Network and method for handling network access control

Abstract

A network for handling network access control includes a memory and a processor. The memory stores instructions, and a processor connected with the memory is configured to execute the following instructions: receiving a registration request from a communication device; in response to receiving the registration request, determining whether validity information in a UE subscription of a stand-alone non-public network (SNPN) for providing a localized service is satisfied or not; and rejecting the registration request when the validity information is not satisfied, which results in rejecting the communication device with an appropriate cause code to prevent the communication device from reselecting or registering the network in an SNPN selection procedure.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to U.S. Provisional Patent Application No. 63 / 385,997 filed on December 5, 2022, and cites the entire disclosure of that patent application as a part of this application. Background Art

[0004] A Public Land Mobile Network (PLMN) is a network established and operated by an administrative authority or a recognized operating organization (ROA) with the specific purpose of providing land mobile communication services to the public. PLMN provides communication possibilities for mobile users. PLMN can provide services in one or more frequency bands. Access to PLMN services is achieved through an air interface involving radio communications between mobile phones and base stations with integrated IP network services. A PLMN may include multiple radio access networks (RANs) using different radio access technologies (RATs) for accessing mobile services. The radio access network is the part of the mobile communication system that implements the radio access technology. Conceptually, the RAN is located at the connection between the mobile device and its core network (CN). According to the standards, mobile phones and other wireless connection devices are called user equipment (UE, i.e. MS), terminal equipment (TE), mobile station (MS, i.e. UE), mobile terminal (MT), etc. Examples of different RATs include 2G GERAN (GSM) radio access network, 3G UTRAN (UMTS) radio access network, 4G E-UTRAN (LTE), 5G New Radio (NR) radio access network, Next Generation RAN (NG-RAN), and other non-3GPP access RATs including WiFi.

[0005] In contrast to PLMN, a non-public network (NPN) is a network used for non-public purposes. NPN is either a standalone non-public network (SNPN), which is operated by an NPN operator and does not rely on network functions provided by the PLMN; or a public network integrated NPN (PNI-NPN), which is a non-public network deployed with the support of a PLMN. A Credentials Holder (CH) can authenticate and authorize access to a SNPN that is separate from the Credentials Holder. The combination of a PLMN ID and a Network Identifier (NID) identifies a SNPN. The UE may be enabled for a SNPN.

[0006] A PNI-NPN is an NPN provided through a PLMN, for example, through a dedicated DNN or one (or more) network slice instances assigned to the NPN. When a PNI-NPN is provided through a PLMN, the UE must have a subscription to the PLMN to access the PNI-NPN. Since network slicing cannot prevent UEs from attempting to access the network in areas where the network slices assigned to the NPN are not allowed, access control for PNI-NPNs can be implemented using closed access groups. A Closed Access Group (CAG) identifies a group of subscribers that are allowed to access one or more CAG cells associated with the CAG. CAG is used for PNI-NPN to prevent UEs that are not allowed to access the NPN through the associated cell from automatically selecting and accessing the associated CAG cell. CAG is used for access control, for example, authorization at the time of cell selection and is configured in the subscription as part of mobility restrictions. CAG is identified by a CAG identifier, which is unique within the scope of the PLMN ID.

[0007] Local or localized services refer to services that are localized (e.g., available in a specific / limited area and / or limited in time). Localized service providers are application providers or network operators who localize their services and provide services to end users over a hosted network. A hosted network is a network that provides (access to) localized services, a hosted network can be a SNPN or a PNI-NPN, and a home network is a network that has a subscription or credentials currently used by the UE. A home network can be a home PLMN or a subscription SNPN. The end user can enable or disable access to localized services. If the end user disables access to localized services, the UE (i.e., MS) may not access the NPN that provides localized services.

[0008] In order to provide (access) localized services to UE, the UE needs to be able to discover, select and access the NPN (as a hosting network) that provides localized services. Summary of the invention

[0009] A network for processing network access control includes a memory and a processor. The memory stores instructions, and the processor connected to the memory is configured to execute the following instructions: receiving a registration request from a communication device; in response to receiving the registration request, determining whether validity information in a UE subscription of a standalone non-public network (SNPN) for providing localized services is satisfied; and when the validity information is not satisfied, rejecting the registration request, which results in rejecting the communication device with an appropriate reason code to prevent the communication device from selecting or registering the network again in the SNPN selection procedure.

[0010] A method for processing network access control of a network, comprising: receiving a registration request from a communication device; in response to receiving the registration request, determining whether validity information in a UE subscription to a stand-alone non-public network (SNPN) for providing localized services is satisfied; and when the validity information is not satisfied, rejecting the registration request, which results in rejecting the communication device with an appropriate reason code to prevent the communication device from selecting or registering the network again in the SNPN selection procedure.

[0011] Other embodiments and advantages are described in the detailed description that follows. This abstract is not intended to define the invention. The invention is defined by the claims.

[0012] These and other objects of the present invention will no doubt become apparent to those of ordinary skill after reading the following description of the preferred embodiments and viewing the various figures and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 Schematically shown is a communication system having a public land mobile network (PLMN), a standalone non-public network (SNPN), and a public network integrated NPN (PNI-NPN) supporting (hosted) network and cell selection with localized services, according to a novel aspect.

[0014] Figure 2 A simplified block diagram of user equipment and network entities is shown according to an embodiment of the present invention.

[0015] Figure 3A A first embodiment of a 5G system architecture for accessing a SNPN using credentials from a credential holder is shown.

[0016] Figure 3B A second embodiment of a 5G system architecture for accessing a SNPN using credentials from a credential holder is shown.

[0017] Figure 4 An example of an NG-RAN mode is shown which broadcasts certain information to provide access to the SNPN.

[0018] Figure 5A An example of an SNPN enabled UE configured with 2 SNPN subscriptions (ie 2 subscribed SNPNs in the "Subscriber Data List") is shown.

[0019] Figure 5B An example of an SNPN enabled UE configured with 2 PLMN subscriptions (ie 2 USIMs) is shown.

[0020] Figure 6The network selection in SNPN access mode is shown, including automatic SNPN network selection and manual SNPN network selection.

[0021] Fig. 7A A first embodiment of network and cell selection and access control for a CAG cell of a PNI-NPN (CAG) is shown, wherein access to the CAG cell is accepted.

[0022] Figure 7B A second embodiment of network and cell selection and access control for non-CAG cells (public cells) is shown, wherein access to a PLMN is accepted.

[0023] Fig. 8A A first embodiment of network and cell selection and access control for a CAG cell of a PNI-NPN (CAG) is shown, wherein access to the CAG cell is denied.

[0024] Figure 8B A second embodiment of network and cell selection and access control for non-CAG cells (public cells) is shown, wherein access to the PLMN is denied.

[0025] Fig. 9A An example of a UE using validity information to discover, select and access an NPN (as a hosting network) that provides localized services is shown.

[0026] Fig. 9B Another example is shown in which the UE uses the validity information associated with the SNPN to discover, select and access the NPN (as a hosting network) that provides localized services and receives the localized services.

[0027] Fig. 9C Different examples are shown in which a UE discovers, selects, and accesses an NPN (as a hosting network) providing localized services using validity information associated with a CAG (CAG) of a PLMN and receives the localized services.

[0028] Fig. 10A A first example of accessing a SNPN (as a hosting network) providing localized services is shown, where the access is accepted.

[0029] Fig. 10B A second example of accessing a SNPN (as a hosting network) providing localized services is shown, where access is denied.

[0030] Fig.11A A first example of accessing a PNI-NPN / CAG (as a hosting network) providing localized services is shown, where the access is accepted.

[0031] Fig. 11BA second example of accessing a PNI-NPN / CAG (as a hosted network) providing localized services is shown, where access is denied.

[0032] Fig.12 An embodiment is shown in which the UE receives updated CAG-related configurations through a CAG cell, enters the LIMITED-SERVICE state, and searches for a suitable cell in the current network.

[0033] Fig.13 Another embodiment is shown in which the UE receives updated CAG-related configurations through a CAG cell, enters the LIMITED-SERVICE state, and searches for a suitable cell in the current network.

[0034] Fig.14 An embodiment is shown in which the UE receives updated CAG-related configurations through a CAG cell, enters the PLMN-SEARCH state and applies a network selection procedure when the UE has no emergency PDU session.

[0035] Fig.15 An embodiment is shown in which the UE receives updated CAG-related configurations through a non-CAG cell, enters the LIMITED-SERVICE state, and searches for a suitable cell in the current network.

[0036] Fig.16 Another embodiment is shown in which the UE receives updated CAG-related configuration through a non-CAG cell, enters the PLMN-SEARCH state and applies the network selection process.

[0037] Fig.17 A process of a network according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0038] Reference will now be made in detail to some embodiments of the present invention, which are illustrated in the accompanying drawings.

[0039] Figure 1Schematically shown is a communication system 100 having a public land mobile network (PLMN) 110, a standalone non-public network (SNPN) 120, and a public network integrated NPN (PNI-NPN) (closed access group (CAG)) 130 providing localized service access, according to a novel aspect. The PLMN network 110 includes control plane functions, user plane functions (e.g., UPF), and applications that provide various services by communicating with multiple user equipments (UEs), including UE 101. A serving base station gNB 112 is part of a radio access network RAN ​​140. The RAN 140 provides radio access to the UE 101 via a radio access technology (RAT). An access and mobility management function (AMF) in the PLMN 110 communicates with the gNB 112. The UE 101 may be equipped with a radio frequency (RF) transceiver or multiple RF transceivers.

[0040] The SNPN network 120 includes control plane functions, user plane functions (e.g., UPF), and applications that provide various services by communicating with multiple user equipments (UEs), including UE 101. A combination of a PLMN ID and a network identifier (NID) identifies a SNPN. A serving base station gNB 122 is part of the RAN 150. The RAN 150 provides radio access to the UE 101 via a RAT. The AMF in the SNPN 120 communicates with the gNB 122. The SNPN 120 is operated by an NPN operator and does not rely on network functions provided by the public network. A credential holder (CH) can authenticate and authorize access to the SNPN independently of the credential holder. The NG-RAN node that provides access to the SNPN broadcasts the following information: one or more PLMN IDs, and a list of NIDs (123) for each PLMN ID identifying the non-public networks to which the NG-RAN provides access. A UE supporting SNPN is configured with a PLMN ID and NID (SNPN ID) of a subscribed SNPN, and a SNPN-enabled UE supporting access to the SNPN using credentials of a credential holder may also be configured with information for SNPN selection (SNPN selection information or configuration) and registration using a SNPN subscription or using a PLMN subscription (USIM) (in SNPN access mode) (102).

[0041] The PNI-NPN (CAG) network 130 includes a control plane function (optionally, it may rely on the control plane function of the PLMN), a user plane function (optionally, it may rely on the user plane function of the PLMN), and applications that provide various services by communicating with multiple user equipments (UEs), including UE 101. The PNI-NPN (CAG) 130 is a non-public network deployed with the support of a PLMN, e.g., PLMN 110, by sharing, e.g., RAN / gNB 112 and, e.g., control plane functions. A closed access group (CAG) identifies a group of subscribers who are allowed to access one or more CAG cells associated with the CAG. CAG is used for PNI-NPN to prevent UEs that are not allowed to access the NPN through the associated cells from automatically selecting and accessing the associated CAG cells. The CAG is identified by a CAG identifier, which is unique within the PLMN ID range. The CAG cell broadcasts one or more CAG identifiers for each PLMN (113), and the UE is configured with CAG-related configuration / information (e.g., an (enhanced) CAG information list containing a list of allowed CAGs for each PLMN) (102).

[0042] Local or localized services refer to services that are provided in a specific / limited area (i.e., available in a specific area and / or limited in time (specific period of time)). Localized service providers are application providers or network operators who localize their services and provide them to end users through a hosted network. A hosted network is a network that provides access to localized services and can be either a SNPN or a PNI-NPN, while a home network is a network that has a subscription or credentials that the UE is currently using. Figure 1 In the example of FIG. 1 , both SNPN 120 and PNI-NPN (CAG) 130 may be hosted networks that provide localized service access to UE 101 .

[0043] URSP rules may include the association of UE applications with DNNs or network slices for specific localized services. URSP rules may also include "routing validity criteria" (time windows and / or location criteria validity conditions) that define the time / location of specific localized services. Local Access Data Networks (LADNs) may also be used to enable UEs to access localized services.

[0044] In order to enable the PNI-NPN or SNPN to provide localized service access, the PNI-NPN or SNPN operator configures the network to enable the UE to access the localized service based on the availability of the localized service, and the information is negotiated with the localized service provider, such as: (a) identification of each localized service, for example, for URSP rules; (b) validity criteria / limitations for each localized service, for example, time duration and / or (regional) location validity.

[0045] When the localized service in a network is completed, it is expected that all UEs registered to the network will move to other networks or other cells within the same network. The other network can be a Home PLMN (HPLMN), a Visited PLMN (VPLMN), or another SNPN. The UE may stop using the network resources of the localized service for a number of reasons, such as: (a) the localized service in the network is completed; (b) the validity conditions of the network selection information are no longer met; (c) the user decides to stop using the localized service before the localized service is completed (e.g., the end user disables access to the localized service); (d) the network makes a policy decision that causes the UE to be deregistered before the localized service is completed. The validity information or restrictions or criteria or conditions (103) are provided or configured to the UE as part of the localized service information to restrict the UE from accessing the SNPN / PNI-NPN (as a hosting network) that provides the localized service. In order to provide the UE with the localized service, the UE needs to be able to discover, select and access the SNPN / PNI-NPN (as a hosting network) that provides the localized service. The discovery mechanism is based on providing or configuring appropriate information to the UE.

[0046] Figure 2 A simplified block diagram of a wireless device is shown, for example, a user equipment (UE) 201 and a network entity 211 according to an embodiment of the present invention. The network entity 211 may be a base station combined with an access and mobility management function (AMF). The network entity 211 has an antenna 215 for sending and receiving radio signals. A radio frequency (RF) transceiver module 214 connected to the antenna receives the RF signal from the antenna 215, converts it into a baseband signal and sends it to the processor 213. The RF transceiver module 214 also converts the received baseband signal from the processor 213 into an RF signal and sends it to the antenna 215. The processor 213 processes the received baseband signal and calls different functional modules to perform features in the base station 211. The memory 212 stores program instructions and data 220, which are executed by the processor 213 to control the operation of the base station 211. In Figure 2 In the example of , the network entity 211 also includes a set of control function modules and circuits 290. The registration circuit 231 handles registration and mobility procedures. The session management circuit 232 handles session management functions. The configuration and control circuit 233 provides different parameters to configure and control the UE.

[0047] Likewise, UE 201 has a memory 202, a processor 203, and a radio frequency (RF) transceiver module 204. The RF transceiver module 204 is connected to an antenna 205, receives RF signals from the antenna 205, converts them into baseband signals, and sends them to the processor 203. The RF transceiver module 204 also converts the received baseband signals from the processor 203 into RF signals and sends them to the antenna 205. The processor 203 processes the received baseband signals and calls different functional modules and circuits to perform the features in UE 201. The memory 202 stores data and program instructions 210, which are executed by the processor to control the operation of UE 201. Suitable processors include, for example, dedicated processors, digital signal processors (DSPs), multiple microprocessors, one or more microprocessors associated with a DSP core, controllers, microcontrollers, application specific integrated circuits (ASICs), field programmable gate arrays (FPGA) circuits, and other types of integrated circuits (ICs) and / or state machines. The processor associated with the software can be used to implement and configure the features of UE 201.

[0048] UE 201 also includes a set of functional modules and control circuits to perform the functional tasks of UE 201. Protocol stack 260 includes a non-access layer (NAS) to communicate with the AMF entity connected to the core network, a radio resource control (RRC) layer for high-level configuration and control, a packet data convergence protocol / radio link control (PDCP / RLC) layer, a medium access control (MAC) layer, and a physical (PHY) layer. System modules and circuits 270 can be implemented and configured by software, firmware, hardware, and / or a combination thereof. When executed by a processor through program instructions stored in a memory, these functional modules and circuits cooperate with each other to allow UE 201 to perform embodiments and functional tasks and features in the network. In one example, the system modules and circuits 270 include a registration circuit 221 that performs registration and mobility procedures with the network, a network and cell selection circuit 222 that performs network and cell selection, a PLMN / PNI-NPN (CAG) / SNPN information maintenance circuit 223 that handles adding, removing and resetting one or more PLMN / PNI-NPN (CAG) / SNPN information in the SIM / USIM and / or UE (non-volatile) memory (the information may come from signaling, etc.), and a configuration and control circuit 224 that handles configuration and control parameters. Please note that information related to network selection and registration, such as HPLMN, operator-controlled PLMN / SNPN selector list, user-controlled PLMN / SNPN selector list, can be stored in the SIM / USIM 225 and / or UE (non-volatile) memory.

[0049] SNP

[0050] Figure 3AA first embodiment of a 5G system architecture for accessing a SNPN using credentials from a credential holder is presented. Figure 3A The 5G system architecture of SNPN with credential holder (CH) using AAA server for primary authentication and authorization is described. The AUSF and UDM in SNPN can support primary authentication and authorization of UE using credentials from AAA server in credential holder (CH). Figure 3A The SNPN in can be the SNPN to which the UE subscribes (i.e., the SNPNID of the SNPN to which the UE subscribes is broadcast by the NG-RAN). As a deployment option, Figure 3A The SNPN in may also be another SNPN other than the SNPN to which the UE subscribes (i.e., none of the SNPN IDs broadcast by the NG-RAN matches the SNPN ID corresponding to the SNPN to which the UE subscribes). The NSSAAF deployed in the SNPN may support primary authentication in the SNPN using credentials from the credential holder, using an AAA server (as shown), and / or the NSSAAF may support network slice-specific authentication and authorization with a network slice-specific AAA server (not shown).

[0051] Figure 3B A second embodiment of a 5G system architecture for accessing a SNPN using credentials from a credential holder is presented. Figure 3B The 5G system architecture of SNPN with primary authentication and authorization using AUSF and UDM and network slicing is described. The SNPN can support primary authentication and authorization of UE using AUSF and UDM using credentials from the credential holder. The credential holder can be a SNPN or a PLMN. The credential holder UDM provides subscription data to the SNPN.

[0052] Figure 4 An example of an NG-RAN mode is shown that broadcasts certain information to provide access to a SNPN. A Credential Holder (CH) can authenticate and authorize access to a SNPN that is separate from the Credential Holder. For SNPN identification, the combination of the PLMN ID and the Network Identifier (NID) identifies a SNPN. Two allocation models are supported for NIDs. Under the self-allocated model, the NID is selected individually by the SNPN at deployment time (and therefore may not be unique), but uses a different numbering space than coordinated allocated NIDs. Under the coordinated allocation model, NIDs are allocated using one of two options: 1) NIDs are allocated to be globally unique, independent of the PLMN ID used; or 2) NIDs are allocated to be globally unique, with the combination of the NID and PLMN ID.

[0053] The network-selected Group ID (GIN) supports two allocation models. Under the self-allocation model, the GIN is selected by an individual and therefore may not be unique. Under the coordinated allocation model, the GIN uses a combination of the PLMN ID and the NID and is allocated using one of two options: 1) the GIN is allocated such that the NID is globally unique (e.g., using the IANA Private Enterprise Number), independent of the PLMN ID used; or 2) the GIN is allocated such that the combination of the NID and the PLMN ID is globally unique.

[0054] exist Figure 4 In the example of , NG-RAN 401 provides access to SNPNs and broadcasts the following information (410): one or more PLMN IDs and a list of NIDs for each PLMN ID that identify non-public networks to which the NG-RAN provides access (e.g., SNPN 1 and SNPN 2). Optionally, the broadcasted information also includes the following: a human-readable network name (HRNN) for each SNPN; an indication for each SNPN indicating whether access is supported using the credentials of the credential holder; a list of network selection group IDs (GINs) supported by each SNPN (e.g., GIN 1 and GIN 2); and an indication for each SNPN indicating whether the SNPN allows registration attempts by UEs that are not explicitly configured to select a SNPN, i.e., the UE does not have any SNPN ID (PLMN ID+NID) or a GIN broadcast by the SNPN in a list of priority SNPNs / GINs controlled by the credential holder.

[0055] Figure 5A An example of an SNPN-enabled UE configured with SNPN subscription information for each subscribed SNPN is shown. Figure 5AIn the example, an SNPN-enabled UE 501 is configured with 2 SNPN subscriptions, as shown in 510 / 520, and each subscribed SNPN includes: the SNPN ID (PLMN ID+NID) of the subscribed SNPN (for example, SNPN 1 for entry 1 in the "Subscriber Data List", SNPN 2 for entry 2); and a subscription identifier (SUPI) and credentials for each subscribed SNPN. If the UE supports accessing the SNPN using the credentials of the credential holder, each subscribed SNPN includes: 1) a list of priority SNPNs controlled by the user (e.g., SNPN 111, SNPN 112 for entry 1; SNPN 211, SNPN 212 for entry 2); 2) a list of priority SNPNs controlled by the credential holder (e.g., SNPN 121, SNPN 122 for entry 1; SNPN 221, SNPN 222 for entry 2); and 3) a list of priority GINs controlled by the credential holder (e.g., GIN131, GIN132 for entry 1; GIN 231, GIN 232 for entry 2).

[0056] Figure 5B An example of an SNPN-enabled UE configured with 2 PLMN subscriptions (i.e., 2 USIMs) is shown. An SNPN-enabled UE that supports access to the SNPN using the credentials of the credential holder and is equipped with a PLMN subscription (USIM) may also be configured with information for SNPN selection and registration using the PLMN subscription (in SNPN access mode). For example, PLMN subscription 1 is associated with SNPN selection information 530: 1) a user-controlled list of priority SNPNs (e.g., SNPN 311, SNPN 312); 2) a credential holder-controlled list of priority SNPNs (e.g., SNPN 321, SNPN 322); and 3) a credential holder-controlled list of priority GINs (e.g., GIN 331, GIN 332). Similarly, PLMN subscription 2 is associated with SNPN selection information 540: 1) a user-controlled list of priority SNPNs (e.g., SNPN 411, SNPN 412); 2) a credential holder-controlled list of priority SNPNs (e.g., SNPN 421, SNPN 422); and 3) a credential holder-controlled list of priority GINs (e.g., GIN 431, GIN 432).

[0057] Subscription to an SNPN is identified either by a SUPI containing a network specific identifier in the form of a Network Access Identifier (NAI). The field part of the NAI may include the NID of the SNPN; or by a SUPI containing the IMSI. For an SNPN-enabled UE with an SNPN subscription, the credential holder-controlled list of priority SNPNs / GINs may be updated by the CH using the Steering of Roaming (SoR) procedure. For an SNPN-enabled UE with a PLMN subscription, the credential holder-controlled list of priority SNPNs / GINs may be updated by the CH using the Steering of Roaming (SoR) procedure. When the credential holder updates the UE with the credential holder-controlled list of priority SNPNs and GINs, the UE may perform SNPN selection again, for example, selecting a SNPN with a higher priority.

[0058] Figure 6 Network selection in SNPN access mode is shown, including automatic SNPN network selection and manual SNPN network selection. An SNPN-enabled UE 601 supports accessing the SNPN (in SNPN access mode). When the UE is set to operate in SNPN access mode, the UE only selects and registers the SNPN. When the UE is set to operate in SNPN access mode, the UE does not perform the normal PLMN selection procedure. There are two SNPN network selection procedures: automatic SNPN network selection procedure and manual SNPN network selection procedure.

[0059] Under automatic SNPN network selection, the UE selects and attempts to register with available and allowed SNPNs in the following order: 1) the SNPN with which the UE last registered (if available) or an equivalent SNPN (if available); 2) the subscribed SNPN, identified by the SNPN ID (PLMN ID + NID) for which the UE possesses the SUPI and credentials; 3) if the UE supports access to the SNPN using the credentials of the credential holder, the UE continues to select and attempt to register with available and allowed SNPNs that are broadcast to support access using the credentials of the credential holder in the following order: a) SNPNs in the user-controlled list of priority SNPNs (in order of priority); b) SNPNs in the credential holder-controlled list of priority SNPNs (in order of priority); c) SNPNs that also broadcast a GIN included in the credential holder-controlled list of priority GINs (in order of priority); and 4) SNPNs that also broadcast an indication that the SNPN allows registration attempts by UEs that are not explicitly configured to select a SNPN, i.e., the broadcasted SNPN ID or GIN is not in the credential holder-controlled list of priority SNPNs / GINs in the UE.

[0060] exist Figure 6In the example shown in FIG, UE 601 is registered to SNPN 100, the subscribed SNPN is SNPN 1, and there are three credential lists. The user controller's priority SNPN list includes SNPN 111, SNPN 112; the credential holder's priority SNPN list includes SNPN 121, SNPN 122; the credential holder's priority GIN list includes GIN 131, GIN 132. There is a range of SNPNs / GINs (broadcasted by one or more NG-RANs) available at the current UE location, such as SNPN 100, SNPN 1, SNPN 111, SNPN 112, SNPN 121, SNPN 300 / GIN 131. UE 601 selects and attempts to register to one SNPN in the following priority / priority order: SNPN 100, SNPN 1, SNPN 111, SNPN 112, SNPN 121, and SNPN 300, which also broadcasts GIN 131.

[0061] Under manual network selection, a user equipment operating in SNPN access mode presents to the user a list of SNPNs (each identified by a PLMN ID and NID) and the associated human-readable network names (if available) of the available SNPNs for which the user equipment has a corresponding SUPI and credentials. If the user equipment supports access to the SNPN using the credentials of the credential holder, the user equipment shall also present an indication broadcasting “Access using credentials of the credential holder is supported” and the human-readable names associated with the SNPNs (if available). When the user equipment performs an initial registration to a SNPN, the user equipment shall indicate the selected PLMN ID and NID broadcasted by the selected SNPN to the NG-RAN. The NG-RAN shall inform the AMF of the selected PLMN ID and NID.

[0062] If the UE performs a registration or service request procedure in a SNPN identified by a PLMN ID and a self-assigned NID, and the UE does not have a subscription, the AMF shall reject the UE with an appropriate cause code to temporarily prevent the UE from automatically selecting and registering with the same SNPN. If the UE performs a registration or service request procedure in a SNPN identified by a PLMN ID and a coordinated assigned NID, and the UE does not have a subscription, the AMF shall reject the UE with an appropriate cause code to permanently prevent the UE from automatically selecting and registering with the same SNPN. If the UE performs a registration in a SNPN using credentials from a credential holder, and the UE is not authorized to access the specific SNPN, the UDM may reject the UE, resulting in the AMF rejecting the UE's registration request with an appropriate cause code to prevent the UE from selecting and registering with the same SNPN using credentials from a credential holder. In order to prevent authorized UEs from accessing SNPNs in case of network congestion / overload, unified access control information is configured for each SNPN (i.e. as part of the UE's subscription information for a given SNPN) and provided to the UE.

[0063] PNI-NPN(CAG)

[0064] PNI-NPNs (CAGs) are NPNs provided over PLMNs, for example, via dedicated DNNs, or via one (or more) network slice instances assigned to the NPN. Existing network slicing functionality applies. When a PNI-NPN is provided over a PLMN, the user equipment should have a subscription to the PLMN in order to access the PNI-NPN. A Closed Access Group (CAG) identifies a group of subscribers who are allowed to access one or more CAG cells associated with the CAG. CAGs are used for PNI-NPNs to prevent user equipment that is not allowed to access the NPN via the associated cell from automatically selecting and accessing the associated CAG cell. A CAG is identified by a CAG identifier, which is unique within the PLMN ID range. A CAG cell broadcasts one or more CAG identifiers, one for each PLMN. A CAG cell may also broadcast a human readable network name (HRNN) for each CAG identifier.

[0065] In order to use CAG, a user equipment supporting CAG (indicated as part of the user equipment 5GMM core network capabilities) may be pre-configured or (re)configured with the following CAG-related information. If the user equipment supports CAG, the network may provide the configuration to the user equipment via CAG-related configuration (e.g., (enhanced) CAG information (list) containing a list of CAGs allowed per PLMN), including zero or more entries, each entry containing a) a PLMN ID, b) an "allowed CAG list" containing zero or more CAG-IDs, and c) an optional "indication indicating that the user equipment is only allowed to access the 5GS via CAG cells". The HPLMN may (pre)configure or reconfigure the above CAG-related configuration of the user equipment using a user equipment configuration update procedure or other 5GMM procedures (e.g., a registration procedure or a service procedure). The above CAG-related configuration is provided by the HPLMN per PLMN. In a PLMN, the user equipment should only consider the CAG information provided for that PLMN.

[0066] When the subscribed CAG related configuration changes, UDM sets a CAG information subscription change indication and sends it to AMF. When UDM indicates that the CAG related configuration in the access and mobility subscription data has changed, AMF shall provide the CAG related configuration to the user equipment. When AMF receives an indication from UDM that the CAG related configuration in the access and mobility subscription has changed, AMF updates the user equipment with the CAG related configuration received from UDM. Once AMF has updated the user equipment and obtained the confirmation from the user equipment, AMF notifies UDM that the update is successful and UDM clears the CAG information subscription change indication flag. AMF may update the user equipment using the user equipment configuration update procedure after the registration procedure is completed, or by including the new CAG related configuration in a registration accept or registration reject or deregistration request or service reject.

[0067] When the user equipment is roaming and the serving PLMN provides CAG-related configuration, the user equipment should only update the CAG-related configuration provided for the serving PLMN, and the CAG-related configuration stored for other PLMNs is not updated. When the user equipment is not roaming and the HPLMN provides CAG-related configuration, the user equipment should update the CAG-related configuration stored in the user equipment with the received CAG-related configurations of all PLMNs. The user equipment should store the latest available CAG-related configuration for each PLMN provided to it and keep it stored when the user equipment is logged off or turned off. CAG-related configuration is only applicable to 5GS.

[0068] For network and cell selection, a CAG cell should broadcast information so that only UEs supporting CAG can access the cell; a cell is either a CAG cell or a normal PLMN cell (non-CAG cell). To control access, in case of network congestion or overload, to prevent authorized UEs from accessing the NPN, existing mechanisms defined for control plane load control, congestion and overload control, and access control and barring functions can be used, or unified access control using access categories. Mobility restriction should be able to restrict the mobility of the UE based on the allowed CAG list (if configured in the subscription) and include an indication whether the UE is only allowed to access the 5GS through CAG cells (if configured in the subscription).

[0069] During the transition from CM-IDLE to CM-CONNECTED and during registration after connected mode mobility from E-UTRAN to NG-RAN, the AMF shall verify whether the UE is allowed access via mobility restrictions. If the UE accesses the 5GS via a CAG cell and if at least one CAG identifier received from the NG-RAN is part of the UE's allowed CAG list, the AMF accepts the NAS request. If the UE accesses the 5GS via a CAG cell and if all CAG identifiers received from the NG-RAN are not part of the UE's allowed CAG list, the AMF rejects the NAS request and the AMF may include the CAG related configuration in the NAS reject message. The AMF then releases the NAS signalling connection for the UE by triggering the AN release procedure. If the UE accesses the 5GS via a non-CAG cell and the UE's subscription contains an indication that the UE is only allowed to access the 5GS via CAG cells, the AMF rejects the NAS request and the AMF shall include the CAG related configuration in the NAS reject message. The AMF then releases the NAS signalling connection for the UE by triggering the AN release procedure.

[0070] During transition from RRC Inactive state to RRC Connected state, when the UE initiates the RRC Resume procedure to transition from RRC Inactive state to RRC Connected state in a CAG cell, if none of the CAG identifiers supported by the CAG cell is part of the UE's allowed CAG list according to the mobility restrictions received from the AMF, or if no allowed CAG list was received from the AMF, the NG-RAN shall reject the UE's RRC Resume request. When the UE initiates the RRC Resume procedure to transition from RRC Inactive state to RRC Connected state in a non-CAG cell, if according to the mobility restrictions received from the AMF, the UE is only allowed to access CAG cells, the NG-RAN shall reject the UE's Resume request.

[0071] In the connected mode mobility procedure within the NG-RAN, i.e., the handover procedure, the source NG-RAN shall not handover the UE to the target NG-RAN node if the target is a CAG cell and none of the CAG identifiers supported by the target CAG cell are part of the UE's allowed CAG list or if the allowed CAG list has not been received from the AMF. If the UE is only allowed to access CAG cells, based on the mobility restriction list, the source NG-RAN shall not handover the UE to a non-CAG cell. If the target cell is a CAG cell, the target NG-RAN shall reject the N2-based handover procedure if none of the CAG identifiers supported by the target CAG cell are part of the UE's allowed CAG list or if the allowed CAG list has not been received from the AMF. If the target cell is a non-CAG cell, the target NG-RAN shall reject the N2-based handover procedure if the UE is only allowed to access CAG cells based on the mobility restriction list. When the AMF receives a Nudm_SDM_Notification from the UDM and the AMF determines that the allowed CAG list or the indication whether the UE is only allowed to access CAG cells has changed, the AMF shall update the mobility restrictions in the UE and NG-RAN accordingly, if necessary.

[0072] Fig. 7A A first embodiment of network and cell selection and access control of a CAG cell of a PNI-NPN (CAG) is presented, wherein access to the CAG cell is accepted. Fig. 7A In the example, UE 711 is configured with CAG-related configuration (e.g., CAG information list 710), including a list of entries. For each entry, it includes a) a PLMN ID, b) an "allowed CAG list" containing zero or more CAG-IDs, and c) an optional "indicator that the UE is only allowed to access 5GS through CAG cells." For example, entry 1 includes PLMN 111, and the allowed CAG list contains CAG-IDs AAA and BBB. Through 5GC / AMF and NG-RAN, a CAG cell broadcasts one or more CAG-IDs for each PLMN, for example, CAG-IDs AAA and CCC can be accessed through CAG cell 712. Therefore, UE 711 can access CAG cell 712 in PLMN 111.

[0073] Figure 7B A second embodiment of network and cell selection and access control for non-CAG cells is shown, wherein access to a PLMN is accepted. Figure 7BIn the example, UE 721 is configured with CAG-related configuration (e.g., CAG information list 720), including a list of entries. For each entry, it includes a) a PLMN ID, b) an "allowed CAG list" containing zero or more CAG-IDs, and c) an optional "indication that the UE is only allowed to access the 5GS through CAG cells." For example, entry 1 includes PLMN 111, and the allowed CAG list contains CAG-IDs AAA and BBB. In addition, there is no indication in entry 1 that the UE is only allowed to access the 5GS through CAG cells. Through 5GC / AMF and NG-RAN 722, UE 721 finds a non-CAG cell in PLMN111 (i.e., cell 722 does not broadcast a CAG ID). Since UE 721 is allowed to access the 5GS through the non-CAG cell, UE 721 can access the non-CAG cell 722 in PLMN 111.

[0074] Fig. 8A A first embodiment of network and cell selection and access control for a CAG cell of a PNI-NPN (CAG) is shown, wherein access to the CAG cell is denied. Fig. 8A In the example of FIG. 8 , a user equipment (UE) 811 is configured with a CAG-related configuration (e.g., a CAG information list 810 ) including a list of entries. For each entry, it includes a) a public land mobile network (PLMN) ID, b) an “allowed CAG list” containing zero or more CAG-IDs, and c) an optional “indication indicating that the UE is only allowed to access the 5GS through CAG cells”. For example, entry 1 includes PLMN 111, and an allowed CAG list containing CAG-IDs AAA and BBB. Through the 5G core network (5GC) / access and mobility management function (AMF) and the new generation radio access network (NG-RAN) 812, a CAG cell broadcasts one or more CAG-IDs of each PLMN, for example, CAG-IDs CCC and DDD. However, neither CAG-ID CCC nor CAG-ID DDD is in the “allowed CAG list”. Therefore, UE 811 cannot access this CAG cell CCC / DDD of PLMN 111.

[0075] Figure 8B A second embodiment of network and cell selection and access control for a CAG cell of a PNI-NPN (CAG) is shown, wherein access to a PLMN is denied. Figure 8BIn the example of , a user equipment (UE) 821 is configured with a CAG-related configuration (CAG information list 820), including a list of entries. For each entry, it includes a) a public land mobile network (PLMN) ID, b) an "allowed CAG list" containing zero or more CAG-IDs, and c) an optional "indication indicating that the UE is only allowed to access the 5GS through CAG cells." For example, entry 1 includes PLMN 111, and an allowed CAG list containing CAG-IDs AAA and BBB. In addition, there is an indication in entry 1 that the UE is only allowed to access the 5GS through CAG cells. Through the 5G core network (5GC) / access and mobility management function (AMF) and the new generation radio access network (NG-RAN) 822, UE 821 discovers non-CAG cells in PLMN 111 (i.e., no CAG cell ID is broadcast by cell 822). Since UE 821 is not allowed to access 5GS through non-CAG cells, UE 821 cannot access non-CAG cell 822 in PLMN 111.

[0076] A non-public network (NPN) that provides localized services (as a managed network).

[0077] Local or localized services are localized (i.e., provided in a specific / limited area and / or may be limited in time). Services may be enabled through applications (e.g., live or on-demand audio / video streaming, electronic games, IP Multimedia Subsystem (IMS), etc.) or connectivity (e.g., UE to UE, UE to data network, etc.). Localized service providers are application providers or network operators who localize their services and provide services to end users over a hosted network, which is a network that provides access to local or localized services. A home network is a network that has a subscription or credential currently used by a UE. A home network may be a home PLMN or a subscribed SNPN. An SNPN may support primary authentication and authorization of a UE using credentials from a credential holder, using an authentication server function (AUSF) and unified data management (UDM). A credential holder may be a home PLMN or a subscribed SNPN. For an SNPN that is a hosted network, the home network may be considered a CH. For a PNI-NPN (CAG) that is a hosted network, the home network may be considered a (home) PLMN. In order to provide localized services to the UE, the UE needs to be able to discover, select and access an NPN (as a hosting network) that provides localized service access. The discovery mechanism is based on providing / (pre-)configuring / signaling appropriate information to the UE.

[0078] Fig. 9AAn example of a UE using validity information to discover, select and access an NPN (as a hosted network) and receive localized services is shown. When the UE uses the subscription / credentials of its home network to access the NPN (as a hosted network), only two cases are considered. If the home network ( / CH) is a PLMN, the hosted network can be a PNI-NPN or a SNPN. If the home network ( / CH) is a SNPN, the hosted network can only be a SNPN. If the UE uses a subscription or credential from the UE's home network to access the hosted network, and the UE has multiple credentials or subscriptions, the UE needs to determine which credential or subscription is used to access the hosted network. The validity information or conditional information provided to the UE as part of the localized service information can be used to restrict the UE's access to the hosted network, including: (time and / or location) validity information or conditional information ((time and / or location): duration, criteria or restrictions) is related to the SNPN (ID) or global network identity (GIN); and (time and / or location) validity information / conditions ((time and / or location): duration, criteria or restrictions) is related to the PNI-NPN / CAG-ID.

[0079] As shown in 910, a UE supporting SNPN is configured with the following information for each subscribed SNPN: the PLMN ID and NID (SNPN ID) of the subscribed SNPN (e.g., SNPN 1); and the subscription identifier (SUPI) and credentials of the subscribed SNPN. If the UE supports accessing the SNPN using credentials from the credential holder, the UE is also configured with 1) a user-controlled priority SNPN list (e.g., SNPN 111, SNPN 112); 2) a credential holder-controlled priority SNPN list (e.g., SNPN 121, SNPN 122, SNPN 123); and 3) a credential holder-controlled priority GIN list (e.g., GIN 131, GIN 132).

[0080] Fig. 9BAnother example is shown of a UE using validity information to discover, select and access an NPN (as a hosted network) and receive localized services. For automatic network selection, in the case of a SNPN (as a hosted network) that provides localized services, there may be (time (duration) and / or location (restrictions)) validity information associated with the SNPN or GIN. For example, as shown in 910, (1) an existing credential holder-controlled priority SNPN list (and GIN) may be extended to add (time and / or location) validity information or condition information for each entry in the list; or as another example shown in 911, (2) one (or more) new list types may be defined to provide entries with validity information for SNPNs (and GINs) (e.g., defining a new CH-controlled priority SNPN / GIN list (for accessing localized services, where each entry contains an SNPN / GIN identity and / or contains (optional) validity information / conditions).

[0081] As shown in 910 or 911, SNPN 121 has an associated time (duration) validity condition (the time duration (e.g., start and end time) that the UE is allowed to access SNPN 121) from January 1 to January 2, SNPN 123 has an associated time validity condition from January 1 to January 3, and GIN 131 has an associated time (duration) validity condition from January 1 to January 3. These time (duration) validity / condition information are provided to the UE as part of the localized service information to limit the UE's access to (hosted network) localized services. The validity / condition information may also optionally include location validity / condition information, which may be in the form of geographic location and / or TAI(s) / Cell(s) (serving network (serving PLMN / PNI-NPN or serving SNPN)), and the location validity / condition information may be used to assist the UE in knowing where to start searching for the SNPN of the hosted network.

[0082] Fig. 9CAnother example of a UE discovering, selecting and accessing an NPN (as a hosted network) and receiving localized services using validity / condition information is shown. For automatic network selection, in the case of a PNI-NPN with a CAG, the CAG-ID (in the (enhanced / extended (allowed)) CAG list) can be optionally associated with time validity / condition or restriction information (the time duration (e.g., start and end time) that the UE is allowed to access the PNI-NPN / CAG) and / or location validity / condition or restriction information. The time duration and / or location validity / condition or restriction can be provided together with the CAG identifier. For example, the ((enhanced / extended) allowed) CAG list can be provided to the UE and the AMF for execution to ensure that the UE does not access the CAG cell outside the time duration or ( / and) outside the allowed location. The location validity / condition information can be in the form of a geographic location and / or TAI(s) / Cell(s) (serving network (serving PLMN / PNI-NPN or serving SNPN)), and the location validity / condition or restriction information can be used to assist the UE in knowing where to start searching for the PNI-NPN hosted network.

[0083] Note that as shown in Figure 920, the (time and / or location) validity information can be stored next to the CAG-ID (e.g., enhancing / extending the original allowed CAG list), or stored independently in the UE and associated with one (or more) CAG-IDs; or as shown in Figure 921, one (or more) new list types can be defined to provide CAG(s) entries with validity information. As shown in Figure 920, for example, the ((enhanced / extended) allowed) CAG list of PLMN 111 includes CAG AAA, BBB, and CCC. CAG-ID AAA is associated with time validity information January 1 to January 3, and CAG-ID CCC is associated with time validity information January 1 to January 2. If there is location validity, similar logic applies. These (time and location) validity conditions are provided to the UE as part of the localized service information to limit the UE's access to localized services (hosting network).

[0084] Fig. 10A The first example of accessing a localized service through a SNPN (as a hosting network) was demonstrated, where access was accepted. Fig. 10AIn the example of , UE 1001 is configured with the following SNPN subscriptions: Subscribed SNPN = SNPN 1, a priority SNPN list controlled by the credential holder, which includes SNPN 121, SNPN 122, and SNPN 123. SNPN 121 is associated with the time validity condition January 1 to January 2, and SNPN 123 is associated with the time validity condition January 1 to January 3. Through 5GC / AMF and NG-RAN 1002, SNPN 123 broadcasts its SNPN ID == 123, indicating that access using the credential of the credential holder is supported. Since UE 1001 subscribes to SNPN 1 and SNPN 123 is included in the "Subscriber Data List" entry of SNPN 1 as the preferred SNPN, UE 1001 may attempt to access SNPN 123 using the credentials of SNPN 1. Due to the time validity condition associated with SNPN 123, UE 1001 needs to determine whether this time validity condition is met before access. UE 1001 checks that the current time is January 2, which is within the time period from January 1 to January 3. Therefore, UE 1001 can access SNPN 123 using the credentials of (subscribed) SNPN 1. SNPN 123 is the localization service provider. SNPN 123 is the hosting network. SNPN 1 is the credential holder. (If there is location validity information, in this example we assume that the location validity is satisfied according to the location validity information.)

[0085] Fig. 10B A second example of accessing a localized service through a SNPN (as a hosting network) is shown, where access is not allowed (the network will deny access if the UE attempts it). Fig. 10BIn the example of , UE 1001 is configured with the following SNPN subscriptions: Subscribed SNPN = SNPN 1, a priority SNPN list controlled by the credential holder, which includes SNPN 121, SNPN 122, and SNPN 123. SNPN 121 is associated with the time validity condition January 1 to January 2, and SNPN 123 is associated with the time validity condition January 1 to January 3. Through 5GC / AMF and NG-RAN 1002, the hosted network SNPN 123 broadcasts its SNPNID == 123, indicating that access using the credential of the credential holder is supported. Since UE 1001 subscribes to SNPN 1 and SNPN 123 is included in the "Subscriber Data List" entry of SNPN 1 as the preferred SNPN, UE 1001 may attempt to access SNPN 123. However, due to the time validity condition associated with SNPN 123, UE 1001 also needs to additionally determine whether this time validity condition is met before access. UE 1001 checks that the current time is January 4, which is outside the time period from January 1 to January 3. Therefore, UE 1001 cannot access SNPN 123 using the credentials of SNPN 1.

[0086] Fig.11A The first example of accessing a localized service through a PNI-NPN with a CAG (as a managed network) was shown, where the access was accepted. Fig.11AIn the example of FIG. 1 , a user equipment (UE) 1101 is configured with a CAG-related configuration 1110, including a list of entries. For example, entry 1 includes PLMN 111, and an enhanced or extended allowed CAG list with CAG-IDs AAA, BBB, and CCC. CAG AAA is associated with a time validity condition of January 1 to January 3, and CAG CCC is associated with a time validity condition of January 1 to January 2. Through 5GC / AMF and NG-RAN 1102, a CAG cell broadcasts one or more CAG-IDs of each PLMN, for example, CAG-ID AAA of PLMN 111. Since CAG AAA is associated with a time validity condition, UE 1001 needs to determine whether such time validity condition is satisfied before accessing. UE 1101 checks that the current time is January 2, which is within the time period of January 1 to January 3 associated with CAG AAA. Therefore, UE 1101 can access CAG AAA of PLMN 111 through this cell. (PNI-NPN / CAG-AAA is the service provider, PNI-NPN / CAG-AAA is the hosting network, the home PLMN of the currently used USIM is the home network, and the home PLMN is the credential holder.) (If location validity information is available, in this example, we assume that location validity is satisfied according to the location validity information.)

[0087] Fig. 11B A second example of accessing a localized service through a PNI-NPN with a CAG (as a managed network) is shown, where access is denied. Fig. 11B In the example of , UE 1101 is configured with CAG-related configuration 1110, including a list of entries. For example, entry 1 includes PLMN 111, and an enhanced or extended allowed CAG list with CAG-IDs AAA, BBB, and CCC. CAG AAA is associated with a time validity condition of January 1 to January 3, and CAG CCC is associated with a time validity condition of January 1 to January 2. Through 5GC / AMF and NG-RAN 1102, a CAG cell broadcasts one or more CAG-IDs of each PLMN, for example, CAG-ID AAA and CAG-ID CCC of PLMN 111. Since CAG AAA and CCC are associated with time validity conditions, UE 1101 needs to determine whether such time validity conditions are met before accessing. UE 1101 checks that the current time is January 4, which is beyond the time period of January 1 to January 3 associated with CAG AAA, and also beyond the time period of January 1 to January 2 associated with CAG CCC. Therefore, UE 1101 cannot access the CAG cell AAA or CCC.

[0088] Update CAG configuration process

[0089] When PNI-NPN is provided through a PLMN, the UE should have a subscription to the PLMN to access the PNI-NPN. A Closed Access Group (CAG) identifies a group of subscribers that are allowed to access one or more CAG cells associated with a CAG. CAG can be used to apply access control to the PNI-NPN. When a PNI-NPN (as a hosting network) provides localized services, the CAG cells of the PNI-NPN hosting network broadcast one or more CAG identifiers for each PLMN, and each CAG-ID may be associated with validity information, such as time and / or location validity criteria.

[0090] In order to use CAG, a UE that supports CAG (indicated as part of the UE 5GMM Core Network Capabilities) may be configured and / or reconfigured or updated with CAG-related configuration. The CAG-related configuration (e.g., (enhanced) CAG information (list) containing a list of allowed CAGs per PLMN) consists of zero or more entries, each of which contains a) a PLMN ID, b) an "Allowed CAG List" with zero or more CAG-IDs, and c) an optional "indicator that the UE is only allowed to access 5GS via CAG cells".

[0091] When the subscribed CAG related configuration changes, UDM sets a CAG information subscription change indication and sends it to AMF. When UDM indicates that the CAG related configuration in the access and mobility subscription data has changed, AMF shall provide the updated CAG related configuration to the UE. When the UE receives the updated CAG related configuration, the UE's operation needs to take into account the configured "CAG validity information".

[0092] According to the first novel aspect, the UE receives an updated CAG-related configuration via a CAG cell, which broadcasts a list of CAG-IDs supported by the current network in a DL NAS message. The updated CAG-related configuration includes a list of CAG-IDs allowed by the current network, and an indication as to whether the UE is only allowed to access the 5GS via the CAG cell. The UE checks the allowed CAG-ID list in the updated CAG-related configuration, determines whether they are supported by the CAG cell, whether they are associated with validity information, whether the validity criteria are met, whether the UE is only allowed to access the 5GS via the CAG cell, and whether the UE has any emergency PDU sessions. Depending on the determination result, the UE then either enters the LIMITED-SERVICE and searches for a suitable cell in the current network, or enters the PLMN-SEARCH state and applies the PLMN selection procedure.

[0093] According to the second novel aspect, the UE receives an updated CAG-related configuration in a DL NAS message via a non-CAG cell of the current network. The updated CAG-related configuration includes a list of CAG-IDs allowed by the current network, and an indication as to whether the UE is only allowed to access the 5GS via CAG cells. The UE checks the allowed CAG-ID list in the updated CAG-related configuration, determines whether they are associated with the validity information, whether the validity criteria are met, whether the UE is only allowed to access the 5GS via CAG cells, and whether the UE has any emergency PDU sessions. Depending on the determination result, the UE then either enters the LIMITED-SERVICE and searches for a suitable cell in the current network, or enters the PLMN-SEARCH state and applies the PLMN selection procedure.

[0094] In one example, the validity information includes only time validity information, wherein the validity criterion is satisfied if the time validity information matches the current time of the UE; and the validity criterion is not satisfied if the time validity information does not match the current time of the UE. In another example, the validity information includes only location validity information, wherein the validity criterion is satisfied if the location validity information matches the current location of the UE; and the validity criterion is not satisfied if the location validity information does not match the current location of the UE. In another example, the validity information includes time validity information and location validity information, wherein the validity criterion is satisfied if the time validity information matches the current time of the UE and the location validity information matches the current location of the UE; and the validity criterion is not satisfied if the time validity information does not match the current time of the UE or the location validity information does not match the current location of the UE.

[0095] Fig.12 An embodiment of a user equipment (UE) receiving updated CAG-related configuration through a CAG cell and entering a LIMITED-SERVICE state and searching for a suitable cell in the current network is shown. Fig.12In the example of , user equipment 1201 accesses PLMN 111 via 5GC / NG-RAN 1202. The current CAG cell broadcasts a list of supported CAG IDs, including CAG BBB, CCC and DDD, for PLMN 111. Thereafter, user equipment 1201 configures an updated CAG-related configuration 1210 via a downlink NAS signaling message, the configuration including multiple entries, including an entry including PLMN ID 111, with an (enhanced) (allowed) CAG list. The (enhanced) (allowed) CAG list further includes multiple allowed CAGIDs of PLMN 111, including CAG AAA, BBB and CCC. Among the allowed CAG-IDs, CAG AAA is not supported by the current CAG cell. CAG BBB and CCC are supported by the current CAG cell, but they are associated with validity information for accessing local services. CAG BBB is associated with time validity / restriction information / criteria (January 3 to January 5), and CAG CCC is associated with time validity / restriction information and criteria (January 3 to January 5) for localized services. If the current time is January 2, the validity / restriction criteria / conditions of CAG BBB and CCC are not met. Therefore, the user equipment 1201 cannot access the CAG AAA, BBB or CCC of the current CAG cell.

[0096] However, the updated CAG-related configuration 1210 contains an allowed CAG AAA, which is not associated with any validity information. In addition, the updated CAG-related configuration 1210 does not indicate that the user equipment is only allowed to access the 5GS through CAG cells. Therefore, the user equipment can remain in the current PLMN 111 to find other suitable cells (CAG / non-CAG cells). In one example, the user equipment 1201 can enter the LIMITED-SERVICE state and look for another CAG cell supporting CAG AAA in the PLMN 111. In another example, the user equipment 1201 can enter the LIMITED-SERVICE state and look for a non-CAG cell in the PLMN 111. If the user equipment 1201 has an emergency PDU session, then the user equipment 1201 can enter the LIMITED-SERVICE state and perform a local release of all other PDU sessions associated with 3GPP access.

[0097] Fig.13 Another embodiment is shown in which a user equipment receives updated CAG-related configuration through a CAG cell and enters a LIMITED-SERVICE state and searches for a suitable cell in the current network. Fig.13In the example, user equipment 1301 accesses PLMN 111 through 5GC / NG-RAN 1302. The current CAG cell broadcasts a list of supported CAG IDs, including CAG DDD. Afterwards, user equipment 1301 configures an updated CAG-related configuration 1310 through a downlink NAS signaling message, which includes multiple entries, including an entry including PLMN ID 111, with an (enhanced) (allowed) CAG list. The (enhanced) (allowed) CAG list further includes multiple (allowed) CAG IDs of PLMN 111, including CAG BBB and CCC. Among the allowed CAG-IDs, CAG BBB and CCC are not supported by the current CAG cell. Therefore, user equipment 1301 cannot access CAG BBB or CAG CCC of the current CAG cell.

[0098] In addition, the updated CAG-related configuration 1310 also includes an indication that the user equipment is only allowed to access 5GS through CAG cells, which means that the user equipment 1301 can only look for CAG cells. However, CAG BBB is associated with time validity / restriction information and criteria (January 1 to January 5), and CAG CCC is associated with time validity / restriction information / criteria (January 3 to January 5) for localized services. If the current time is January 2, the validity criteria of CAG BBB are met, and the validity criteria of CAG CCC are not met. Therefore, the user equipment can stay in the current PLMN 111 to find other suitable cells. In one example, the user equipment 1301 can enter the LIMITED-SERVICE state and look for another CAG cell supporting CAG BBB in the PLMN 111 because the validity criteria of CAG BBB are met. If the user equipment 1301 has an emergency PDU session, the user equipment 1301 can enter the LIMITED-SERVICE state and perform a local release of all other PDU sessions related to 3GPP access.

[0099] Fig.14 It shows a UE receiving updated CAG related configuration via CAG cell and entering PLMN-SEARCH state and applying network selection process, when the UE has no emergency PDU session. Fig.14In the example, user equipment 1401 accesses PLMN 111 through 5GC / NG-RAN 1402. The current CAG cell broadcasts a list of supported CAG IDs, including CAG DDD. Afterwards, user equipment 1401 configures an updated CAG-related configuration 1410 through a downlink NAS signaling message, which includes multiple entries, including an entry including PLMN ID 111, with an (enhanced) (allowed) CAG list. The (enhanced) (allowed) CAG list further includes multiple (allowed) CAG IDs of PLMN 111, including CAG BBB and CCC. Among the allowed CAG-IDs, CAG BBB and CCC are not supported by the current CAG cell. Therefore, user equipment 1401 cannot access CAG BBB or CAG CCC of the current CAG cell.

[0100] In addition, the updated CAG-related configuration 1410 also includes an indication that the user equipment is only allowed to access the 5GS through CAG cells, which means that the user equipment 1401 can only look for CAG cells. However, CAG BBB is associated with time validity / restriction information and criteria (January 3 to January 5), and CAG CCC is associated with time validity / restriction information / criteria (January 3 to January 5) for localized services. If the current time is January 2, then the validity / restriction criteria or conditions of the allowed CAG BBB and CAG CCC are not met. Therefore, if the user equipment 1401 does not have an emergency PDU session, then the user equipment 1401 should not stay in the current PLMN 111, because the user equipment 1401 will not be able to find any suitable cell in the current PLMN 111. Therefore, the user equipment 1401 enters the PLMN-SEARCH state and applies the updated CAG-related configuration to perform a PLMN selection process to find another network. However, if the user equipment 1401 has an emergency PDU session, then the user equipment 1401 should (1) perform a local release of all PDU sessions associated with the 3GPP access, except the emergency PDU session, and enter the LIMITED-SERVICE state in the PLMN 111 or (2) (a) perform a local release of all non-emergency (single access) PDU sessions associated with the 3GPP access (b) perform a local release of 3GPP access user plane resources for an MA PDU that has user plane resources on both 3GPP access and non-3GPP access (c) perform a local release of an MA PDU that has user plane resources only on the 3GPP access.

[0101] Fig.15An embodiment is presented in which a user equipment (UE) receives updated CAG-related configurations through a non-CAG cell, enters a LIMITED-SERVICE state, and searches for a suitable cell in the current network. Fig.15 In the example of , user equipment 1501 accesses a non-CAG cell in PLMN 111 via a 5G core network / next generation radio access network (5GC / NG-RAN) 1502. Thereafter, user equipment 1501 configures an updated CAG-related configuration 1510 via a downlink NAS signaling message, which includes an entry including PLMN ID 111 with an (enhanced) (allowed) CAG list. The (enhanced) (allowed) CAG list further includes multiple (allowed) CAG IDs of PLMN 111, including CAG BBB and CCC. The updated CAG-related configuration 1510 also includes an indication that the user equipment is only allowed to access the 5G system (5GS) via CAG cells, which means that user equipment 1501 can only access CAG cells on PLMN 111. Therefore, user equipment 1501 can no longer access the current non-CAG cells in PLMN 111.

[0102] In addition, CAG BBB is associated with time validity / restriction information / criteria (January 1 to January 5), and CAG CCC is associated with time validity / restriction information / criteria (January 3 to January 5) for localized services. If the current time is January 2, the validity / restriction criteria / conditions of CAG BBB are met, while the validity / restriction criteria / conditions of CAG CCC are not met. Therefore, the user equipment 1501 can stay in the current PLMN 111 to find other suitable CAG cells. In one example, the user equipment 1501 can enter the LIMITED-SERVICE state and find another CAG cell supporting CAG BBB in the PLMN 111.

[0103] Fig.16 Another embodiment is shown in which a user equipment receives updated CAG-related configuration through a non-CAG cell and enters a PLMN-SEARCH state and applies a network selection process. Fig.16In the example, user equipment 1601 accesses a non-CAG cell in PLMN 111 via 5GC / NG-RAN 1602. Thereafter, user equipment 1601 configures an updated CAG-related configuration 1610 via a downlink NAS signaling message, which includes an entry including PLMN ID 111 with an (enhanced) (allowed) CAG list. The (enhanced) (allowed) CAG list further includes multiple allowed CAG IDs of PLMN 111, including CAG BBB and CCC. The updated CAG-related configuration 1610 also includes an indication that the user equipment is only allowed to access 5GS via CAG cells, which means that user equipment 1601 can only access CAG cells in PLMN 111. Therefore, user equipment 1601 can no longer access the current non-CAG cells in PLMN 111.

[0104] In addition, CAG BBB is associated with time validity / restriction information / criteria (January 3 to January 5), and CAG CCC is associated with time validity / restriction information / criteria (January 3 to January 5) for localized services. If the current time is January 2, the validity / restriction criteria / conditions of both (allowed) CAG BBB and CAG CCC are not met. Therefore, if the user equipment 1601 does not have an emergency PDU session, the user equipment 1601 should not stay in the current PLMN 111 because the user equipment 1601 will not be able to find any suitable cell in the current PLMN 111. Therefore, the user equipment 1601 enters the PLMN-SEARCH state and applies the updated CAG-related configuration to perform the PLMN selection process to find another network. However, if user equipment 1601 has an emergency PDU session, user equipment 1601 should (1) perform a local release of all PDU sessions associated with 3GPP access, except the emergency PDU session, and enter the LIMITED-SERVICE state in PLMN 111 or (2) (a) perform a local release of all non-emergency (single access) PDU sessions associated with 3GPP access (b) perform a local release of MA PDUs of user plane resources for 3GPP access and non-3GPP access (c) perform a local release of MAPDUs of user plane resources only on 3GPP access (d) enter the LIMITED-SERVICE state in PLMN 111.

[0105] Fig.17 A process 170 in a network according to an embodiment of the present invention is shown. The process 170 is used in a network to process network access control (e.g., Figure 2 Network entity 211 or Figure 3A-3B credential holder in ), including the following steps:

[0106] Step S1700: Start.

[0107] Step S1702: Receive a registration request from a communication device (eg, UE).

[0108] Step S1704: Determine whether the validity information in the UE subscription of the SNPN used to provide the localized service is satisfied in response to the received registration request (e.g., stored in a network entity of the network (e.g., Figure 3B UDM / User Data Repository (UDR) of CH in which UDR is considered as a part of UDM).

[0109] Step S1706: Reject the registration request when the validity information is not satisfied (for example, if the network entity (such as Figure 3B The UDM / UDR of the CH in the SNPN selection procedure, where the UDR is considered as part of the UDM) does not authorize the communication device), which results in the communication device being rejected with an appropriate reason code to prevent the communication device from selecting or registering a network again in the SNPN selection procedure.

[0110] Step S1708: End.

[0111] In step 1702, the registration request may refer to Fig. 10A or Fig. 10B .like Fig. 10A As shown, when the validity information of the localized service provided by the SNPN is satisfied, the communication device generates and transmits a registration request to the SNPN. For example, when the time validity information in the UE configuration and subscription information of the SNPN 123 is satisfied, the UE can transmit a registration request to the SNPN 123. Otherwise, as Fig. 10B As shown, when the time validity in the UE configuration and subscription information of SNPN 123 is not satisfied, the UE cannot transmit a registration request to SNPN 123.

[0112] Step S1706 may be replaced by "rejecting the registration request when the validity information of the SNPN stored in the network for providing localized services does not satisfy the requirement (for example, if the network entity (such as Figure 3B The UDM / UDR of the CH in the communication, where the UDR is considered as part of the UDM) does not authorize the communication device) and rejects the communication device. This causes the SNPN providing the localized service (e.g., the network entity of the SNPN (such as AMF)) to perform a registration rejection and use an appropriate cause code. "

[0113] The implementation process 170 is not limited to the above description. The following examples can be applied to the implementation process 170.

[0114] In one example, the registration request is generated and transmitted by the communication device based on the UE configuration and subscription information in the communication device. In one example, the registration request is received by a network entity of the SNPN providing the localized service (e.g., the AMF of the SNPN 123) and then forwarded to a network entity of the network (e.g., Figure 3B In one example, a network (e.g., Figure 3B The UDM / UDR of the CH shown in , where the UDR is considered as part of the UDM) considers the registration request to determine whether the validity information stored in the network related to the registration request is satisfied.

[0115] In one example, when the validity information satisfies (e.g., if a network entity (e.g., Figure 3B The UDM of the CH in the communication device, where the UDR is considered as a part of the UDM) successfully authenticates and authorizes the communication device), the network accepts the registration request, and notifies the SNPN providing the localization service (for example, the network entity of the SNPN (such as AMF)) to perform registration acceptance on the communication device.

[0116] In one example, the network broadcasts system information associated with at least one SNPN identifier (ie, SNPN ID) and / or at least one GIN associated with at least one SNPN providing localized services. A detailed description of the system information can be found in Figure 4 In one example, when a communication device is rejected with an appropriate reason code, the network updates the communication device's system information (e.g., a list of priority SNPNs and GINs controlled by the credential holder, a list of priority SNPNs and GINs that provide localized services controlled by the credential holder) in the SNPNs that provide localized services (as a hosting network) using a rejection message.

[0117] In one example, the validity information includes time validity information including one or more time periods. In one example, if at least one time period in the time validity information matches the current condition of the communication device, the validity information is satisfied. In one example, if all time periods in the time validity information do not match the current condition of the communication device, the validity information is not satisfied. In one example, the current condition includes the current time of the communication device. The validity information and the time validity information can refer to the previous description and are not described here for the sake of brevity.

[0118] In one example, the appropriate cause code indicates at least one of the following: the communication device has no subscription; the validity information of the UE subscription stored in the network does not satisfy (e.g., stored in a network entity of the network (e.g., Figure 3BUDM / UDR of CH in the network, where UDR is considered as part of UDM); and the network does not authorize the communication device to access the SNPN providing localized services (e.g., temporarily). In one example, the appropriate reason code may be #74 or #75, but is not limited thereto.

[0119] In one example, the communication device selects the SNPN providing the localized service according to the UE configuration and the subscription information of the SNPN selected by the network to provide the localized service. The detailed description of the network selection information of the SNPN providing the localized service can be referred to Figure 5A A detailed description of the network selection of SNPN providing local services can be found in Figure 6 and Figures 10A-10B Description. In one example, the network selection information in the communication device includes validity information. In one example, the communication device determines whether the validity information is satisfied. In one example, when the validity information is satisfied, the communication device transmits a registration request to the network. In one example, when an appropriate reason code (e.g., #74 or #75) is received, the communication device does not perform a registration request for the same SNPN providing localized services. In one example, when the network updates the communication device with system information (e.g., a list of priority SNPNs and GINs controlled by the credential holder, a list of priority SNPNs and GINs providing localized services controlled by the credential holder), the communication device selects other SNPNs providing localized services (e.g., a SNPN providing localized services with a higher priority may be selected).

[0120] In one example, if a communication device performs registration in a SNPN providing localized services using credentials of a network (e.g., CH), and the network (e.g., CH) does not authorize the communication device to access the specific SNPN providing localized services due to access authorization based on subscription data (e.g., invalid time), the unified data management (UDM) in the network (e.g., UDM of CH) may reject the communication device, causing the AMF to reject the registration request from the communication device with an appropriate reason code to prevent the communication device from automatically selecting and registering the same SNPN using credentials of the network (e.g., CH). In one example, the CH is the PLMN / SNPN that owns the communication device subscription and controls access.

[0121] In one example, the network includes (e.g., is) a CH, which can be a PLMN or an SNPN including a UDM in the CH. In one example, the SNPN providing localized services is identified by a PLMN ID and an NID. In one example, the NID includes a self-assigned NID or a coordinated assigned NID. A detailed description of the NID can be referred to Figure 4In one example, the communication device includes (eg, is) a UE. In one example, the SNPN selection procedure is an automatic SNPN selection mode procedure (eg, network selection of a SNPN providing localized services).

[0122] In the example of process 170, the terms "registration" and "registration process" may be replaced with the term "service request process."

[0123] In summary, embodiments of the present invention provide a network and a method for processing network access control. The network accepts or rejects a communication device to register in a SNPN based on validity information to control the communication device's access to the SNPN. The network rejects the communication device with an appropriate reason code to temporarily prevent the communication device from automatically selecting and using the network's credentials to register with the SNPN. Therefore, the problem of processing network access control can be solved.

[0124] Those skilled in the art will readily observe that many modifications and variations of the apparatus and methods can be made while retaining the teachings of the invention. Accordingly, the above disclosure should be limited only by the limits of the appended claims.

Claims

1. A network for processing network access control, comprising: Memory; and A processor connected to the memory, wherein the memory stores instructions, and the processor is configured to execute the instructions: receiving a registration request from a communication device; In response to receiving the registration request, determining whether validity information in a UE subscription to a standalone non-public network (SNPN) for providing localized services is satisfied; When the validity information is not satisfied, the registration request is rejected, which results in the communication device being rejected with an appropriate reason code to prevent the communication device from selecting or registering to the same SNPN network again in the SNPN selection procedure.

2. The network of claim 1, wherein the validity information comprises time validity information, the information comprising one or more time periods.

3. The network of claim 2, wherein the validity information satisfies if at least one time period in the time validity information matches a current condition of the communication device.

4. The network of claim 2, wherein the validity information is not satisfied if all time periods in the time validity information do not match the current conditions of the communication device. The network of claim 4 , wherein the current condition comprises a current time of the communication device.

6. The network of claim 1, wherein the appropriate cause code represents at least one of the following: The communication device has no subscription; The validity information of the UE subscription is not satisfied; and The network does not authorize the communication device to access the SNPN that provides localized services.

7. The network as claimed in claim 1, wherein the network includes a certificate holder (CH), which can be a public land mobile network (PLMN) or a SNPN of a unified data management (UDM) included in the CH.

8. The network of claim 1, wherein the SNPN providing the localized service is identified by a Public Land Mobile Network (PLMN) ID and a Network ID (NID).

9. The network of claim 8, wherein the NID comprises a self-assigned NID or a coordinated assigned NID.

10. The network of claim 1, wherein the SNPN selection procedure is an automatic SNPN selection mode procedure.

11. The network of claim 1, wherein the registration request is generated and transmitted by the communication device based on UE configuration and subscription information in the communication device.

12. A method for processing network access control of a network, comprising: receiving a registration request from a communication device; In response to receiving the registration request, determining whether validity information in a UE subscription to a standalone non-public network (SNPN) for providing localized services is satisfied; When the validity information is not satisfied, the registration request is rejected, which results in the communication device being rejected with an appropriate reason code to prevent the communication device from selecting or registering the same SNPN network again in the SNPN selection procedure.

13. The method of claim 12, wherein the validity information comprises time validity information, the information comprising one or more time periods.

14. The method of claim 13, wherein the validity information satisfies if at least one time period in the time validity information matches a current condition of the communication device.

15. The method of claim 13, wherein the validity information is not satisfied if all time periods in the time validity information do not match the current conditions of the communication device. The method of claim 15 , wherein the current condition of the communication device comprises a current time of the communication device.

17. The method of claim 12, wherein the appropriate reason code represents at least one of the following: The communication device has no subscription; The validity information of the UE subscription is not satisfied; and The network does not authorize the communication device to access the SNPN that provides localized services.

18. The method of claim 12, wherein the network includes a certificate holder (CH), which can be a public land mobile network (PLMN) or a SNPN of a unified data management (UDM) included in the CH.

19. The method of claim 12, wherein the SNPN selection process is an automatic SNPN selection mode process.

20. The method of claim 12, wherein the registration request is generated and transmitted by the communication device based on UE configuration and subscription information in the communication device.

Images