” and “at least one of ” and similar expressions, where a list of two or more elements is connected by “and” or “or”, mean at least any one of the elements, or at least any two or more of the elements, or at least all of the elements.

[0136] In addition, although operations are depicted in a particular order, this should not be construed as requiring the execution of these operations in the particular order shown or in a continuous order, or the execution of all operations shown, to achieve the desired result. In some cases, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these details should not be considered as limitations on the scope of the present application, but should be considered as descriptions of features that may be specific to a particular embodiment. Certain features described in the context of a separate embodiment may also be implemented in combination in a single embodiment. On the contrary, the various features described in the context of a single embodiment may also be implemented in multiple embodiments individually or in any suitable sub-combination.

[0137] Although the subject matter has been described in language specific to structural features and / or methodological acts, it is to be understood that the subject matter defined in the appended claims is not limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as examples of implementing the claims.

Claims

1. A terminal device, comprising: at least one processor; as well as at least one memory storing instructions, which, when executed by the at least one processor, causes the terminal device to at least: Sending a request message to an access network device, wherein the request message includes network slice group information corresponding to the network slice identification information of the terminal device; Receive, from the access network device in response to the request message, an identification of a non-3GPP access network device capable of serving at least one network slice indicated in the network slice identification information.

2. The terminal device according to claim 1, wherein: The at least one memory further stores instructions, which, when executed by the at least one processor, cause the terminal device to at least: Receive the network slice group information corresponding to the network slice identification information of the terminal device from the core network device.

3. The terminal device according to claim 1 or 2, wherein: The at least one memory further stores instructions, which, when executed by the at least one processor, cause the terminal device to at least: receiving, from a core network device, a public key associated with the access network device; as well as The network slice group information is encrypted using the public key.

4. A terminal device as claimed in any one of the preceding claims, wherein: The identifier of the non-3GPP access network device is the address of the non-3GPP access network device.

5. A network access device, comprising: at least one processor; as well as at least one memory storing instructions, which, when executed by the at least one processor, causes the access network device to at least: Receive a request message from a terminal device, wherein the request message includes network slice group information corresponding to the network slice identification information of the terminal device; as well as In response to the request message, an identifier of a non-3GPP access network device that can serve at least one network slice indicated in the network slice identification information is sent to the terminal device.

6. The access network device according to claim 5, wherein: The at least one memory further stores instructions that, when executed by the at least one processor, cause the access network device to at least: Configuration information indicating a mapping between network slice group information and network slice identification information is received from a core network device.

7. The access network device according to claim 6, wherein: The at least one memory further stores instructions that, when executed by the at least one processor, cause the access network device to at least: Based on the configuration information, the network slice identification information corresponding to the network slice group information of the terminal device is extracted.

8. The access network device according to any one of claims 5 to 7, wherein: The identification of the non-3GPP network node is determined based at least on the network slice identification information and the identification of the terminal device.

9. The access network device according to claim 8, wherein: The identifier of the terminal device is the IP address of the terminal device indicated in the request message.

10. The access network device according to any one of claims 5 to 9, wherein: The at least one memory further stores instructions that, when executed by the at least one processor, cause the access network device to at least: receiving, from a core network device, a private key associated with the access network device; as well as Use the private key to decrypt the network slice group information.

11. A core network device, comprising: at least one processor; as well as at least one memory storing instructions, which, when executed by the at least one processor, cause the core network device to at least: Determine the network slice group information corresponding to the network slice identification information of the terminal device; Configuration information indicating a mapping between network slice group information and network slice identification information is sent to an access network device in a non-3GPP access network used to provide access to a terminal device.

12. The core network device according to claim 11, wherein: The at least one memory further stores instructions, which, when executed by the at least one processor, cause the core network device to at least: Sending a public key associated with the access network device to the terminal device; A private key associated with the public key is sent to the access network device.

13. A method implemented at a terminal device, comprising: Sending a request message to an access network device, wherein the request message includes network slice group information corresponding to the network slice identification information of the terminal device; as well as Receive, from the access network device in response to the request message, an identification of a non-3GPP access network device capable of serving at least one network slice indicated in the network slice identification information.

14. The method of claim 13, further comprising: Receive the network slice group information corresponding to the network slice identification information of the terminal device from the core network device.

15. The method according to claim 13 or 14, further comprising: receiving, from a core network device, a public key associated with the access network device; as well as The network slice group information is encrypted using the public key.

16. The method according to any one of claims 13 to 15, wherein: The identifier of the non-3GPP access network device is the address of the non-3GPP access network device.

17. A method implemented at an access network device, comprising: Receive a request message from a terminal device, wherein the request message includes network slice group information corresponding to the network slice identification information of the terminal device; as well as In response to the request message, an identification of a non-3GPP access network device capable of serving at least one network slice indicated in the network slice identification information is sent to the terminal device.

18. The method of claim 17, further comprising: Configuration information indicating a mapping between network slice group information and network slice identification information is received from a core network device.

19. The method of claim 18, further comprising: Based on the configuration information, the network slice identification information corresponding to the network slice group information of the terminal device is extracted.

20. The method of any one of claims 17 to 19, wherein: The identification of the non-3GPP network node is determined based at least on the network slice identification information and the identification of the terminal device.

21. The method of claim 20, wherein: The identifier of the terminal device is the IP address of the terminal device indicated in the request message.

22. The method of any one of claims 17 to 21, further comprising: receiving, from a core network device, a private key associated with the access network device; as well as Use the private key to decrypt the network slice group information.

23. A method implemented at a core network device, comprising: Determine the network slice group information corresponding to the network slice identification information of the terminal device; as well as Configuration information indicating the mapping between network slice group information and network slice identification information is sent to an access network device in a non-3GPP access network used to provide access to the terminal device.

24. The method of claim 23, further comprising: Sending a public key associated with the access network device to the terminal device; A private key associated with the public key is sent to the access network device.

25. An apparatus comprising: A device for sending a request message to an access network device, wherein the request message includes network slice group information corresponding to the network slice identification information of the terminal device; as well as A device for receiving, from the access network device in response to the request message, an identification of a non-3GPP access network device capable of serving at least one network slice indicated in the network slice identification information.

26. The apparatus of claim 25, further comprising: Apparatus for carrying out the method according to any one of claims 14 to 16.

27. An apparatus comprising: An apparatus, configured to receive a request message from a terminal device, wherein the request message includes network slice group information corresponding to the network slice identification information of the terminal device; as well as A device for sending, in response to the request message, to the terminal device an identifier of a non-3GPP access network device that can serve at least one network slice indicated in the network slice identification information.

28. The apparatus of claim 27, further comprising: Apparatus for carrying out the method of any one of claims 18 to 22.

29. An apparatus comprising: Device, used to determine network slice group information corresponding to the network slice identification information of the terminal device; A device for sending configuration information indicating the mapping between network slice group information and network slice identification information to an access network device in a non-3GPP access network for providing access to a terminal device.

30. The apparatus of claim 29, further comprising: Apparatus for performing the method of claim 24.

31. A computer-readable medium comprising program instructions, which, when executed by an apparatus, cause the apparatus to at least perform the method of any one of claims 13 to 24.

Images