Systems and methods related to split RAN architectures and security modes for future x-centric service networks

Abstract

Systems and methods related to a split RAN architecture and security mode for future X-centric serving networks are provided. A communication network that deploys the split RAN architecture is also provided. The communication network includes a radio access network (RAN) having a centralized unit (CU) and one or more distributed units (DUs). The communication network also includes one or more service modules deployed between the CU and the one or more DUs. The one or more service modules are used for providing one or more network services for data processing. Systems and methods related to a split RAN architecture and security mode for future X-centric serving networks are provided.

Description

Technical Field

[0001] The present invention relates to the field of communication networks, and in particular, to systems and methods related to a split radio access network (RAN) architecture and security mode for future X-centric service networks. Background Art

[0002] Existing network architectures, such as radio access network (RAN) architectures, may limit the way new services are provided. For example, existing network architectures may limit the amount of data that can be processed as required. In addition, the current L2 sublayer and PHY layer in existing architectures may lack the functionality to support new types of services.

[0003] Furthermore, deploying new services on existing network architectures may further burden the network and cause it to become overloaded, thereby weakening the network architecture. For example, some new services may require data to be aggregated before processing, which will increase the load on the interfaces involved and thus affect traditional connection-oriented services.

[0004] Other limitations of existing networks may be the security protection required for services in future networks, while the current network may not be able to provide the security protection required for such services.

[0005] Therefore, there is a need for systems and methods related to a split RAN architecture and security mode for future X-centric service networks to eliminate or reduce one or more limitations of the prior art.

[0006] The purpose of providing this background information is to disclose information that the applicant believes may be relevant to the present invention. It is not necessarily intended to be admitted, nor should any of the above information be construed as prior art against the present invention. Summary of the Invention

[0007] Aspects of the present invention may provide systems and methods related to a split RAN architecture and security mode for future X-centric service networks.

[0008] One aspect of the present invention provides a communication network. The communication network includes a radio access network (RAN) having a central unit (CU) and one or more distributed units (DUs). The communication network may further include: one or more service modules deployed between the CU and the one or more DUs, the one or more service modules being configured to provide one or more network services for data processing.

[0009] The data processing may include at least one of the following: data analysis, artificial intelligence (AI) training, AI inference, data privacy protection, data collection, data purification, data processing, data management, data cleaning, data normalization, junk data filtering, data feature engineering, data compression, data embedding, data representation learning, and data feature extraction.

[0010] The one or more service modules may be deployed in one or more of the following: the RAN, the core network (CN), and the user equipment (UE).

[0011] Each service module among the one or more service modules may include: one or more service controller units for controlling the one or more network services. Each service module among the one or more service modules may further include: one or more processing function (PF) units for performing one or more tasks associated with the one or more network services. The one or more service controller units may be deployed on the control plane.

[0012] The one or more PF units may be deployed on the user plane, the data plane, the computing plane, or the data processing plane. The one or more PF units may be used to perform the data processing under the control of the one or more service controller units. The one or more service controller units may be used to control and configure the one or more PF units for the data processing.

[0013] The one or more DUs may be connected to the one or more service modules through a T1 interface. The CU may be connected to each service module among the one or more service modules through a T2 interface. One of the one or more service controller units may be connected to the one or more DUs through the T1 interface (T1-C interface) on the control plane.

[0014] The one or more PF units may be connected to the one or more DUs through the T1 interface (T1-U interface) on the user plane, the data plane, the computing plane, or the data processing plane. The one or more service controller units may be connected to the CU through the T2 interface (T2-C interface) on the control plane.

[0015] The one or more PF units may be connected to the CU via a T2 interface (T2-U interface) on the user plane, the data plane, the computing plane, or the data processing plane. One PF unit among the one or more PF units may be connected to one service controller unit among the one or more service controller units via a T3 interface. One service controller unit among the one or more service controller units may be connected to the one or more PF units via a T3 interface.

[0016] The same service module or different PF units in different service modules among the one or more service modules may be interconnected via a T4 interface. The same service module or different service controller units in different service modules among the one or more service modules may be interconnected via a T5 interface. One PF unit among the one or more PF units may be directly or indirectly connected to a CN function (CNF) via a T6 interface.

[0017] The one PF unit among the one or more PF units may be indirectly connected to the CNF via the T6 interface through an intermediate CU. One service controller unit among the one or more service controller units may be directly or indirectly connected to a CN function (CNF) via a T7 interface. The one service controller unit among the one or more service controller units may be indirectly connected to the CNF via the T7 interface through an intermediate CU.

[0018] The CNF may be one of the following: a service module in the CN, a PF unit in the CN, a service controller unit in the CN, and a function for data forwarding. The function for data forwarding is one of the following: a user plane function (UPF), an evolved UPF, or a gateway function.

[0019] Different service modules among the one or more service modules may be interconnected via a T8 interface. The T8 interface may be an integration of the T4 interface and the T5 interface. One or more DUs may be connected to the CU via an F1 interface.

[0020] The application layer signaling protocol on the control plane of the communication network has interfaces T1, T2, T3, T5, T7, and T8, and the application layer signaling protocols are respectively referred to as T1 application protocol (T1AP), T2 application protocol (T2AP), T3 application protocol (T3AP), T5 application protocol (T5AP), T7 application protocol (T7AP), and T8 application protocol (T8AP).

[0021] The underlying protocol stack of one or more of the T1AP, the T2AP, the T3AP, the T5AP, the T7AP, and the T8AP may include one or more of the following: General Packet Radio Service (GPRS) User Plane Tunneling Protocol (GTP-U), User Datagram Protocol (UDP), Internet Protocol (IP), Quick UDP Internet Connections (QUIC) protocol, Hypertext Transfer Protocol (HTTP), Stream Control Transmission Protocol (SCTP), and Segment Routing over IPv6 (SRv6) protocol.

[0022] The underlying protocol stack on the data plane for one or more of the T1 interface, T2 interface, T4 interface, T6 interface, and T8 interface may include one or more of the following: General Packet Radio Service (GPRS) User Plane Tunneling Protocol (GTP-U), User Datagram Protocol (UDP), Internet Protocol (IP), Quick UDP Internet Connections (QUIC) protocol, Hypertext Transfer Protocol (HTTP), Stream Control Transmission Protocol (SCTP), and Segment Routing over IPv6 (SRv6) protocol.

[0023] The communication network may further include, above the underlying protocol stack, on the user plane, the data plane, the compute plane, or the data processing plane: a PF sublayer, deployed above the Packet Data Convergence Protocol (PDCP) sublayer at the one or more PF units.

[0024] The communication network may further include, above the underlying protocol stack, on the user plane, the data plane, the compute plane, or the data processing plane: a corresponding PF sublayer, deployed at the UE: above the respective PDCP sublayer; or between the SDAP sublayer and the respective PDCP sublayer.

[0025] The communication network may further include, above the underlying protocol stack, on the user plane, the data plane, the compute plane, or the data processing plane: at the UE, a Radio Link Control (RLC) sublayer; a Media Access Control (MAC) sublayer, deployed at the UE; and a deployed Physical (PHY) layer.

[0026] The communication network may further include, above the underlying protocol stack, on the user plane, the data plane, the compute plane, or the data processing plane: at the one or more DUs, an RLC sublayer, a MAC sublayer, and a PHY layer.

[0027] The communication network may further include, above the underlying protocol stack, on the user plane, the data plane, the compute plane, or the data processing plane: at the CU, a deployed respective SDAP sublayer.

[0028] The communication network may further include, on the control plane and above the underlying protocol stack: a service controller sublayer, which is deployed above the Packet Data Convergence Protocol (PDCP) sublayer at the one or more service controller units.

[0029] The communication network may further include, on the control plane and above the underlying protocol stack: at the UE, a corresponding service controller sublayer, which is deployed above the PDCP sublayer; a Radio Link Control (RLC) sublayer; a Medium Access Control (MAC) sublayer; and a Physical (PHY) layer.

[0030] The communication network may further include, on the control plane and above the underlying protocol stack: at the one or more DUs, an RLC sublayer, a MAC sublayer, and a PHY layer.

[0031] The one or more PF units may be integrated into the CU. The communication network may further include, on the user plane, data plane, compute plane, or data processing plane and above the underlying protocol stack: a PF sublayer, which is deployed at the CU: above the Packet Data Convergence Protocol (PDCP) sublayer, or between the PDCP sublayer and the Service Data Adaptation Protocol (SDAP) sublayer.

[0032] The communication network may further include, on the user plane, data plane, compute plane, or data processing plane and above the underlying protocol stack: at the one or more DUs, an RLC sublayer, a MAC sublayer, and a PHY layer.

[0033] The communication network may further include, on the user plane, data plane, compute plane, or data processing plane and above the underlying protocol stack: at the UE, a PF sublayer: above the PDCP sublayer, or between the PDCP sublayer and the SDAP sublayer. The communication network may further include, on the user plane, data plane, compute plane, or data processing plane and above the underlying protocol stack: at the UE, an RLC sublayer, a MAC sublayer, and a PHY layer.

[0034] The one or more control units may be integrated into the CU. The communication network may further include, on the control plane and above the underlying protocol stack: at the CU, a service controller sublayer, which is deployed: above the Packet Data Convergence Protocol (PDCP) sublayer; or between the PDCP sublayer and the Radio Resource Control (RRC) sublayer; or above the RRC sublayer.

[0035] The communication network may further include, on the control plane and above the underlying protocol stack: at the one or more DUs, a deployed PHY layer, an RLC sublayer, and a MAC sublayer.

[0036] The communication network may also include, on the control plane and above the underlying protocol stack, at the UE, a service controller sublayer, deployed: above the PDCP sublayer; or between the PDCP sublayer and the RRC sublayer; or above the RRC sublayer. The communication network may also include, on the control plane and above the underlying protocol stack, at the UE, an RLC sublayer, a MAC sublayer, and a PHY layer.

[0037] The one or more PF units may be deployed between the one or more DUs and the CU. The first PF unit among the one or more PF units may include: a PF sublayer, deployed above the Packet Data Convergence Protocol (PDCP) sublayer and corresponding to the PF sublayer of the UE. The first PF unit may further include: the PDCP sublayer, corresponding to the PDCP sublayer of the UE.

[0038] The communication network may further include: a second PF unit among the one or more PF units, deployed between the one or more DUs and the CU, wherein the first PF unit may further include: a second PF sublayer, corresponding to the PF sublayer of the second PF unit, and the second PF sublayer is deployed above the second PDCP sublayer of the first PF unit.

[0039] The CU may be used to perform at least one of the following: one or more functions of the Packet Data Convergence Protocol (PDCP) sublayer for (de)compression of headers; sequence numbering of PDCP service data units (SDUs).

[0040] The one or more PF units may be used to perform one or more functions of the PDCP sublayer for security protection, wherein the one or more functions are related to one or more of the following: integrity protection and encryption.

[0041] A network service among the one or more network services may be identified by a network service identifier (ID). The network service ID may include one or more of the following: a service type ID, a task ID, a task set ID, a network ID. The service type ID may identify the network type of the network service. The task ID may identify the data processing task that the network service is used to perform. The task set ID may identify the task set that the network service is used to perform, and the task set includes one or more tasks among the tasks. The network ID may identify the network that provides the network service.

[0042] The communication network may further include a plurality of network nodes. Two of the plurality of network nodes may be used to exchange the capabilities of the two network nodes in terms of the one or more network services. Each of the two network nodes may be one of the following: a service module in the one or more service modules; a PF unit in the one or more PF units; a service controller unit in the one or more service controller units; a DU in the one or more DUs; the CU.

[0043] The two network nodes may be used to exchange the capabilities of the two network nodes by causing a first node among the two network nodes to send a first message to a second node among the two network nodes. The message may include one or more of the following: a node identifier (ID) identifying the first node; a cell ID identifying the cell providing the network service in the one or more network services; a tracking area ID identifying the tracking area providing the network service in the one or more network services; a network service ID identifying the network service; a network ID identifying the network providing the network service, where the network ID is one of the following: a public land mobile network (PLMN) ID or a non-public network (NPN) ID.

[0044] The two network nodes may be used to exchange the capabilities of the two network nodes by further causing the second node to send a second message to the first node. The second message may include one or more of the following: a node ID identifying the second node; a second cell ID; a second tracking area ID; a second network service ID; a second network ID.

[0045] One or more of the node ID, the second cell ID, the second network service ID, and the second network ID included in the second message and identifying the second node may be the same as one or more of the node ID, the cell ID, the network service ID, and the network ID included in the first message.

[0046] The second node may be used to send a failure message to the first node when the second node determines that the capability of the second node to provide the network service does not overlap with the capability of the first node to provide the network service.

[0047] A network node among the multiple network nodes sends a message to the UE to identify the one or more network services. The message may include one or more of the following: cell identifier (ID), network service ID, and network ID. The network ID may be one of the following: Public Land Mobile Network (PLMN) ID or Non-Public Network (NPN) ID. The message may be either a unicast message or a multicast / broadcast message. Wherein, if the message is a unicast message, the message may be either a dedicated Radio Resource Control (RRC) message or a dedicated signaling message. Wherein, if the message is a multicast / broadcast message, the message may be a System Information (SI) message.

[0048] After receiving the message, the UE may select a network service from the one or more network services for access and send a second message to the network node. The second message may include one or more of the following: network service ID associated with the selected network service, network ID associated with the selected network service, cell ID associated with the selected network service. The second message may be a dedicated Radio Resource Control (RRC) message or a dedicated signaling message of the network service.

[0049] The PF sublayer may be used to perform privacy protection on data processing at one or more of the following: the one or more PF units, the UE, and the CU. The PDCP sublayer may be used to perform security protection on data forwarding at one or more of the following: the one or more PF units, the one or more service controller units, the CU, and the UE.

[0050] The communication network may support one or more Access Stratum (AS) security modes, and each AS security mode indicates that security protection and privacy protection will not be performed on the one or more network services on the user plane (UP) and / or control plane (CP), or that security protection and / or privacy protection will be performed on the one or more network services on the user plane (UP) and / or control plane (CP).

[0051] The one or more AS security modes may indicate that the Packet Data Convergence Protocol (PDCP) sublayer (e.g., for encryption and integrity) will perform the security protection on the one or more network services on the UP. The one or more AS security modes may indicate that the PF sublayer (e.g., for privacy protection) will perform the privacy protection on the one or more network services on the UP. The one or more AS security modes may indicate that the PDCP sublayer will perform the security protection on the one or more network services on the UP, and the PF sublayer will perform the privacy protection on the one or more network services on the UP. The one or more AS security modes may indicate that the PDCP sublayer and the PF sublayer will not perform the security protection or the privacy protection on the network services on the UP.

[0052] The one or more AS security modes indicate that the Packet Data Convergence Protocol (PDCP) sublayer will perform the security protection on the one or more network services on the CP. The one or more AS security modes indicate that the service controller sublayer will perform the privacy protection on the one or more network services on the CP. The one or more AS security modes indicate that the PDCP sublayer will perform the security protection on the one or more network services on the CP, and the service controller sublayer will perform the privacy protection on the network services on the CP. The one or more AS security modes indicate that the PDCP sublayer and the service controller sublayer will not perform the security protection or the privacy protection on the one or more network services on the CP.

[0053] The one or more AS security modes may indicate one or more security algorithms based on which the security protection and / or the privacy protection will be performed. The one or more security algorithms include one or more of the following: encryption algorithms and integrity algorithms on the Packet Data Convergence Protocol (PDCP) sublayer; privacy protection algorithms on the PF sublayer; privacy protection algorithms on the controller sublayer.

[0054] The one or more supported AS security modes may be configured at one or more of the following: the one or more service modules, the one or more PF units, the UE, the CU, the one or more service controller units, and the aggregated RAN node. The aggregated RAN node may include two or more of the following: the one or more service modules, the one or more PF units, the CU, the one or more service controller units, and the one or more DUs.

[0055] The communication network may further provide a first network node, and the first network node notifies one or more AS security modes supported at the first network node to a second network node through an AS security mode notification procedure.

[0056] The AS security mode notification procedure may include: the first network node sending a message to the second network node. The message may include one or more AS security mode IDs, each AS security mode ID identifying an AS security mode supported by the first node, and the message may further include the priority of each supported AS security mode among the supported AS security modes. The message may further include the corresponding quality of service (QoS) guaranteed by each supported AS security mode among the supported AS security modes for the one or more network services.

[0057] The first network node may be the UE. The second network node may be one of the following: a service module in the one or more service modules, the CU, a service controller unit in the one or more service controller units, the integrated RAN node and CN function (CNF). The first network node sending a message to the second network node may include: the UE sending a report to the second network node, the report indicating one or more supported AS security modes of the UE.

[0058] The AS security mode notification procedure may further include: after receiving the report from the UE, the second network node selects an AS security mode for the UE and sends an AS security configuration to the UE. The AS security configuration may include one or more of the following: the selected AS security mode and AS security parameters; the AS security configuration may be sent to the UE through one or more of the following: a dedicated radio resource control (RRC) message, a dedicated signaling message for one or more network services, and a non-access stratum (NAS) message. The dedicated RRC message may be an AS security mode command message.

[0059] The AS security mode notification procedure may further include: based on the AS security configuration, on the UP, the UE performs one or more of the following: performing uplink encryption on the packet data convergence protocol (PDCP) sublayer for securing data forwarding; performing downlink decryption on the PDCP sublayer for securing data forwarding; performing uplink encryption on the PF sublayer for protecting privacy of data processing; performing downlink decryption on the PF sublayer for protecting privacy of data processing.

[0060] The AS security mode notification process may further include: based on the AS security configuration, on the CP, the UE performs one or more of the following: performs uplink encryption on the Packet Data Convergence Protocol (PDCP) sublayer for security protection; performs downlink decryption on the PDCP sublayer for security protection; performs uplink encryption on the service controller sublayer for privacy protection; performs downlink decryption on the service controller sublayer for privacy protection.

[0061] The AS security mode notification process may further include: based on the AS security configuration, on the UP, the second network node performs one or more of the following: performs downlink encryption on the Packet Data Convergence Protocol (PDCP) sublayer for securing data forwarding; performs uplink decryption on the PDCP sublayer for securing data forwarding; performs downlink encryption on the PF sublayer for privacy protection of data processing; performs uplink decryption on the PF sublayer for privacy protection of data processing.

[0062] The AS security mode notification process may further include: based on the AS security configuration, on the CP, the second network node performs one or more of the following: performs downlink encryption on the Packet Data Convergence Protocol (PDCP) sublayer for security protection; performs uplink decryption on the PDCP sublayer for security protection; performs downlink encryption on the service controller sublayer for privacy protection; performs uplink decryption on the service controller sublayer for privacy protection.

[0063] The AS security mode notification process may further include: based on the selected AS security mode, the RAN performs downlink encryption on one or more of the following: the Packet Data Convergence Protocol (PDCP) sublayer for data forwarding, associated with the service data bearer (XDB) on the serving UP; the PF sublayer, associated with the XDB on the serving UP. The AS security mode notification process may further include: based on the selected AS security mode, the RAN performs uplink decryption on one or more of the following: the PDCP sublayer for data forwarding, associated with the XDB on the serving UP; the PF sublayer, associated with the XDB on the serving UP.

[0064] The AS security mode notification process may further include: based on the selected AS security mode, the RAN performs downlink encryption on one or more of the following: the PDCP sublayer associated with the service signaling bearer (XSB) on the serving CP; the service controller sublayer associated with the XSB on the serving CP; and performs uplink decryption on one or more of the following: the PDCP sublayer associated with the XSB on the serving CP; the service controller sublayer associated with the XSB on the serving CP.

[0065] The first network node may be one or more PF units, and the second network node may be a service controller unit of the one or more service controllers. Each PF unit among the one or more PF units may send a message to the service controller unit.

[0066] The second network node may be a service controller unit among the one or more service controller units. The service controller unit may select a PF unit among the one or more PF units to serve the UE. The selected PF unit may support one or more AS security modes that overlap with the one or more AS security modes supported by the UE. The service controller unit may select an AS security mode supported by one or more of the following: the UE, the selected PF unit, and the service controller. The service controller unit may send an AS security configuration corresponding to the AS security configuration of the UE to the PF unit.

[0067] Based on the AS security configuration received from the service controller unit, the selected PF unit performs one or more of the following: on the user plane (UP), performs downlink encryption on one or more of the following: the packet data convergence protocol (PDCP) sublayer and the PF sublayer. Based on the AS security configuration received from the service controller unit, the selected PF unit performs one or more of the following: on the UP, performs uplink decryption on one or more of the following: the PDCP sublayer and the PF sublayer. Based on the AS security configuration received from the service controller unit, the selected PF unit performs one or more of the following: on the control plane (CP), performs downlink encryption on one or more of the following: the PDCP sublayer and the service controller sublayer. Based on the AS security configuration received from the service controller unit, the selected PF unit performs one or more of the following: on the CP, performs uplink decryption on one or more of the following: the PDCP sublayer and the service controller sublayer.

[0068] In the communication network, a data bearer for one or more of the network services can be established between the UE and a service module among the one or more service modules on the RAN. The data bearer for one or more of the network services can be established between the PF protocol layer on the UE side and the PF protocol layer on the PF unit side of the service module among the one or more service modules. The PF protocol layer on the UE side and the PF protocol layer on the PF unit side can belong to the data bearer.

[0069] The communication network can provide for the establishment of a data bearer for one or more of the network services between the UE and a service module among the one or more service modules on the RAN. A signaling bearer for one or more of the network services can be established between the service controller protocol layer on the UE side of the service module and the service controller protocol layer on the service controller unit side. The service controller protocol layer on the UE side and the service controller protocol layer on the service controller unit side can belong to the signaling bearer.

[0070] Security protection for data forwarding and / or privacy protection for data processing can be performed on one or more of the following: the data bearer for one or more of the network services and the signaling bearer for one or more of the network services.

[0071] After receiving the second message, the network node can establish one or more of the following for the selected network service: a data bearer and a signaling bearer. Then, the network node can send bearer configuration information to the UE. The bearer configuration information can include AS security configuration. The AS security configuration can include one or more of the following: a selected AS security mode and AS security parameters.

[0072] The service module among the one or more service modules can be directly connected to the CN function (CNF) or connected through the CU.

[0073] The communication network can provide for the establishment of one or more sessions on the user plane to provide the one or more network services to the UE, and the one or more sessions involve one or more of the following: one or more service modules on the RAN side, one or more service modules on the CN side, one or more DUs, one or more CUs, one or more PF units on the RAN side, one or more PF units on the CN side, and the UE.

[0074] The one or more sessions may include one or more QoS flows in the quality of service (QoS) flows of the one or more network services, and the one or more QoS flows are the finest granularity of QoS differentiation in the session. Traffic in the same QoS flow among the one or more QoS flows may receive the same data forwarding disposition and data processing disposition.

[0075] The one or more QoS flows may be mapped by a service data adaptation protocol sublayer to one or more data bearers of the one or more network services. The UE sends a request message to the communication network to establish the one or more sessions. The request message includes one or more of the following: session identifier (ID), QoS flow ID, QoS requirement, network service ID, network ID, UE ID, and UE group ID.

[0076] According to another aspect, a method for aligning everything as a service (XaaS) capabilities between two network nodes may be provided. The method may include: a first network node (NN) sending an interface request message to a second NN to establish or update an interface between the first NN and the second NN. The interface establishment message may include one or more of the following: a first node identifier (ID), cell ID, service ID, and network ID. The method may further include: the first NN receiving an interface response message from the second NN, the interface response message indicating that the interface between the first NN and the second NN is established or updated. The interface response message may include a second node ID and information overlapping with the interface request message, and the information includes one or more of the following: cell ID, service ID, and network ID.

[0077] The first NN may be one of a processing function (PF) node and an XaaS controller (XC) node of a RAN. If the first NN is the PF node, the second node may be the XC node. Or, if the first NN is the XC node, the second node may be the PF node. In this case, the interface between the first NN and the second NN may be a T3 interface.

[0078] The first NN may be an XC node. The one or more service IDs included in the interface request message may indicate one or more services supported by the XC node through the one or more network IDs included in the interface request message. The one or more services supported by the XC node may also be supported by at least one processing function (PF) associated with the XC node. The second NN may be a centralized unit (CU) node of a RAN. In this case, the interface between the first NN and the second NN may be a T2 interface.

[0079] The first NN may be a distributed unit node of the RAN. The second NN may be a CU node of the RAN. In this case, the interface between the first NN and the second NN may be the F1 interface.

[0080] The first NN may be a distributed unit node of the RAN, and the second NN may be an XC node. In this case, the interface between the first NN and the second NN is the T1 interface.

[0081] The method may further include: the first NN sending a supported service message to a user equipment (UE), the supported service message including one or more of the following: a service ID, a network ID, and a cell ID.

[0082] The supported service message may be sent by a unicast method, and the supported service message is a dedicated radio resource control message or a dedicated signaling message. The supported service message may be sent by a multicast / broadcast method, and the supported service message is a system information block.

[0083] According to another aspect, a method related to XaaS bearer establishment is provided. The method may include an XC node of the RAN receiving a request message for a service from a UE. The method further includes: the XC node sending a UE context establishment request message to a PF associated with the XC node to establish resources for the service. The method further includes: the XC node receiving a UE context establishment response from the PF, the UE context establishment response indicating the establishment of a bearer associated with the service. The method further includes: the XC node sending a service response to the UE to configure the UE for the service.

[0084] The request message may include one or more of the following: a session ID identifying a session through which the UE may receive the service; a QoS flow ID identifying a QoS flow included in the session; QoS requirements; a service ID identifying the service; a network ID identifying the network through which the UE may receive the service; a cell ID identifying the cell through which the UE may receive the service; an ID associated with the UE.

[0085] The service response may include one or more of the following: a session ID identifying the session through which the UE may receive the service; a QoS flow ID identifying the QoS flow included in the session; a bearer ID; a data radio bearer (DRB) ID identifying the DRB; a new radio bearer (NRB) ID identifying the radio bearer for point-to-multipoint data transmission. The service response may further include mapping information associated with the session, the QoS flow, the bearer, and the DRB. The service response may further include configurations of layer L1 and layer L2.

[0086] The request message may be one of a radio resource control message and a dedicated signaling message. The QoS requirement may indicate one or more of the following: data forwarding parameters and data processing parameters.

[0087] The UE context establishment request message may include one or more of the following: a bearer identifier (ID) identifying the bearer associated with the service, a QoS flow ID identifying the mapping of the QoS flow, a mapped session ID identifying the session, an ID associated with the UE, a QoS requirement for the bearer or the QoS flow, a node address for forwarding service data to the CU node.

[0088] The method may further include: the XC node selecting the PF from one or more PFs connected to the XC node based on the service request message.

[0089] The method may further include: the XC node sending a second request message for the service to the CU node, the second request message including one or more information included in the request message. The method may further include: the XC node receiving a bearer context establishment request message from the CU to establish the resources for the service. The bearer context establishment request message may include one or more information in the context establishment request message. The method may further include: the XC node sending a UE bearer contention establishment response message to the CU, the UE bearer contention establishment response message indicating the establishment of the bearer associated with the service.

[0090] The method may further include: the XC node receiving a second bearer context update request message from the centralized unit node to update the bearer. The method may further include: the XC node sending a second context establishment request message to the PF to update the bearer based on the bearer context update request message.

[0091] The second bearer context update message may include one or more of the following: a data radio bearer ID, an NRB ID, a mapped bearer ID, a node address for forwarding service data to a distributed unit (DU) node.

[0092] According to another aspect, a method for establishing an XaaS bearer is provided. The method may include: a CU node of a RAN receiving a request message associated with a UE from an XC node of the RAN, the request message requesting a service. The method further includes: the CU node sending a second request message for the service to a core network function (CNF), the second request message including one or more information included in the request message. The method further includes: the CU node receiving a setup request message from the CNF to establish resources for the service, the setup request message including one or more information included in the request message and the second request message.

[0093] The request message includes one or more of the following: a session ID identifying a session through which the UE may receive the service; a QoS flow ID identifying a QoS flow included in the session; QoS requirements; a service ID identifying the service; a network ID identifying the network through which the UE may receive the service; a cell ID identifying a cell through which the UE may receive the service; an ID associated with the UE.

[0094] The method may further include: the CU node sending a bearer context setup request message to the XC node to establish resources for the service based on the setup request message. The method may further include: the CU node receiving a UE bearer context setup response message from the XC node, the UE bearer context setup response message indicating the establishment of a bearer associated with the service.

[0095] The bearer context setup request message includes one or more of the following: a bearer ID identifying a bearer associated with the service, a mapped QoS flow ID identifying a QoS flow, a mapped session ID identifying a session associated with the service, an ID associated with the UE requesting the service, QoS requirements for the bearer or the QoS flow, a node address for forwarding service data to the CU node.

[0096] The method may further include: the CU node sending a second UE context establishment request message to a distributed unit (DU) node to establish resources for the service. The second context establishment request message may include one or more of the following: DRB ID, NRB ID, mapped bearer ID, node address for forwarding service data to the DU node. The method may further include: the CU node receiving a second UE bearer context establishment response message from the DU node, the second UE bearer context establishment response message indicating the establishment of a DRB. The second UE bearer context establishment response message may include one or more of the following: DRB ID, NRB ID, mapped bearer ID, configuration information of the radio link control (RLC) sublayer, configuration information of the MAC sublayer, configuration information of the PHY layer.

[0097] The method may further include: the CU node sending a second bearer context update request message to the XC node to establish resource updates for the service to update the bearer. The method may further include: the CU node receiving a second context establishment request message from the XC node to update the XaaS bearer based on the bearer context update request message. The method may further include: the CU sending a service response message to the UE to configure the UE for the service.

[0098] The second bearer context update message may include one or more of the following: DRB ID, NRB ID, mapped bearer ID, the node address for forwarding service data to the DU node.

[0099] According to another aspect, a method for security configuration based on a pre-configured access stratum (AS) security mode is provided. The method may include: an XC node of a RAN receiving a security mode message from at least one PF associated with the XC node, the security mode message including one or more AS security mode IDs identifying one or more AS security modes supported by the at least one PF. The method may further include: the XC node receiving a bearer establishment request message from a CU node, the bearer establishment request message including one or more of the following: AS security mode IDs identifying one or more AS security modes supported by a UE. The method may further include: the XC node selecting a PF based on the one or more AS security modes supported by the UE and the one or more AS security modes supported by the at least one PF.

[0100] Each of the one or more AS security modes supported by the at least one PF may indicate that security protection should not be performed on the Packet Data Convergence Protocol (PDCP) sublayer and the PF sublayer, or that security protection should be performed on one or more of the PDCP sublayer and the PF sublayer. The security mode message may also include one or more AS priority indicators corresponding to the one or more AS security modes, the one or more AS priority indicators indicating the priorities of the one or more AS security modes.

[0101] The method may further include: the XC node sending a second security mode message to the CN node, the second security mode message including the one or more AS security mode IDs identifying the one or more AS security modes supported by the at least one PF.

[0102] The bearer establishment request message may include one or more of the following: a selected security mode supported by the core network and the UE, CU assistance information regarding the AS security mode, CN assistance security information. The CN assistance security information may include one or more of the following: CN assistance information regarding the AS security mode, and CN assistance security parameters for deriving AS security parameters.

[0103] The method may further include: the XC node selecting an AS security mode based on one or more of the following: the CU assistance information and the CN assistance information regarding the AS security mode. The method may further include: the XC node generating AS security parameters according to the selected AS security mode and based on the CN assistance security parameters. The method may further include: the XC node sending an AS security configuration message to the at least one PF, the AS security configuration message including one or more of the following: the ID of the selected AS security mode and the generated AS security parameters.

[0104] The CN assistance security parameters may include one or more of the following: a first security key Kx for generating AS security parameters of the PF sublayer and a second security key Kc for generating AS security parameters of the PDCP sublayer.

[0105] Generating AS security parameters may include: the XC node generating one or more AS security keys based on the first security key Kx. The one or more AS security keys include a first AS security key Kpf-u for PF sub-layer security between the selected PF and the UE. The one or more AS security keys include a second AS security key Kpf-pf for PF sub-layer security between different PF units. The one or more AS security keys include a third AS security key Kxc-u for XC sub-layer security between the XC node and the UE. Generating AS security parameters may include: the XC node generating a fourth AS security key Kpd-u for PDCP sub-layer security between the PF and the UE based on the second security key Kc.

[0106] The method may further include: the XC node sending a second AS security configuration message to the UE, the second AS security configuration message including one or more of the following: the ID of the selected AS security mode and the generated AS security parameters. The method may further include: the XC node sending a third AS security configuration message to the CU node, the third AS security configuration message including one or more of the following: the ID of the selected AS security mode and the generated AS security parameters. Each of the UE and the XC node may be pre-configured with a set of AS-supported security modes.

[0107] According to another aspect, another method is provided. The method may involve configuring security protection based on a pre-configured security mode. The method may include the CU node of the RAN receiving a setup request message from a core network function (CNF). The setup request message may include a set of AS security mode IDs identifying one or more AS security modes supported by the UE. The method may further include: the CU node sending a bearer setup request message to the XC node of the RAN, the bearer setup request message including the set of AS security mode IDs. The method may further include: the CU node receiving an AS security configuration message from the XC node, the AS security configuration message including one or more of the following: the ID of the AS security mode selected by the XC node and the AS security parameters generated by the XC node.

[0108] The method may further include: the CU node sending a second AS security configuration message to the UE, the second AS security configuration message including one or more of the following: the ID of the AS security mode selected by the XC node and the AS security parameters generated by the XC node.

[0109] The method may further include: the CU node receiving a security mode message from the XC node, the security mode message indicating one or more AS security modes supported by at least one PF associated with the XC node. The method may further include: the CU node selecting, based on one or more of the following, an AS security mode for data forwarding on the PDCP sublayer: the one or more AS security modes supported by the UE, the one or more AS security modes supported by the at least one PF, the CN-assisted security information included in the establishment request message. The method may further include: the CU node generating AS security parameters based on the selected AS security mode. The method may further include: the CU node generating CU-assisted information regarding the AS security mode.

[0110] The establishment request message may further include a security key Kc for generating AS security parameters for the PDCP sublayer. Generating the AS security parameters includes generating an AS security key Kpd-u based on the security key Kc.

[0111] Each of the UE and the CU node may be pre-configured with a set of security modes supported by AS.

[0112] According to another aspect, a method is provided. The method may provide security configuration based on pre-configured security modes. The method may include: the CNF receiving a registration request message from a user equipment (UE), the registration request message including: a set of NAS security mode IDs identifying one or more NAS security modes supported by the UE, a second set of AS security mode IDs identifying one or more AS security modes supported by the UE. The method may further include: the CNF selecting, based on one or more of the following, a NAS security mode for data processing and data forwarding: the one or more NAS security modes supported by the UE and the set of security modes supported by the CNF. The method may further include: the CNF sending a NAS security configuration message to the UE, the NAS security configuration message including: the ID of the selected NAS security mode. The method may further include: the CNF sending an establishment request message to a CU node of the RAN, the establishment request message including one or more information included in the registration request message.

[0113] The establishment request message may further include CN-assisted information and CN-assisted security parameters regarding the AS security mode. Each of the UE and the CNF is pre-configured with a set of security modes supported by NAS.

[0114] According to another aspect, a method is provided. The method can provide a security configuration based on pre-configured security capabilities. The method can include: an XC node of the RAN receives a security capability message from at least one PF associated with the XC node. The security capability message can include security capabilities supported by the at least one PF, and the security capabilities include one or more of the following: a set of security capabilities in data processing supported by the at least one PF and a second set of security capabilities in data forwarding. The method can further include: the XC node receives a bearer establishment request message from a CU node, and the bearer establishment request message includes security capabilities supported by a UE, and the security capabilities include one or more of the following: a set of security capabilities in data processing and a second set of security capabilities in data forwarding. The method can further include: the XC node selects a PF based on the security capabilities supported by the at least one PF and the security capabilities supported by the UE.

[0115] The set of security capabilities in data processing can include: a set of security for data processing on the PF sublayer. The set of security capabilities in data forwarding can include: a set of security algorithms for data forwarding on the PDCP sublayer.

[0116] The method can further include: the XC node sends a second security capability message to the CN node, and the second security capability message includes one or more pieces of information included in the security capability message.

[0117] The bearer establishment request message can further include CU assistance information about the AS security mode and CN assistance security information. The CN assistance security information can include one or more of the following: CN assistance information about the AS security mode, and CN assistance security parameters for deriving AS security parameters.

[0118] The method can further include: the XC node selects an AS security mode based on one or more of the following: the CU assistance information and the CN assistance information about the AS security mode. The method can further include: the XC node selects an AS security algorithm based on one or more of the following: the selected AS security mode, the security capabilities supported by the at least one PF unit, and the security capabilities supported by the UE. The method can further include: the XC node generates AS security parameters according to the selected AS security mode and based on the CN assistance security parameters. The method can further include: the XC node sends an AS security configuration message to the at least one PF, and the AS security configuration message includes one or more of the following: the ID of the selected AS security mode, the selected AS security algorithm, and the generated AS security parameters.

[0119] The CN auxiliary security parameters may include one or more of the following: a first security key Kx for generating the AS security parameters of the PF sublayer and a second security key Kc for generating the AS security parameters of the PDCP sublayer. Generating the AS security parameters may include: the XC node generating one or more AS security keys based on the first security key Kx. The one or more AS security keys may include a first AS security key Kpf-u for the PF sublayer security between the selected PF and the UE. The one or more AS security keys may include a second AS security key Kpf-pf for the PF sublayer security between different PF units in the at least one PF unit. The one or more AS security keys may include a third AS security key Kxc-u for the XC sublayer security between the XC node and the UE. Generating the AS security parameters includes: the XC node generating a fourth AS security key Kpd-u for the PDCP sublayer security between the PF and the UE based on the second security key Kc.

[0120] The method may further include: the XC node sending a second AS security configuration message to the UE, the second AS security configuration message including one or more of the following: the ID of the selected AS security mode, the selected AS security algorithm, and the generated AS security parameters. The method may further include: the XC node sending a third AS security configuration message to the CU node, the third AS security configuration message including one or more of the following: the ID of the selected AS security mode, the selected AS security algorithm, and the generated AS security parameters.

[0121] Each of the UE and the XC node may be pre-configured with a set of security capabilities, the set of security capabilities indicating one or more lists of algorithms for data processing and / or data forwarding.

[0122] According to another aspect, a method for performing security configuration based on pre-configured security capabilities is provided. The method includes: a CU node of a RAN receives a setup request message from a CNF. The setup request message may include security capabilities supported by a UE, and the security capabilities include one or more of the following: a set of security capabilities in terms of data processing and a second set of security capabilities in terms of data forwarding. The method may further include: the CU node sends a bearer setup request message to an XC node of the RAN, and the bearer setup request message includes the security capabilities supported by the UE. The method may further include: the CU node receives an AS security configuration message from the XC node, and the AS security configuration message includes one or more of the following: an ID of an AS security mode selected by the XC node, a set of AS security algorithms selected by the XC node, and AS security parameters generated by the XC node. The method may further include: the CU node sends a second AS security configuration message to the UE, and the second AS security configuration message includes the AS security configuration message.

[0123] The method may further include: the CU node receives a security capabilities message from the XC node, and the security capabilities message indicates the security capabilities supported by at least one PF associated with the XC node. The method may further include: the CU node selects a set of AS security capabilities for data forwarding on the PDCP sublayer based on one or more of the following: the security capabilities supported by the at least one PF, the security capabilities supported by the UE, and CN assistance security information included in the setup request message. The method may further include: the CU node generates AS security parameters based on the selected set of AS security capabilities. The method may further include: the CU node generates CU assistance information regarding the AS security mode.

[0124] The setup request message may further include a security key Kc for generating AS security parameters for the PDCP sublayer. Generating the AS security parameters may include generating an AS security key Kpd-u based on the security key Kc.

[0125] Each of the UE and the CU node may be pre-configured with a set of security capabilities, and the set of security capabilities indicates one or more lists of algorithms for data processing and / or data forwarding.

[0126] According to another aspect, a method for performing security configuration based on pre-configured security capabilities is provided. The method includes: the CNF receiving a registration request message from the UE, the registration request message including: security capabilities supported by the UE, the security capabilities including a first set of security algorithms for data processing and a second set of security algorithms for data forwarding. The method may further include: the CNF selecting a set of AS security algorithms based on one or more of the following: the security capabilities supported by the UE and the security capabilities supported by the CNF. The method may further include: the CNF sending a NAS security configuration message to the UE, the NAS security configuration message including the selected set of AS security algorithms. The method may further include: the CNF sending a setup request message to the CU node of the RAN, the setup request message including the security capabilities supported by the UE.

[0127] The setup request message may further include CN assistance information and CN assistance security parameters regarding the AS security mode. Each of the UE and the CNF may be pre-configured with a set of security capabilities, the set of security capabilities indicating one or more lists of algorithms for data processing and / or data forwarding.

[0128] According to another aspect, a device is provided. The device includes modules for performing one or more methods and systems described herein.

[0129] According to one aspect, a device is provided, wherein the device includes: a memory for storing a program; a processor for executing the program stored in the memory, and when the program stored in the memory is executed, the processor is configured to execute one or more methods and systems described herein.

[0130] According to another aspect, a computer-readable medium is provided, wherein the computer-readable medium stores program code for being executed by a device and for executing one or more methods and systems described herein.

[0131] According to one aspect, a chip is provided, the chip including a processor and a data interface, the processor reading instructions stored in a memory through the data interface to execute one or more methods and systems described herein.

[0132] Other aspects of the present invention provide apparatuses and systems for implementing the methods according to the first aspect disclosed herein. For example, a wireless station and an access point may be configured with a machine-readable memory that includes instructions which, when executed by a processor of these devices, cause the devices to perform one or more of the methods and systems disclosed herein.

[0133] Embodiments have been described above in connection with aspects of the present invention, and these embodiments may be implemented based on these aspects. Those skilled in the art will understand that embodiments may be implemented in combination with the aspects describing these embodiments, but may also be implemented together with other embodiments of that aspect. When embodiments are mutually exclusive or incompatible with each other, it will be obvious to those skilled in the art. Some embodiments may be described in connection with one aspect, but may also be applicable to other aspects, which is obvious to those skilled in the art. BRIEF DESCRIPTION OF THE DRAWINGS

[0134] In conjunction with the accompanying drawings, further features and advantages of the present invention will become apparent from the following detailed description, in which:

[0135] Figure 1 An XaaS module and related interfaces are shown.

[0136] Figure 2 A split RAN architecture is shown.

[0137] Figure 3 Potential security protection for future networks is shown.

[0138] Figure 4 A split RAN architecture provided by one aspect is shown.

[0139] Figure 5 The deployment of the PF sublayer in the PF unit of the XaaS module provided by one aspect is shown.

[0140] Figure 6 The deployment of the XC sublayer in the XC unit of the XaaS module provided by one aspect is shown.

[0141] Figure 7 The deployment of the PF unit at the CU provided by one aspect is shown.

[0142] Figure 8 The deployment of the XC unit at the CU provided by one aspect is shown.

[0143] Figure 9 An XaaS ID provided by one aspect is shown.

[0144] Figure 10 The process of XaaS capability alignment between two nodes provided by one aspect is shown.

[0145] Figure 11 Illustrates a process for notifying a UE of support for XaaS services provided in one aspect.

[0146] Figure 12 Illustrates the deployment of a PF unit provided in one aspect.

[0147] Figure 13 Illustrates multiple PF units provided in one aspect participating in providing XaaS services to a UE.

[0148] Figure 14 Illustrates the deployment of multiple PF units provided in one aspect.

[0149] Figure 15 Illustrates an example table of supported AS security modes provided in one aspect.

[0150] Figure 16 Illustrates a process for joint security configuration based on a preconfigured security mode provided in one aspect.

[0151] Figure 17 Illustrates a process for joint security configuration based on preconfigured security capabilities provided in one aspect.

[0152] Figure 18 Illustrates an interface management process for a split RAN provided in one aspect.

[0153] Figure 19A and Figure 19B Illustrates a process for establishing an XaaS session and an XaaS bearer provided in one aspect.

[0154] Figure 20 Illustrates a process for joint security configuration of the PDCP sublayer and the PF sublayer based on a preconfigured security mode provided in one aspect.

[0155] Figure 21 Illustrates a process for joint security configuration of the PDCP sublayer and the PF sublayer based on preconfigured security capabilities provided in one aspect.

[0156] Figure 22 Illustrates an apparatus that can perform any or all of the operations of the above methods and features explicitly or implicitly described herein, provided in different aspects of the present invention.

[0157] It should be noted that throughout the drawings, the same features are identified by the same reference numerals. Detailed Description

[0158] Future networks can provide new types of services that support network-native data processing using one or more of the following methods: data analysis, AI training, AI inference, data privacy protection, data storage, data collection, data purification, data processing, data management, data cleaning, data normalization, useless data filtering, data feature engineering, data compression, data embedding, data representation learning, and data feature extraction.

[0159] Aspects of the present invention can provide systems and methods related to a split RAN architecture and security mode for a future X-centric service network. Some aspects of the present invention can provide for the deployment of plug-and-play XaaS modules in a split RAN architecture. According to one aspect, participating units for data forwarding (e.g., a central unit and a distributed unit) and participating units for data processing (e.g., a PF unit and an XC unit) can be joined to each other as described herein. Other aspects of the present invention can provide an enhanced protocol stack for the participating units.

[0160] Some aspects of the present invention can provide a method for aligning XaaS capabilities between two network nodes. For example, a method for aligning XaaS capabilities between two network nodes can include: a first NN sending an interface request message to a second NN to establish or update an interface between the first NN and the second NN. The interface establishment message includes one or more of the following: a first node ID, a cell ID, a service ID, and a network ID. The method can further include: the first NN receiving an interface response message from the second NN, the interface response message indicating that the interface between the first NN and the second NN has been established or updated. The interface response message can include a second node ID and information overlapping with the interface request message, the information including one or more of the following: a cell ID, a service ID, and a network ID.

[0161] Some aspects can provide an interface management process. Some aspects can provide the establishment of one or more of an XaaS bearer and an XaaS session. For example, a method can include an XC node of a RAN receiving a request message for a service from a UE. The method further includes: the XC node sending a UE context establishment request message to a PF associated with the XC node to establish resources for the service. The method further includes: the XC node receiving a UE context establishment response from the PF, the UE context establishment response indicating the establishment of a bearer associated with the service. The method further includes: the XC node sending a service response to the UE to configure the UE for the service.

[0162] Other aspects may provide AS security mode selection and configuration based on a pre-configured AS security mode, as described herein. For example, a method may include: an XC node of the RAN receiving a security mode message from at least one PF associated with the XC node. The security mode message may include one or more AS security mode IDs identifying one or more AS security modes supported by the at least one PF. The method may further include: the XC node receiving a bearer establishment request message from the CU node, the bearer establishment request message including one or more of the following: an AS security mode ID identifying one or more AS security modes supported by the UE. The method may further include: the XC node selecting a PF based on one or more AS security modes supported by the UE and one or more AS security modes supported by the at least one PF.

[0163] Other aspects may provide AS security mode selection and configuration based on a pre-configured AS security capability, as described herein. For example, a method may include: an XC node of the RAN receiving a security capability message from at least one PF associated with the XC node. The security capability message may include a security capability supported by the at least one PF, the security capability including one or more of the following: a first set of security capabilities in data processing supported by the at least one PF and a second set of security capabilities in data forwarding. The method may further include: the XC node receiving a bearer establishment request message from the CU node. The bearer establishment request message may include a security capability supported by the UE. The security capability may include one or more of the following: a first set of security capabilities in data processing and a second set of security capabilities in data forwarding. The method may further include: the XC node selecting a PF based on the security capability supported by the at least one PF and the security capability supported by the UE.

[0164] In addition to traditional connection-oriented communication services, 6G also includes new types of services for network-native data processing. These services may include: data analysis, artificial intelligence (AI) training, AI inference, data privacy protection, data storage, data collection, data purification, data processing, data management, data cleaning, data normalization, junk data filtering, data feature engineering, data compression, data embedding, data representation learning, and data feature extraction. One or more of the new types of services for network-native data processing may be referred to as X as a Service (XaaS) or Everything as a Service.

[0165] According to one aspect, an X-centric network can be proposed for 6G to provide XaaS. In some aspects, XaaS can be Data Analytics and Management (DAM) as a Service, NET4AI as a Service, NET4Data as a Service, NET4meta as a Service, etc. In some aspects, one or more of these services can be provided by one or more service providers. The one or more service providers can include one or more of the following: operators, vendors, network functions, network devices, and third parties.

[0166] In one aspect, the DAM service can include collecting data (by one or more service providers) from data sources and providing the collected data to data consumers in a privacy-protected form (e.g., de-identified data or anonymized data, etc.). The data consumers can use the collected data to perform tasks such as data analysis, AI training, and AI inference.

[0167] In some aspects, the NET4AI service can include providing connection and intelligent computing services, e.g., for AI training and AI inference. In some aspects, the NET4Data service can include providing data storage services and performing data access control.

[0168] In some aspects, multiple of these services can be combined and provided to customers. For the combined service, one or more service providers can collaborate with each other to provide the combined service.

[0169] Each XaaS may involve one or more functions when providing services. In some aspects, each XaaS can involve an XC. The XaaS XC can control and manage the service. For example, the XC can control and configure the XaaS PF to perform specific tasks involved in the XaaS.

[0170] In some aspects, each XaaS can also involve one or more PFs. The XaaS PF can perform one or more XaaS tasks under the control of the XC. Some examples of XaaS tasks can include data preprocessing and data privacy protection tasks in the DAM service, AI training and AI inference tasks in the NET4AI service, and data storage and access control tasks in the NET4Data service.

[0171] In some aspects, each XaaS can be provided by an XaaS module. Each module can be associated with an XC and one or more PFs.

[0172] In some aspects, one or more XaaS functions (e.g., XC, PF) can be deployed in one or more of the following: RAN, CN, and UE. For example, XC can be deployed in the network control plane (CP), and PF can be deployed in the network user plane (UP) or data plane. According to one aspect, XaaS PF can be deployed into the network, e.g., to the RAN and UE sides.

[0173] XaaS can be a service that provides data processing between the UE and an XaaS function (e.g., PF deployed in the CN, PF deployed in the RAN, or a data network). In some aspects, XaaS can be a service that provides data processing between an XaaS customer and an XaaS network function, e.g., between the UE and a CN XaaS function, between a third-party server and a CN XaaS function, between the UE and a DN, between the DN and a CN PF, and between a server and a RAN node, etc.

[0174] In some aspects, XaaS can also involve an XaaS session. An XaaS session can refer to the association between an XaaS customer and an XaaS network function that provides XaaS. In some aspects, an XaaS session can be the association between the UE and a CN XaaS function that provides XaaS (e.g., PF deployed in the CN or a data network). In some aspects, an XaaS session can be established between the UE and a CN PF unit, or between the UE and a DN.

[0175] In some aspects, XaaS can be implemented on top of the 5G PDU connection service. In some aspects, establishing an XaaS session can include establishing relevant resources (e.g., connection resources, computing resources, and storage resources) for completing XaaS tasks. In some aspects, an XaaS session can be regarded as an improved PDU session, whose purpose is to perform data processing in addition to data forwarding.

[0176] In some aspects, through an XaaS session, data can be flexibly processed in different nodes (e.g., in a CN PF unit, in a PF sublayer of the RAN, in a PF sublayer of the UE). The number of participating nodes (e.g., RAN, UE, and CN functions) in an XaaS session can be unrestricted. Therefore, an XaaS session can pass through several RAN nodes, and these RAN nodes can cooperate to process XaaS data sequentially or in parallel.

[0177] In some aspects, XaaS may also involve XaaS bearers (which may include XaaS data bearers and XaaS signaling bearers). An XaaS bearer may refer to the services provided by the RAN radio layer 2 (including the PF sublayer and the XC sublayer) for both data transmission and data processing between the UE and the RAN. In some aspects, an XaaS bearer may be a channel provided by the RAN radio layer 2 (including the PF and XC sublayers) to the upper layer for both data transmission and data processing. Therefore, the PF and XC sublayers may provide services for data forwarding and data processing between the UE and the RAN to the upper layer through the XaaS bearer. The service access point between the PF sublayer and the upper layer (or between the XC sublayer and the upper layer) may be the XaaS bearer.

[0178] In some aspects, the XaaS bearer may include an XaaS data bearer (XDB) for user plane data. In some aspects, each XDB may be configured with the PF sublayer at the RAN and the UE, the PDCP sublayer at the RAN and the UE, the RLC sublayer at the RAN and the UE, the MAC sublayer at the RAN and the UE, and the PHY layer at the RAN and the UE.

[0179] In some aspects, the XaaS bearer may include an XaaS signaling bearer (XSB) for control plane data. In some aspects, each XSB may be configured with the XC sublayer at the RAN and the UE, the PDCP sublayer at the RAN and the UE, the RLC sublayer at the RAN and the UE, the MAC sublayer at the RAN and the UE, and the PHY layer at the RAN and the UE, as shown in the figure. In some aspects, the XC sublayer at the RAN and the UE may be located above the PDCP sublayer at the RAN and the UE to transmit signaling messages between the RAN and the UE, for example, to configure and control the PF sublayer.

[0180] In some aspects, XaaS may also involve XaaS QoS flows. According to one aspect, an XaaS QoS flow may be the finest granularity for QoS differentiation in an XaaS session. In some aspects, traffic mapped to the same XaaS QoS flow may receive the same data forwarding treatment and data processing treatment. In some aspects, an XaaS session may include one or more XaaS QoS flows.

[0181] Providing different XaaS QoS data processing and handling and data forwarding handling may require separate XaaS QoS flows. An XaaS QoS flow ID (XQFI) can be used to identify an XaaS QoS flow. The XQFI can be a scalar ID that serves as a reference for a specific XaaS QoS feature. Traffic in an XaaS session with the same XQFI (e.g., user plane traffic) can receive the same data processing and handling and data forwarding handling. Data processing and handling can refer to computing precision, computing latency, privacy level, storage duration, data processing policy, data cleaning policy, data normalization policy, etc. Data forwarding handling can include scheduling policy, queue management policy, link layer protocol configuration (e.g., MAC / RLC configuration), access threshold, etc. In some aspects, the XQFI can be carried in the encapsulation header of a CN or RAN message (e.g., GTP-U message header, SDAP message header).

[0182] In some aspects, XaaS can also involve XaaS QoS parameters. XaaS QoS parameters can include parameters regarding data forwarding handling and parameters regarding data processing and handling. In some aspects, XaaS QoS parameters can be configured for each node (e.g., for each UE), for each network function, for each XaaS session, for each XaaS QoS flow, or for each XaaS bearer.

[0183] In some aspects, data forwarding handling parameters can include one or more of the following: data transmission resource scheduling policy, data queue management policy, data transmission priority level, link layer protocol configuration (e.g., MAC / RLC configuration), access threshold, data loss rate, data transmission latency, data forwarding security protection method, security level, etc. Data forwarding handling parameters can relate to data forwarding in the data plane (e.g., in the RAN L2 / L1 layer and in the CN UPF).

[0184] In some aspects, data processing and handling parameters can include one or more of the following: data processing scheduling policy, computing precision, computing latency, AI model type, privacy protection method, privacy level, data storage duration, data processing policy, data cleaning policy, data normalization policy, data quality level, data processing priority, etc. Data processing and handling parameters can relate to data processing in the UE PF sublayer, the RAN PF sublayer, or the CN PF.

[0185] In some aspects, data forwarding handling parameters and data processing and handling parameters can be cross-adjusted and dynamically adapted, for example, under the control of an XC or other control plane function. For example, data transmission latency and computing latency can be cross-adjusted to ensure the total latency threshold of an XaaS task, e.g., so as to reduce data transmission latency while increasing computing latency to achieve balance.

[0186] In some aspects, one or more data forwarding handling parameters may be associated with one or more data processing handling parameters. For example, ensuring a data forwarding handling parameter (e.g., data loss rate) may be a prerequisite for ensuring a data processing handling parameter (e.g., computing precision).

[0187] In some aspects, an XaaS session may be configured with an SDAP entity. Each XaaS bearer may be configured with a PF entity. Each DRB may be associated with a PDCP entity. In some aspects, the SDAP sublayer may perform mapping between data of one or more XaaS QoS flows and one or more XaaS bearers. One or more XaaS QoS flows may be mapped to an XaaS bearer. One or more XaaS bearers may be further mapped to one or more DRBs.

[0188] Figure 1 An XaaS module and related interfaces are shown. As shown, XaaS may be provided by an XaaS module (e.g., XaaS modules 102, 104, and 106). In some aspects, the XaaS module may be a plug-and-play component that can be deployed in the CN 108, RAN 110, or even the terminal.

[0189] As described herein, the XaaS service may be provided by an XaaS module. According to one aspect, the XaaS module may include at least one PF unit and an XC unit related to the XaaS service. In some aspects, each XaaS module may be responsible for providing a specific XaaS service, such as a DAM service, a NET4AI service. In some aspects, the XaaS module may provide one or more XaaS services according to the implementation.

[0190] In some aspects, one or more XaaS modules with the same or different responsibilities may be deployed in one or more of the CN 108, RAN 110, and the terminal using a centralized or distributed implementation method. Inside an XaaS module 104 or 106, an XC unit 112 or 114 and one or more PF units 116 or 118 may be included. A PF unit may be connected to an XC unit through a T3 interface, and an XC unit may be connected to one or more PF units. In some aspects, one or more of the PF unit and the XC unit may be implemented in a centralized or distributed manner.

[0191] In some aspects, different PF units within the XaaS module can be connected via the T4 interface. The PF unit and the XC unit can be connected to the CN 108 via logical T6 and T7 interfaces respectively (either directly or via intermediate nodes). According to one aspect, the PF units 116 and 118 in different XaaS modules can be connected via the T4 interface. The XC units 112 and 114 in different XaaS modules 104 and 106 can be connected via the T5 interface respectively.

[0192] In some aspects, the T4 interface and the T5 interface between different XaaS modules can be replaced by a unified T8 interface between different XaaS modules.

[0193] Figure 2 A split RAN architecture is shown. As shown, the split RAN architecture 202 can include a CU 204 and one or more DUs 206. The CU 204 and the DU 206 can be interconnected via F1-U (for the user plane) and F1-C (for the control plane) interfaces.

[0194] On the user plane, the Service Data Adaptation Protocol (SDAP) sublayer 211 and the Packet Data Convergence Protocol (PDCP) sublayer 212 can be deployed in the CU 204, and the RLC sublayer 213, the Media Access Control (MAC) sublayer 214, and the Physical (PHY) layer 215 can be deployed in the DU 206. The DRB can be configured with the SDAP 211, PDCP 212, RLC 213, MAC 214 sublayers, and the PHY layer 215.

[0195] On the control plane, the Radio Resource Controller (RRC) sublayer 221 instead of the SDAP sublayer can be deployed in the CU 204 together with the PDCP sublayer 222. At the DU 206, the RLC sublayer 223, the MAC sublayer 224, and the PHY layer 225 can be deployed. The SRB can be configured with the RRC 221, PDCP 222, RLC 223, MAC 224 sublayers, and the PHY layer 225. One DU can be connected to one CU204. The CU 204 can be connected to multiple DUs 206. The DUs can be distributed locally to the UE, and the CU can be distributed in the cloud away from the DUs and the UE.

[0196] The data encapsulated in the QoS flow of the PDU session can be mapped by the SDAP sublayer 211 to one or more DRBs. For example, the RAN SDAP sublayer 211 can map the data of the PDU session or the associated QoS flow to the DRB. The UE can map the uplink data of its PDU session or the associated QoS flow to the DRB to send to the peer RAN. Similarly, the UE can map the downlink data of its DRB to the PDU session or the associated QoS flow to submit to the application layer.

[0197] As described above, a split RAN architecture may include a CU and one or more DUs. One DU can be connected to one CU. One CU can be connected to multiple DUs. The DUs can be locally distributed to the UEs, and the CU can be distributed away from the DUs and UEs in the cloud.

[0198] The coverage range of the DU may be small, such as millimeter wave or terahertz in 6G. Therefore, in order to provide XaaS in the future, deploying the XaaS module in the DU may limit the amount of data that can be collected due to the small local coverage area of the DU. For example, the data that can be collected can include raw data in the DAM service, intermediate model data in the NET4AI service, etc. Therefore, the amount of data collected at the DU may not be sufficient for the XaaS module to fully perform the data processing of XaaS.

[0199] For the CU, the XaaS module can be deployed at the CU 204, and the data collected by the DU 206 can be aggregated at the CU 204 to achieve "big data". However, the data transmission from the DU to the CU may increase the burden on the F1 interface and the CU, thus having a negative impact on traditional connection-oriented services.

[0200] In addition, the current L2 sublayer and PHY layer in the CU and DU may not be able to (lack the function) parse and process data. For example, they do not have the ability to parse and process the service data unit (SDU) of each sublayer or layer.

[0201] In addition, as an internal plug-and-play component of the RAN node, it is not clear how the XaaS module (i.e., the PF unit and the XC unit) is deployed in the RAN. The split architecture of the RAN further increases the complexity of the challenge.

[0202] Figure 3 The potential security protection of the future network is shown. In a traditional data forwarding network, encryption protection can be performed at the PDCP sublayer. In a future network (e.g., a future data forwarding and data processing network), the encryption protection of XaaS can be performed at one or more of the following: the PDCP sublayer 212 and the PF unit 306.

[0203] The PF unit 306 of the XaaS module 302 can use one or more encryption algorithms, such as the homomorphic encryption (HE) algorithm, to perform privacy protection on data processing. In some aspects, the CU 204 (e.g., the PDCP sublayer 212 of the CU) can use one or more encryption algorithms, such as the traditional 5G Advanced Encryption Standard (AES), SNOW 3G, and ZUC (Zuchongzhi block cipher) algorithms, to perform security protection on data forwarding. In some aspects, the CU can perform the security protection on data forwarding together with (or simultaneously with) the privacy protection performed by the PF unit.

[0204] According to one aspect, encryption protection (e.g., for privacy protection) may have been performed on XaaS data in the PF unit. For example, the data may be encrypted by the PF unit using homomorphic encryption in federated learning (FL) (i.e., NET4AI service). In some aspects, if the security level requirements have been met through a homomorphic encryption scheme, the CU (e.g., the PDCP sublayer of the CU) may not need to perform the traditional 5G encryption scheme.

[0205] The AS security mode 310 may indicate what security protection and privacy protection may be required. For example, the AS security mode 310 may indicate that data encryption should not be performed at the PDCP sublayer and the PF unit, or that data encryption should be performed at one or more of the PDCP sublayer and the PF unit. In some aspects, the AS security mode (e.g., only the PDCP sublayer should perform data encryption, only the PF should perform data encryption, both the PDCP sublayer and the PF unit should perform data encryption, or neither should perform data encryption) may be aligned and negotiated between the PF unit 306 and the CU 204 in terms of security protection and privacy protection.

[0206] Some aspects of the present invention may provide for the deployment of XaaS modules together with the CU and the DU in a split RAN architecture. As described herein, the XaaS module (including one or more of the following: PF unit and XC unit) may be a component of a RAN node in 6G. In some aspects, the XaaS module may be an internal component of a RAN node in 6G.

[0207] In some aspects, different nodes (e.g., UE, DU, CU, XC unit, and PF unit) may provide or support different XaaS services to service clients (e.g., UE, third-party server). The XaaS capabilities of different nodes may be aligned and transmitted (e.g., via notification) to different nodes for interface management, mutual node selection, etc.

[0208] In some aspects, the XaaS module may provide privacy protection through encryption, and the CU may also provide security protection through encryption. According to one aspect, privacy protection and security protection may be aligned in terms of data encryption between the XaaS module and the CU.

[0209] To solve the above problems, a split RAN architecture as shown in Figure 4 is proposed. The XaaS module may be an internal component of the RAN, deployed together with the CU and the DU.

[0210] Figure 4Shows a split RAN architecture provided by one aspect. The RAN 400 may include a CU 404 and one or more DUs 406. The RAN may also include one or more XaaS modules 410 and 420. One or more XaaS modules 410 and 420 may be deployed below the CU 404 (e.g., between the CU 404 and the DU 406) and serve as internal components of the split RAN architecture. One or more XaaS modules may have the same or different responsibilities. One or more XaaS modules may be deployed according to a centralized or distributed implementation method.

[0211] In some aspects, the CU 404 may be a control plane and user plane anchor connected to the CN 408. Thus, one or more PF units and one or more XC units of one or more XaaS modules may be connected to the CN 408 through the CU 404.

[0212] The XaaS module 410 may include an XC unit 412 and one or more PF units 414. One PF unit may be connected to the XC unit 412 through the T3 interface 416, and the XC unit 412 may be connected to one or more PF units through the T3 interface 416. Different PF units 414 within the XaaS module 410 may be interconnected through the T4 interface 418.

[0213] According to one aspect, the CU 404 may be connected to the XC unit 412 through the T2-C 421 interface on the control plane to send and receive signaling and control messages, and connected to one or more PF units 414 through the T2-U interface 422 on the user plane to send and receive traffic. In some aspects, the T2-C 421 interface and the T2-U 422 interface may be integrated into the T2 interface (e.g., the T2 interface 423 between the CU404 and the XaaS module 420).

[0214] In some aspects, one or more DUs 406 may be connected to the XC unit 412 through the T1-C 425 interface on the control plane to send and receive signaling and control messages, and connected to one or more PF units 414 through the T1-U interface 426 on the user plane to send and receive traffic. In some aspects, the T1-C 425 interface and the T1-U 426 interface may be integrated into the T1 interface.

[0215] In some aspects, some DUs among one or more DUs 406 can be connected to CU 404, but may not be connected to one or more of the following: XC unit 412 or PF unit 414. In some aspects, PF units among one or more PF units 414 can be connected to one or more DUs under the same CU. In some aspects, intermediate PF units among one or more PF units 414 may not be directly connected to any CU.

[0216] According to one aspect, DUs among one or more DUs 4106 can be connected to one or more PF units 414 of the XaaS module, and can also be connected to an XC unit under the same CU. In some aspects, if multiple XaaS modules are deployed under the same CU, the DUs can be connected to one or more PF units of one or more XaaS modules and the XC units of each XaaS module in the XaaS modules.

[0217] In some aspects, each DU 406 can be connected to CU 404 through F1-C 429 (for control plane) interface and F1-U 430 (for user plane) interface. In some aspects, the traffic of F1-C 429 and F1-U 430 can be carried through T1 interface and T2 interface, where the F1 traffic can be encapsulated on the T1 interface and T2 interface, and the F1 interface can be physically withdrawn or separated. For example, the signaling and control messages of F1-C can be carried through T1-C 425 interface and T2-C 421 interface, and the traffic of F1-U can be carried through T1-U 426 interface and T2-U 422 interface.

[0218] In some aspects, one or more PF units in different XaaS modules can be interconnected through the T4 interface. In some aspects, XC units in different XaaS modules can be directly interconnected through the T5 interface. In some aspects, XC units in different XaaS modules can be indirectly interconnected through the CU or one or more CUs.

[0219] In some aspects, the T4 and T5 interfaces between different XaaS modules can be replaced by a unified T8 interface between different XaaS modules.

[0220] In some aspects, the XC unit and one or more PF units can be deployed as separate entities (for example, the XC unit and one or more PF units can be in separate nodes of the RAN) or within the same entity (for example, the XC unit and one or more PF units can be respectively deployed as the CP sub-layer and the UP sub-layer within the same XaaS module or RAN node).

[0221] In some aspects, one or more of the PF units and one or more of the XC units may be deployed between one or more DUs and the CU. In some aspects, one or more of the PF units and one or more of the XC units may be deployed closer to one or more DUs or closer to the CU.

[0222] The implementation of XC of the XaaS module and one or more PFs is not limited to the implementation shown, and other potential implementations are also possible. For example, some units may be integrated together into a unified entity. For example, the CU and the XC unit may be integrated together, the CU and one or more PF units may be integrated together, the DU and one or more PF units may be integrated together, or the XC unit and one or more PF units may be integrated in the DU or the CU. In the case where two or more units can be integrated together, the interface between the units may be based on the internal implementation.

[0223] According to one aspect, the data collected by the DU 406 may be aggregated at one or more XaaS modules to achieve "big data", so that there is no need to send data to the CU, thereby reducing the overhead and burden on the F1 interface. Therefore, a plug-and-play XaaS module can be enabled, and the units (CU and DU) for data forwarding and the units (PF units and XC units) for data processing can be joined together.

[0224] In addition, Figure 4 The split RAN architecture (e.g., RAN 400) can be backward compatible and have a small impact on the current connection-oriented RAN architecture for data forwarding services. For example, the XaaS module may not affect the F1 interface (between the CU and the DU) of the current connection-oriented RAN node. In addition, the protocols and specifications on the F1 interface may not need to be changed. In addition, the split architecture of RAN 400 can reduce or prevent frequent interruptions of XaaS service tasks and task context migrations, for example, when UE DU handover occurs.

[0225] In Figure 4 there may be different options available for deploying one or more PF units and XC units of the XaaS module, as Figure 5 and Figure 6 shown. Figure 5 Shows the deployment of the PF sublayer in the PF unit of the XaaS module provided by one aspect. Figure 6 Shows the deployment of the XC sublayer in the XC unit of the XaaS module provided by one aspect. In the context of the present invention, the XC sublayer may also refer to the XC protocol layer.

[0226] According to one aspect, referring to Figure 5, the PF unit 500 of the XaaS module may include an enhanced RAN protocol sublayer (i.e., PF sublayer 502) to perform XaaS tasks. The PF sublayer 502 at the PF unit 500 may be deployed above the PDCP sublayer 503. Correspondingly, on the user plane, at the UE 510, the PF sublayer 512 may be deployed between the SDAP sublayer 511 and the PDCP sublayer 513. According to one aspect, data processing may be performed at one or more of the following: the UE side on the PF sublayer 512 and the RAN side on the PF sublayer 502. Data processing may be performed using one or more of the following methods: data analysis, AI training, AI inference, data privacy protection, data purification, data processing, data management, data cleaning, data normalization, useless data filtering, data feature engineering, data compression, data embedding, data representation learning, and data feature extraction.

[0227] For example, the UE 510 may perform AI training at the PF sublayer 512 and send training data to the DU 520 via a wireless link. The DU 520 may send the training data to the PF unit 500 via the T1-U interface. The PF unit 500 may perform further data processing, such as AI training, at the PF sublayer 502 to obtain further training data (e.g., a trained model). Then, the PF unit 500 may feedback the further training data to the UE 510 via the T1-U interface and the wireless link.

[0228] According to one aspect, referring to Figure 6 , the XC unit 600 of the XaaS module may include an enhanced RAN protocol sublayer (i.e., XC sublayer 602) to control the execution of XaaS tasks. The XC unit 600 may be similar to the foregoing XC unit 412. The XC sublayer 602 may be deployed above the PDCP sublayer 603 at the XC unit 600. On the control plane, at the UE side 510, the XC sublayer 612 may be deployed above the PDCP sublayer 613.

[0229] In some aspects, one or more functions of the PDCP sublayer, including functions related to the XaaS bearer, may be pulled down from the CU to the PF unit 500 and / or the XC unit 600 of the XaaS module, so that the PF sublayer 502 and / or the XC sublayer 602 can parse data encrypted by the peer PDCP sublayer. For example, data may be encrypted by the PDCP sublayer of a node (e.g., UE or PF unit), and the PDCP sublayer of the peer node (e.g., PF unit or UE) may decrypt the encrypted data and then forward the decrypted data to the PF sublayer of the peer node (e.g., PF unit or UE) for further data processing, such as for data parsing.

[0230] In some aspects, for traditional connection-oriented SRBs or DRBs, the PDCP sublayer may be in the CU.

[0231] Figure 5 The protocol structures of interface T1-U 541 (which may be similar to interface T1-U 426) and interface T2-U 542 (which may be similar to interface T2-U 422) are further shown. In some aspects, the transport network layer (TNL) may be based on IP transport, including the User Datagram Protocol (UDP) and the GPRS User Plane Tunneling Protocol (GTP-U) sublayers above the Internet Protocol (IP) sublayer. According to one aspect, for the T1-U 541 interface, the PF unit 500 may further include a GTP-U sublayer 504, a UDP sublayer 505, and an IP sublayer 506, as Figure 5 shown. For the T2-U 542 interface, the PF unit 500 may further include a GTP-U sublayer 507, a UDP sublayer 508, and an IP sublayer 509, as shown in the figure. As described above, the T4 interface is dedicated to sending and receiving traffic between two PF units on the data plane, and the T6 interface is dedicated to sending and receiving traffic between the PF unit and the CNF on the data plane. The T7 interface is dedicated to sending and receiving signaling and control messages between the XC unit and the CNF on the control plane. The PF unit and the CNF may be connected through the T8-U interface to send and receive traffic on the data plane. The XC unit and the CNF may be connected through the T8-C interface to send and receive signaling and control messages on the control plane. That is, the T8-U interface is also called the T6 interface, and the T8-C interface is also called the T7 interface. Similar to T1-U and T2-U, the underlying protocol stacks on T4, T6, and T8 may but are not limited to Figure 5 the underlying protocol stacks in, for example, the underlying protocol stack may be one or more of the following: GPRS User Plane Tunneling Protocol (GTP-U), User Datagram Protocol (UDP), Internet Protocol (IP), Quick UDP Internet Connections (QUIC), Hypertext Transfer Protocol (HTTP), Stream Control Transmission Protocol (SCTP), and Segment Routing based on IPv6 (SRv6).

[0232] In some aspects, the TNL may be based on other protocols, for example, based on IP transport, including Quick UDP Internet Connections (QUIC) or Segment Routing based on IPv6 (SRv6) above IP. The underlying protocol stack may be but is not limited to Figure 5 the underlying protocol stacks in, for example, the underlying protocol stack may be one or more of the following: GPRS User Plane Tunneling Protocol (GTP-U), User Datagram Protocol (UDP), Internet Protocol (IP), Quick UDP Internet Connections (QUIC), Hypertext Transfer Protocol (HTTP), Stream Control Transmission Protocol (SCTP), and Segment Routing based on IPv6 (SRv6).

[0233] Thus, in some aspects, for the T1-U interface 541, the DU 520 (e.g., the DU of the UD 406) may include a corresponding GTP-U sublayer 524, UDP sublayer 525, and IP sublayer 526, as shown. Similarly, for the T2-U interface 542, the CU 530 (which may be similar to the CU 404) may include a corresponding GTP-U sublayer 537, UDP sublayer 538, and IP sublayer 539, as shown.

[0234] Figure 6 The protocol structures of the T1-C 641 interface (which may be similar to the T1-C 425 interface) and the T2-C 642 interface (which may be similar to the T2-C 421 interface) are further shown. In some aspects, the TNL may be based on IP transport, including the Stream Control Transmission Protocol (SCTP) over IP. In some aspects, the TNL may be based on other protocols, such as IP transport, including QUIC or SRv6 over IP. The application layer signaling protocols may be referred to as the T1 Application Protocol (T1AP) and the T2 Application Protocol (T2AP), respectively. Similar to T1AP and T2AP, the application layer signaling protocol on the T3 interface may be referred to as the T3 Application Protocol (T3AP), the application layer signaling protocol on the T5 interface may be referred to as the T5 Application Protocol (T5AP), the application layer signaling protocol on the T7 interface may be referred to as the T7 Application Protocol (T7AP), and the application layer signaling protocol on the T3 interface may be referred to as the T8 Application Protocol (T8AP). T1AP, T2AP, T3AP, T5AP, T7AP, and T8AP send or receive signaling and control messages on the corresponding interfaces. The underlying protocol stack may be but is not limited to Figure 6 the underlying protocol stack in, e.g., the underlying protocol stack may be one or more of the following: GPRS User Plane Tunneling Protocol (GTP-U), User Datagram Protocol (UDP), Internet Protocol (IP), Quick UDP Internet Connections (QUIC), Hypertext Transfer Protocol (HTTP), Stream Control Transmission Protocol (SCTP), and Segment Routing based on IPv6 (SRv6).

[0235] According to, in some aspects, referring to Figure 6 , for the T1-C 641 interface, the XC unit 600 may further include a T1AP sublayer 604, an SCTP sublayer 605, and an IP sublayer 606, as shown. For the T2-C 642 interface, the XC unit 600 may further include a T2AP sublayer 607, an SCTP sublayer 608, and an IP sublayer 609, as shown.

[0236] In some aspects, for the T1-C interface 641, the DU 520 may further include a corresponding T1AP sublayer 624, SCTP sublayer 625, and IP sublayer 626, as shown in the figure. Similarly, for the T2-C interface 642, the CU 530 may correspondingly include a T2AP sublayer 637, SCTP sublayer 638, and IP sublayer 639, as shown in the figure.

[0237] According to one aspect, one or more of the PF unit and XC unit of the XaaS module may be deployed together with the CU or DU for XaaS services. Therefore, one or more of the PF unit and XC unit may be integrated with the CU or DU.

[0238] For example, as an evolution of the 5G split RAN architecture, on the user plane, the SDAP, PF, and PDCP sublayers may be deployed in the CU, and the RLC, MAC sublayers, and PHY layer may be deployed in the DU, as Figure 7 shown. Figure 7 Shows the deployment of the PF unit at the CU provided by one aspect. The CU 730 may be integrated with one or more PF units. Therefore, the functions of the PF unit and the CU may be integrated. The CU may communicate with the DU 720 through the enhanced F1'-U 740 interface. The UE 710 may communicate with the DU 702 and CU 730 through a wireless link.

[0239] In some aspects, the PF sublayer 702 may be deployed in the CU 730 for XaaS bearer. The CU 730 may further include an SDAP sublayer 701 and a PDCP sublayer 703. Correspondingly, the UE 710 may include an SDAP sublayer 711, a PF sublayer 712, and a PDCP sublayer 713.

[0240] Figure 7 Further shows the protocol structure of the enhanced interface F1'-U 740 between the DU 720 and the CU 730. In some aspects, the TNL may be based on IP transmission, including UDP and GTP-U over IP. In some aspects, the TNL may be based on other protocols, such as IP transmission, including QUIC or SRv6 over IP. The underlying protocol stack may be but is not limited to Figure 7 the underlying protocol stack in, for example, the underlying protocol stack may be one or more of the following: GPRS User Plane Tunneling Protocol (GTP-U), User Datagram Protocol (UDP), Internet Protocol (IP), Quick UDP Internet Connections (QUIC), Hypertext Transfer Protocol (HTTP), Stream Control Transmission Protocol (SCTP), and Segment Routing based on IPv6 (SRv6).

[0241] According to one aspect, the DU 720 and the CU 730 can exchange data through an enhanced F1'-U interface 740 (an enhancement of the F1-U interface (e.g., F1-U 430)). For the F1'-U interface 740, the CU 730 can include a GTP-U sublayer 704, a UDP sublayer 705, and an IP sublayer 706. Correspondingly, for the F1'-U interface 740, the DU 720 can include a GTP-U sublayer 724, a UDP sublayer 725, and an IP sublayer 726.

[0242] Those skilled in the art can understand that the implementation of the PF unit in the RAN is not limited to the illustrated implementation, and other implementations are also possible. In some aspects, when the PF unit is integrated with the CU 730, the XaaS module may not be a flexible plug-and-play module, and the data collected by the DU may be aggregated to the CU together, which may increase the traffic burden on the F1'-U interface.

[0243] Figure 8 The deployment of the XC unit at the CU provided by one aspect is shown. The XC unit of the XaaS module can be deployed at the CU 830. Therefore, the functions of the XC unit and the CU can be integrated.

[0244] In one aspect, on the control plane, the XC sublayer 802 and the PDCP sublayer 803 can be deployed at the CU 830, and the RLC 814, the MAC sublayer 815, and the PHY layer 816 can be deployed in the DU 820. Correspondingly, the UE 810 can include an XC sublayer 812 above the PDCP sublayer 813.

[0245] The CU 830 and the DU 820 can communicate with each other through the F1'-C interface 841. The UE 810 can communicate with the DU 820 and the CU 830 through a wireless link.

[0246] Figure 8 The protocol structure of the enhanced interface F1'-C 841 between the DU 820 and the CU 830 is further shown. In some aspects, the TNL can be based on IP transmission, including SCTP over IP. In some aspects, the TNL can be based on other protocols, such as IP transmission, including QUIC or SRv6 over IP. In some aspects, the application layer signaling protocol can be called the F1' application protocol (F1'AP). The underlying protocol stack can be but is not limited to Figure 8The underlying protocol stack therein. For example, the underlying protocol stack may be one or more of the following: GPRS User Plane Tunneling Protocol (GTP-U), User Datagram Protocol (UDP), Internet Protocol (IP), Quick UDP Internet Connections (QUIC), Hypertext Transfer Protocol (HTTP), Stream Control Transmission Protocol (SCTP), and Segment Routing based on IPv6 (SRv6).

[0247] According to one aspect, for the control plane, the DU 820 and the CU 830 may exchange data messages through an enhanced F1'-C interface 841 (an enhancement of the F1-C interface (e.g., F1-C429)). For the F1'-C interface 841, the CU 830 may include an F1'AP sublayer 804, an SCTP sublayer 805, and an IP sublayer 806. Correspondingly, for the F1'-C interface 841, the DU 820 may include an F1'AP sublayer 824, an SCTP sublayer 825, and an IP sublayer 826.

[0248] According to one aspect, one or more nodes (e.g., UE, DU, CU, XC unit, and PF unit) may provide or support different XaaS services to service customers. In one aspect, each of the multiple nodes (e.g., UE, DU, CU, XC unit, and PF unit) may be aligned with and transmitted to other nodes in the multiple nodes through an interface management process based on the capabilities supported by the node.

[0249] Based on the capabilities supported by the nodes, the capabilities of different nodes in terms of XaaS services may be aligned and transmitted to different nodes for mutual node selection in one or more subsequent or later processes (e.g., UE initial access process and UE XaaS bearer establishment process for XaaS services).

[0250] According to one aspect, XaaS services (e.g., NET4AI service, DAM service) may be identified using XaaS IDs. In some aspects, one or more nodes may provide one or more XaaS services to the UE through different cells of different networks. Each network may be identified using a network identifier (ID), e.g., Public Land Mobile Network (PLMN) ID or Non-Public Network (NPN) ID. Cells in the network may be identified through cell IDs.

[0251] Figure 9Shows the XaaS ID 900 provided by one aspect. In some aspects, the XaaS ID 900 may include one or more of the following: service type ID 902, task ID 904, task set ID 906, and network ID 908. The service type ID 902 may identify the service type of the XaaS service (e.g., NET4AI service, DAM service). The task ID 904 may identify one or more tasks that the XaaS service can perform (e.g., the DAM service can perform data privacy protection tasks, data preprocessing tasks, data analysis tasks; the NET4AI service can perform AI model training tasks, AI inference tasks). The task set ID 906 may identify the tasks that the XaaS service can participate in. The network ID 908 may identify the network that provides the XaaS service. In some aspects, the task set may include one or more tasks.

[0252] Figure 10 Shows the process 1000 of XaaS capability alignment between two nodes provided by one aspect. The two nodes can align their XaaS capabilities with each other by sharing information about the XaaS services they support. Each of the two nodes can be one or more of the following: PF unit, XC unit, DU, and CU.

[0253] In some aspects, the process 1000 may include the first node 1 1020 sending a request message 1002 to the second node 2 1030. The request message may be an interface establishment or update request message. The request message may include one or more of the following: node 1 ID, cell ID, XaaS ID, and network ID (e.g., PLMN ID, NPN ID). In some aspects, the request message 1002 may indicate that the node 1 identified by the node 1 ID supports the XaaS service identified by the XaaS ID through the network identified by the network ID and the cell identified by the cell ID. In some aspects, the request message 1002 may include a list of one or more of the following: cell ID, XaaS ID, and network ID that the node 1 1020 can support.

[0254] In some aspects, if the first node 1 1020 (e.g., PF) is not configured with a cell, the cell ID may not be included in the request message 1002.

[0255] In some aspects, process 1000 may further include the second node 2 1030 sending a response message 1004 to the node 1 1020. The response message 1004 may be an interface establishment or update response message to notify the successful establishment or update of the interface. In some aspects, the response message 1004 may include one or more of the following: node 2 ID, cell ID, XaaS ID, and network ID (e.g., PLMN ID, NPN ID). In some aspects, the response message 1004 may indicate that the node 2 identified by the node 2 ID supports the XaaS service identified by the XaaS ID through the network identified by the network ID and the cell identified by the cell ID. The response message 1004 may include a list of one or more of the following: cell ID, XaaS ID, and network ID. One or more of the cell ID, XaaS ID, and network ID of the node 2 1030 included in the interface establishment or update response message may overlap (i.e., be similar) with the cell ID, XaaS ID, and network ID of the node 1 1020 included in the interface establishment or update request message 10002.

[0256] In some aspects, if the XaaS ID, cell ID, and network ID of the node 2 1030 indicated in the response message 1004 are different from the XaaS ID, cell ID, and network ID of the node 1 provided in the interface establishment or update request message 1002, the node 1 1020 may consider the difference and use the overlapping IDs (e.g., XaaS ID, cell ID, and network ID). For example, the node 1 1020 that knows the ID differences (e.g., XaaS ID, cell ID, and network ID) may then use or select the overlapping IDs, e.g., to perform UE access control and resource scheduling.

[0257] In some aspects, after receiving the interface establishment or update request message 1002, if the node 2 1030 determines that its capabilities do not overlap with those of the node 1 (e.g., does not support the XaaS service identified by the XaaS ID, cell ID, and network ID indicated in the request message 1002), the node 2 1030 may send an interface establishment failure message to notify the node 1 1020 of the failure to establish the interface.

[0258] The process 1000 related to the interface establishment or update process may align the XaaS service capabilities between the first node 1 1020 and the second node 2 1030. The process 1000 may help with mutual node selection in subsequent processes, e.g., in the UE initial access process and the UE XaaS bearer establishment process for the XaaS service, based on the supported capabilities.

[0259] Figure 11Process 1100 for notifying a UE of supported XaaS services provided by one aspect is shown. Process 1100 may involve the network notifying the UE of the supported XaaS services so that the UE can access the appropriate network for the XaaS services. Process 1100 may include a network node (e.g., DU) sending a message 1102 to UE 1120 indicating one or more supported XaaS services. In some aspects, message 1102 may be a unicast message (dedicated radio resource control (RRC) message, dedicated XaaS signaling message) or a multicast / broadcast message (e.g., system information block 1 (SIB1) or other system information (SI) messages such as other SIBs). In some aspects, message 1102 may include one or more of the following: cell ID, XaaS ID, and network ID (e.g., PLMN ID, NPN ID). In some aspects, message 1102 may indicate that the XaaS service identified by the XaaS ID is supported and can be accessed through the network identified by the network ID and the cell identified by the cell ID. In some aspects, message 1102 may also include a list of one or more of the following: cell ID, XaaS ID, and network ID. In some aspects, the included cell ID, XaaS ID, and network ID may be aligned among the DU, PF unit, XC unit, and CU according to the operations described in reference Figure 10 The operations described are aligned among the DU, PF unit, XC unit, and CU.

[0260] In some aspects, process 1100 may further include: after receiving message 1102, UE 1130 selects an appropriate cell and network to access the XaaS service. In some aspects, UE 1120 may report the selected XaaS ID and network ID for the XaaS request 1104 to the network 1130, for example, via an RRC establishment completion message. UE 1120 may send a request 1104 to the network 1130, and the request includes the selected XaaS ID and network ID. In some aspects, UE 1120 may select an appropriate cell and network to access the XaaS service based on locally pre-configured and stored information in UE 1120. For example, information about which XaaS services can be received through which network (e.g., allowed XaaS services and networks) may be locally pre-configured and stored in UE 1120, for example, as subscription information. In some aspects, for data processing and data forwarding, the UE side may also be configured with a UE routing selection policy (URSP) related to the XaaS ID.

[0261] Figure 12 The deployment of the PF unit provided by one aspect is shown. Figure 12 May be similar to Figure 5, however, one or more functions of the PDCP sublayer 1203, e.g., functions related to robust header compression (ROHC) 1204, may be performed at the CU 1230. Figure 12 Another deployment of the T1-U interface (between the DU 1220 and the PF unit 1200) and the T2-U interface (between the PF unit 1200 and the CU 1230) is also shown. In some aspects, the PF unit 1200 of the XaaS module may be deployed between the DU 1220 and the CU 1230 such that one or more functions of the PDCP sublayer (including functions related to the XaaS bearer) may be distributed, shared, or partitioned between the PF unit 1200 and the CU 1230.

[0262] According to one aspect, one or more functions of the PDCP sublayer may be performed at the CU 1230. For example, the CU 1200 may perform header (de)compression and / or sequence numbering of the PDCP SDU.

[0263] According to one aspect, one or more functions of the PDCP sublayer may be performed at the PF unit 1200. For example, the PF unit 1200 may perform security protection (for the XaaS bearer), e.g., integrity protection and encryption. In some aspects, for each XaaS bearer, the integrity protection function and the encryption function may be configurable.

[0264] In some aspects, the distribution of the PDCP function between the PF unit 1200 and the CU 1230 may be transparent to the UE 1210 and thus does not affect the UE 1210.

[0265] Similar to Figure 5 、 Figure 12 , at the PF unit 1200, the PF sublayer 1203 may be deployed above the PDCP sublayer 1203. Correspondingly, at the UE 1210, the PF sublayer 512 may be deployed between the SDAP sublayer 1211 and the PDCP sublayer 1213.

[0266] Figure 13 It shows that multiple PF units provided by one aspect participate in providing XaaS services to the UE 1310. As Figure 13 shown, multiple PF units (e.g., PF 1304, 1306, 1308) may be involved in providing XaaS services to the UE 1310. In some aspects, data processing routines (e.g., XaaS sessions) may pass through the UE 1310, DU 1320, PF units 1304 and 1308, CU 1330, and CN 1340 sequentially or in parallel. According to one aspect, the XaaS traffic path may include multiple PFs (PF 1304 and PF 1308) within the RAN 1300.

[0267] Figure 14 Shows the deployment of multiple PF units provided by one aspect. Figure 14 Also shows the protocol structure for the T1-U 1441 interface, T4 1443 interface, and T2-U 1442 interface when multiple PF units (PF unit 1400 and PF unit 1450) may be involved.

[0268] In some aspects, PF unit 1 1400 and PF unit 2 1450 can be deployed between DU 1220 and CU 1430. PF unit 1 1400 can include a PF sublayer 1402 corresponding to the PF sublayer 1412 of UE 1410. PF unit 1 1400 can also include a PF sublayer 1452 corresponding to the PF sublayer 1462 of PF unit 2 1460. PF unit 1 1400 can also include a PDCP sublayer 1403 corresponding to the PDCP sublayer 1413 of UE1410. In some aspects, PF unit 1 1400 can also include a PDCP sublayer 1453 corresponding to the PDCP sublayer 1463 of PF unit 2 1460.

[0269] PF unit 1 1400 can be connected to DU 1220 through the T1-U 1441 interface. In some aspects, PF unit 11400 can have a protocol structure for the T1-U 1441 interface, including a GTP-U sublayer 1404, a UDP sublayer 1405, and an IP sublayer 1406. DU 1220 can have a corresponding protocol structure for the T1-U 1441 interface, including a GTP-U sublayer 1424, a UDP sublayer 1425, and an IP sublayer 1426. The underlying protocol stack of the T1-U interface 1441 can be but is not limited to Figure 14 the underlying protocol stack in, for example, the underlying protocol stack can be one or more of the following: General Packet Radio Service (GPRS) User Plane Tunneling Protocol (GTP-U), User Datagram Protocol (UDP), Internet Protocol (IP), Quick UDP Internet Connections (QUIC), Hypertext Transfer Protocol (HTTP), Stream Control Transmission Protocol (SCTP), and Segment Routing based on IPv6 (SRv6).

[0270] In some aspects, PF unit 1 1400 can be connected to PF unit 2 1460 through the T4 1443 interface. PF unit 11400 can have a protocol structure for the T4 1443 interface, including a GTP-U sublayer 1454, a UDP sublayer 1455, and an IP sublayer 1456. In some aspects, PF unit 2 1460 can have a corresponding protocol structure for the T4 1443 interface, including a GTP-U sublayer 1464, a UDP sublayer 1465, and an IP sublayer 1466. The underlying protocol stack of the T4 interface 1443 can be but is not limited toFigure 14 The underlying protocol stack in, for example, the underlying protocol stack can be one or more of the following: GPRS User Plane Tunneling Protocol (GTP-U), User Datagram Protocol (UDP), Internet Protocol (IP), Quick UDP Internet Connections (QUIC), Hypertext Transfer Protocol (HTTP), Stream Control Transmission Protocol (SCTP), and Segment Routing based on IPv6 (SRv6).

[0271] In some aspects, the PF unit 2 1460 can have a protocol structure for the T2-U 1442 interface, including a GTP-U sublayer 1467, a UDP sublayer 1468, and an IP sublayer 1469. In some aspects, the CU 140 can have a corresponding protocol structure for the T2-U 1442 interface, including a GTP-U sublayer 1537, a UDP sublayer 1538, and an IP sublayer 1539. The underlying protocol stack of the T2-U interface 1442 can be but is not limited to Figure 14 The underlying protocol stack in, for example, the underlying protocol stack can be one or more of the following: GPRS User Plane Tunneling Protocol (GTP-U), User Datagram Protocol (UDP), Internet Protocol (IP), Quick UDP Internet Connections (QUIC), Hypertext Transfer Protocol (HTTP), Stream Control Transmission Protocol (SCTP), and Segment Routing based on IPv6 (SRv6).

[0272] According to one aspect, the TNL can be based on IP transport, including UDP and GTP-U layers over IP, as shown. In some aspects, the TNL can be based on other protocols, such as IP transport, including QUIC or SRv6 over IP.

[0273] In some aspects, for example, when an XaaS bearer or an XaaS session is being established, the involved nodes (e.g., PF units 1400 and 1460, DU 1220, CU 1430, and UE 1410) can be configured by the control plane (e.g., by the XC unit, CU function, or CN function), and the tunnels between the involved nodes (e.g., GTP-U tunnels, QUIC connections, SRv6 connections) can be configured by the control plane (e.g., XC unit, CU function, or CN function). In some aspects, the XaaS bearer and / or XaaS session can pass through one or more in-RAN nodes and inter-RAN nodes, and these nodes can cooperate to process XaaS data sequentially or in parallel.

[0274] In some aspects, the involved PF units 1400 and 1460 can be dynamically selected, and the data processing routines can be dynamically determined based on routing information included in, for example, the PF packet header. The routing schemes (e.g., SRv6) and algorithms included in the routing information can vary, as can be understood by those skilled in the art. For example, one PF unit can determine the next hop to another PF unit based on the routing information included in the received PF packet header.

[0275] In some aspects, both the PDCP sublayer and the PF sublayer can be deployed in one or more PF units of the XaaS module, as Figure 5 , Figure 12 and Figure 14 shown. In some aspects, the PF sublayer can perform privacy protection using encryption. In some aspects, the PDCP sublayer can perform security protection using encryption. In some aspects, data encryption (for privacy protection) may already be performed in the PF sublayer for XaaS data. For example, data can be encrypted by the PF sublayer using homomorphic encryption in FL learning (i.e., NET4AI service). In some aspects, if the security level requirements have been met through a homomorphic encryption scheme, the PDCP layer may not need to perform further security protection (e.g., the traditional 5G AS encryption scheme). According to one aspect, the security mode (referring to security protection and privacy protection) can be aligned and negotiated between the PF sublayer and the PDCP sublayer. According to one aspect, the security mode can indicate not to perform protection (which can be security protection and privacy protection depending on the situation) operations at the PDCP sublayer and the PF sublayer, or to perform protection operations at one or more of the PDCP sublayer and the PF sublayer.

[0276] The security mode can indicate the security protection and privacy protection that may be required. In some aspects, the security mode can indicate privacy protection for data processing. In some aspects, the security mode can indicate security protection for data forwarding. In some aspects, the security mode can indicate privacy protection for data processing and security protection for data forwarding. In some aspects, the security mode can indicate that for XaaS, no privacy protection needs to be performed for data processing, nor security protection for data forwarding. In some aspects, the security mode can indicate the algorithms based on which the security protection and / or privacy protection that can be performed.

[0277] In some aspects, the AS security mode may indicate the security protection and privacy protection that may be required on the UP and / or CP. In some aspects, the AS security mode may indicate that the PDCP sublayer (e.g., for encryption and integrity) should perform security protection for XaaS on the UP. In some aspects, the AS security mode may indicate that the PF sublayer should perform privacy protection for XaaS on the UP. In some aspects, the AS security mode may indicate that the PDCP sublayer should perform security protection for XaaS on the UP, and the PF sublayer should perform privacy protection for XaaS on the UP. In some aspects, the AS security mode may indicate that the PDCP sublayer and the PF sublayer should not perform security protection or privacy protection for XaaS on the UP.

[0278] In some aspects, the AS security mode may indicate that the PDCP sublayer (e.g., for encryption and integrity) should perform security protection for XaaS on the CP. In some aspects, the AS security mode may indicate that the XC sublayer (e.g., for privacy protection) should perform privacy protection for XaaS on the CP. In some aspects, the AS security mode may indicate that the PDCP sublayer should perform security protection for XaaS on the CP, and the XC sublayer should perform privacy protection for XaaS on the CP. In some aspects, the AS security mode may indicate that the PDCP sublayer and the XC sublayer should not perform security protection or privacy protection for XaaS on the CP.

[0279] In some aspects, the AS security mode may further indicate one or more algorithms based on which the AS security protection and / or AS privacy protection may be performed. One or more security algorithms include, for example, encryption algorithms and integrity algorithms on the PDCP sublayer, privacy protection algorithms on the PF sublayer, and privacy protection algorithms on the XC sublayer. For example, the AS security mode may indicate that the PDCP sublayer should perform security protection for XaaS UP and the PF sublayer should perform privacy protection for XaaS UP. The AS security mode may further indicate a first algorithm for performing encryption and integrity protection and a second algorithm for performing privacy protection. According to the AS security mode, the PDCP sublayer may perform encryption and integrity protection according to the first algorithm, and the PF sublayer may perform privacy protection according to the second algorithm.

[0280] The non-access stratum (NAS) security mode may indicate what kind of security protection and / or privacy protection is required for XaaS NAS traffic for data forwarding and / or data processing. In some aspects, the NAS security mode may indicate that security protection should be performed on the data forwarding of XaaS NAS traffic (e.g., NAS signaling and / or NAS UP traffic). In some aspects, the NAS security mode may indicate that security protection should be performed on the data processing of XaaS NAS traffic. In some aspects, the NAS security mode may indicate that security protection is performed on the data forwarding of XaaS NAS traffic and security protection is performed on the data processing of XaaS NAS traffic. In some aspects, the NAS security mode may indicate that no security protection is performed on the data forwarding of XaaS NAS traffic nor on the data processing of XaaS NAS traffic.

[0281] In some aspects, the NAS security mode may also indicate one or more security algorithms based on which NAS security protection and / or privacy protection can be performed. In some aspects, the one or more algorithms may include, for example, encryption algorithms and integrity algorithms for NAS signaling and / or NAS UP traffic, and privacy protection algorithms for NAS signaling and / or NAS UP traffic.

[0282] In some aspects, one or more supported AS security modes may be pre-configured at one or more of the following: the UE or a network node (e.g., a CN node, a RAN node (e.g., a PF unit, an XC unit, a CU)). According to one aspect, for example, when XaaS is established, a suitable AS security mode may be selected or determined by the UE or the network from a list of supported AS security modes.

[0283] Figure 15 An example table of supported AS security modes provided by one aspect is shown. In some aspects, Table 1500 may be pre-configured at the node. The supported AS security modes may include a first list of supported security modes, e.g., for a first XaaS QoS requirement for XaaS. The first list of supported security modes may include a first mode, i.e., Mode 1, to indicate that security protection (e.g., encryption and integrity protection in the PDCP sublayer) should be performed on the data forwarding according to, for example, Algorithm 1.1. The first mode may also indicate that privacy protection (e.g., privacy protection in the PF sublayer) should be performed on the data processing according to, for example, Algorithm 1.2.

[0284] In some aspects, the first list of supported security modes may also include a second mode, i.e., Mode 2, to indicate that security protection for data forwarding (e.g., encryption and integrity protection in the PDCP sublayer) is required according to, for example, Algorithm 2.1. The second mode in the first list of supported security modes may also indicate that privacy protection for data processing (e.g., privacy protection in the PF sublayer) is required according to, for example, Algorithm 2.2. The first list of supported security modes may also include other security modes understandable to those skilled in the art.

[0285] The supported AS security modes may also include a second list of supported security modes, e.g., for a second XaaS QoS requirement for XaaS. The second list of supported security modes may include a third mode, i.e., Mode 3, to indicate that security protection for data forwarding (e.g., encryption and integrity protection in the PDCP sublayer) is required according to, for example, Algorithm 3.1. In some aspects, the third mode may not require privacy protection for data processing (e.g., privacy protection in the PF sublayer).

[0286] In some aspects, the second list of supported security modes may also include a fourth mode, i.e., Mode 4, to indicate the need for security protection for data forwarding (e.g., encryption and integrity protection in the PDCP sublayer) according to Algorithm 4.1. In some aspects, the fourth mode may not require privacy protection for data processing (e.g., privacy protection in the PF sublayer). The second list of supported security modes may also include other security modes understandable to those skilled in the art.

[0287] The supported AS security modes may also include a third list of supported security modes, e.g., for a third XaaS QoS requirement for XaaS. The third list of supported security modes may include a fifth mode, i.e., Mode 5, to indicate that privacy protection for data processing (e.g., privacy protection in the PF sublayer) is required according to, for example, Algorithm 5. The fifth mode may not require security protection for data forwarding (e.g., encryption and integrity protection in the PDCP sublayer).

[0288] The supported AS security modes may also include a fourth list of supported security modes, e.g., for a fourth XaaS QoS requirement for XaaS. The fourth list of supported security modes may include a sixth mode, i.e., Mode 6, to indicate that neither security protection for data forwarding nor privacy protection for data processing is required. Thus, the sixth mode may indicate that security protection for data forwarding (e.g., encryption and integrity protection in the PDCP sublayer) or privacy protection for data processing (e.g., privacy protection in the PF sublayer) may not be required.

[0289] In some aspects, a mode priority can be included or assigned for each mode in the AS security mode in Table 1500.

[0290] In some aspects, two or more nodes (e.g., UE, PF unit, XC unit, CU, and CN) can transmit and align their supported AS security modes, for example, before establishing XaaS. In some aspects, one or more nodes involved in XaaS can be preconfigured with the supported AS security modes to improve the alignment and negotiation process for determining or selecting an AS security mode, for example, when establishing an XaaS service. In some aspects, different security modes may have different usage priorities.

[0291] According to one aspect, for each supported AS security mode, one or more supported NAS security protections can be preconfigured for two or more nodes (e.g., UE and CN PF unit) for data forwarding and data processing of XaaS NAS traffic (e.g., NAS signaling and / or NAS UP traffic) involving two or more nodes.

[0292] According to one aspect, for example, for a first XaaS QoS requirement of XaaS, a first list of supported security modes can include a first mode, i.e., Mode 1. The first mode can indicate that security protection (e.g., one or more of encryption and integrity protection) is required for data forwarding of XaaS NAS traffic (e.g., one or more of NAS signaling and NAS UP traffic) between, for example, a UE and a CN according to, for example, Algorithm 1.3. In some aspects, the first mode can also indicate that security protection (e.g., privacy protection) is required for data processing of XaaS NAS traffic (e.g., one or more of NAS signaling and NAS UP traffic) between, for example, a UE and a CN according to, for example, Algorithm 1.4.

[0293] According to one aspect, for example, for a first XaaS QoS requirement of XaaS, a first list of supported security modes can include a second mode, i.e., Mode 2. The second mode can indicate that security protection (e.g., privacy protection) is required for data processing of XaaS NAS traffic (e.g., one or more of NAS signaling and NAS UP traffic) between, for example, a UE and a CN according to, for example, Algorithm 2.4. In some aspects, the second mode may not indicate or require the need for security protection (e.g., encryption or integrity protection) for data forwarding of XaaS NAS traffic (e.g., NAS signaling or NAS UP traffic) between, for example, a UE and a CN.

[0294] As can be understood by those skilled in the art, the first list of supported security modes may also include other modes for securing data forwarding and data processing. In some aspects, a priority for the NAS security mode may be included or assigned for each mode of the NAS security mode.

[0295] One or more security modes may be pre-configured at the UE and the network (e.g., CN, RAN (including XC, PF, XU, DU)), and based on the pre-configured security modes, the UE and the network may perform security mode alignment and selection. Thus, security protection and / or privacy protection may be provided for data forwarding and data processing in one or more of XaaS XSB, XDB, and XaaS NAS traffic.

[0296] Figure 16 A process of joint security configuration based on pre-configured security modes provided by one aspect is shown. Process 1600 may provide selection of AS security mode and NAS security mode based on pre-configured security modes.

[0297] In some aspects, process 1600 may be used for joint PDCP sub-layer and PF sub-layer security configuration based on pre-configured security modes.

[0298] According to one aspect, process 1600 may include pre-configuring (1602) one or more network nodes (UE 1630, CN 1650, RAN 1640 (including XC unit, PF unit, CU, DU)) using supported security modes (e.g., supported AS security mode, supported NAS security mode) by, for example, subscription or network management process. For example, the UE may be pre-configured by subscription, and RAN nodes or core network functions may be pre-configured by network management process.

[0299] In some aspects, the supported security modes may indicate that privacy protection should be performed for data processing. In some aspects, the supported security modes may indicate that security protection should be performed for data forwarding. In some aspects, the supported security modes may indicate that privacy protection should be performed for data processing and security protection should be performed for data forwarding. In some aspects, the supported security modes may indicate that security protection and privacy protection should not be performed for data processing and data forwarding.

[0300] In some aspects, the supported security modes may indicate one or more algorithms based on which security protection and / or privacy protection will be performed.

[0301] In some aspects, process 1600 may further include the UE 1630 reporting to the CN 1650 its supported security modes (e.g., supported AS security mode ID, supported NAS security mode ID) 1604. The supported AS security mode and the supported NAS security mode may be identified by the AS security mode ID and the NAS security mode ID, respectively.

[0302] In some aspects, process 1600 may further include the CN 1650 performing (1606) NAS security mode selection. The selected NAS security mode may have an overlapping or common security mode (i.e., supported by the UE 1630 and the CN 1650). In some aspects, the selection may be based on one or more of the following: the security mode priority and the XaaS QoS requirements sent by the UE 1630 to the CN 1650 before performing (1606) NAS selection. According to one aspect, the CN 1650 may also generate one or more NAS security parameters (e.g., NAS security key) for one or more security algorithms of the selected security mode. In some aspects, one or more security keys may refer to one or more of the following: the key for the privacy protection algorithm for privacy protection and the key for the security protection algorithm for security protection.

[0303] According to one aspect, process 1600 may further include the CN 1650 sending NAS security configuration to the UE, for example, via the NAS security mode command message 1608. In some aspects, the message 1608 may include one or more of the following: the ID of the selected NAS security mode and the NAS security parameters.

[0304] In some aspects, process 1600 may further include the CN 1650 performing (1610) XaaS NAS traffic security protection. According to one aspect, the CN 1650 may start to perform one or more of the following: (upward) downward XaaS NAS traffic encryption (decryption) for data forwarding and privacy protection calculation for data processing based on the selected NAS security mode.

[0305] In some aspects, process 1600 may further include the UE 1630 performing (1612) XaaS NAS traffic security protection. According to one aspect, the UE 1630 may start to perform one or more of the following: (downward) upward XaaS NAS traffic encryption (decryption) for data forwarding and privacy protection calculation for data processing based on the selected NAS security mode.

[0306] In some aspects, process 1600 may further include the CN 1650 generating (1614) CN-assisted security information. In some aspects, the CN-assisted security information may include one or more of the following: CN-assisted information about the AS security mode and CN-assisted security parameters.

[0307] According to one aspect, the CN-assisted information about the AS security mode may help the RAN 1640 (e.g., CU and XC units) to further determine the AS security mode. For example, the RAN 1640 may select the AS security mode based on or in association with the NAS security mode selected by the NAS. In some aspects, the selected AS security mode may be supported by both the RAN 1640 and the UE 1630.

[0308] The assisted security parameters may be used by the RAN (e.g., CU and XC units) to derive the AS security parameters (e.g., AS security keys) of the PF unit, including the PF sublayer and the PDCP sublayer. The CN-assisted security parameters may include one or more of the following: the security key Kx, which is used by the AS to derive the AS security parameters of the PF sublayer (referred to as the PF sublayer-related security key), and the security key Kc, which is used by the AS to derive the AS security parameters of the PDCP sublayer (referred to as the PDCP sublayer-related security key). In some aspects, Kx and Kc may be the same or different. As described herein, one or more security keys may refer to one or more of the following: keys for privacy protection algorithms for privacy protection and keys for security protection algorithms for security protection.

[0309] In some aspects, process 1600 may further include the CN 1650 sending to the RAN 1640 one or more of the following, e.g., via an initial UE context setup request or an XaaS PDU session setup request message 1616: the previously received AS-supported security mode of the UE (e.g., UE-supported security mode 1604) and the CN-assisted security information.

[0310] In some aspects, process 1600 may further include the RAN 1640 performing (1618) AS security mode selection. The selected AS security mode may be an overlapping security mode supported by the UE and the RAN. The selection may be based on one or more of the following: security mode priority, CN-assisted security information, and one or more XaaS QoS requirements sent by the UE or the CN to the RAN (e.g., one or more XaaS QoS requirements received by the RAN before the RAN performs (1618) AS security mode selection). In some aspects, the RAN 1640 may also perform AS security parameter derivation (e.g., AS security keys) for one or more security algorithms of the selected security mode. In some aspects, one or more security keys may refer to one or more of the following: keys for privacy protection algorithms for privacy protection and keys for security protection algorithms for security protection.

[0311] In some aspects, process 1600 may further include the RAN 1640 sending an AS security configuration to the UE 1630, e.g., via an AS security mode command message 1620. In some aspects, message 1620 may include one or more of the following: the selected AS security mode ID and AS security parameters.

[0312] In some aspects, process 1600 may further include the RAN 1640 performing (1622) one or more of the following: based on the selected AS security mode, performing (uplink) downlink encryption (decryption) on the PDCP sublayer and / or the PF sublayer of the XDB on XaaS UP. In some aspects, the RAN 1640 may perform one or more of the following: based on the selected AS security mode, performing (uplink) downlink encryption (decryption) on the PDCP sublayer and / or the XC sublayer of the XSB on XaaS CP.

[0313] In some aspects, process 1600 may further include the UE performing (1624) XaaS AS UP traffic security protection. According to one aspect, the UE 1630 may perform one or more of the following: based on the selected AS security mode, performing (downlink) uplink encryption (decryption) on the PDCP sublayer of the XDB on XaaS UP, performing privacy protection calculations on the PF sublayer, or performing encryption (decryption) on the PDCP sublayer and performing privacy protection calculations on the PF sublayer.

[0314] According to one aspect, the UE 1630 may perform XaaS AS signaling security protection. The UE 1630 may perform one or more of the following: perform (downlink) uplink encryption (decryption) on the PDCP sublayer of the XSB on the XaaS CP, perform privacy protection calculations on the XC sublayer, or perform encryption (decryption) on the PDCP sublayer and perform privacy protection calculations on the XC sublayer, based on a selected AS security mode.

[0315] In some aspects, when sending or receiving a security mode command message, security protection for one or more of NAS traffic, XDB, and XSB may not start immediately at one or more of the CN, RAN, and UE. In some aspects, for example, security protection may be activated after the RAN and CN send an activation indication to the UE for one or more of NAS traffic, XDB, and XSB.

[0316] In some aspects, when one or more nodes (e.g., UE, CN, and RAN) are preconfigured with supported security modes, the supported security algorithms for XaaS data processing and the supported security algorithms for XaaS data forwarding may be naturally mapped and bound together.

[0317] According to one aspect, security mode selection may be performed according to another method or process, where the supported privacy algorithms for XaaS data processing and the supported security algorithms for XaaS data forwarding may be preconfigured separately. In some aspects, the supported privacy algorithms for XaaS data processing and the supported security algorithms for XaaS data forwarding may be preconfigured as independent security capabilities.

[0318] In some aspects, the UE may be configured, for example, through UE subscription with one or more lists of supported security capabilities (e.g., security algorithms and / or privacy algorithms), which may be used for data processing and data forwarding. In some aspects, the one or more lists may include separate or different lists of supported security capabilities corresponding to each of data processing and data forwarding. In some aspects, the one or more lists may be sorted according to priorities determined by the operator.

[0319] In some aspects, one or more network nodes (CN, RAN (including XC unit, PF unit, CU, and DU)) may also be configured, for example, through network management with one or more lists of supported security capabilities (e.g., security algorithms and / or privacy algorithms), which may be used for data processing and data forwarding. In some aspects, the one or more lists may include a first set of lists of supported security capabilities for data processing and a second set of lists for data forwarding. In some aspects, the one or more lists may be sorted according to priorities determined by the operator.

[0320] According to one aspect, the security capabilities supported by the UE may include security capabilities supported in data processing for XaaS (e.g., supported privacy protection algorithms that may be used for one or more of the following: PF sublayer and XaaS NAS traffic (e.g., NAS signaling and / or NAS UP traffic) between the UE and the CN). The security capabilities supported by the UE may also include security capabilities supported by the UE in data forwarding for XaaS (e.g., supported encryption algorithms and integrity protection algorithms), which may be used for one or more of the following: PDCP sublayer and XaaS NAS traffic (e.g., NAS signaling and / or NAS UP traffic) between the UE and the CN. The security capabilities supported by the UE may also include the priorities of different algorithms that can be used for data processing and data forwarding.

[0321] According to one aspect, based on preconfigured security capabilities, the UE 1730 and the network (e.g., CN 1750, RAN 1740 (including XC unit, PF unit, CU, DU)) may perform security capability alignment and security mode selection. The UE and the network may also perform security protection for data forwarding and data processing of XaaS XSB, XDB, or XaaS NAS traffic.

[0322] As Figure 17 shown, according to one aspect, the AS security mode and NAS security mode selection may be determined based on preconfigured security capabilities.

[0323] Figure 17 A process of joint security configuration based on preconfigured security capabilities provided by one aspect is shown. Process 1600 may provide joint PDCP sublayer and PF sublayer security configuration.

[0324] According to one aspect, process 1700 may include preconfiguring (1702), e.g., via a subscription or network management process, one or more network nodes (UE 1730, CN 1750, RAN 1740 (including XC unit, PF unit, CU, DU)). One or more network nodes may be preconfigured with one or more lists of supported security capabilities (i.e., supported security algorithms and / or privacy algorithms, each security algorithm may be identified by a security algorithm ID, and each privacy algorithm may be identified by a privacy algorithm ID), which may be used for data processing and data forwarding. In some aspects, one or more lists may include a separate first set of lists for data processing and a separate second set of lists for data forwarding. One or more lists may be sorted according to priorities determined by the operator.

[0325] According to one aspect, procedure 1700 may further include the UE 1730 sending or reporting its supported security capabilities 1704 to the CN 1750.

[0326] In some aspects, procedure 1700 may further include the CN 1750 performing (1706) NAS security mode selection. The selected NAS security mode may include one or more of the following: overlapping privacy algorithms supported by the UE and the CN for data processing, security algorithms supported by the UE and the CN for data forwarding. In some aspects, the selection may be based on one or more of the following: the priority of the algorithms, and the XaaS QoS requirements sent by the UE to the CN, for example, before the CN selects the NAS security mode. In some aspects, the CN 1750 may generate one or more NAS security parameters (e.g., NAS security keys) for one or more algorithms of the selected security mode. In some aspects, one or more security keys may refer to one or more of the following: privacy protection algorithm keys for privacy protection, security protection algorithm keys for security protection.

[0327] In some aspects, if the selected NAS security mode indicates that no privacy protection for data processing or security protection for data forwarding is required, the corresponding algorithms may not be included.

[0328] In some aspects, procedure 1700 may further include the CN 1750 sending NAS security configuration to the UE, for example, via the NAS security mode command message 1708. The message 1708 may include one or more selected privacy algorithms and / or security algorithms for one or more of data processing and data forwarding. In some aspects, each selected security algorithm may be identified by a security algorithm ID, and each selected privacy algorithm may be identified by a privacy algorithm ID. In some aspects, one or more NAS security parameters may also be included in the message 1708.

[0329] In some aspects, procedure 1700 may further include the CN performing (1710) XaaS NAS traffic security protection. According to one aspect, the CN 1750 may perform one or more of the following: (upward) downward XaaS NAS traffic encryption (decryption) for data forwarding, privacy protection calculation for data processing, based on the selected NAS security and / or privacy algorithms.

[0330] In some aspects, procedure 1700 may further include the UE performing (1712) XaaS NAS traffic security protection. According to one aspect, the UE 1730 may perform one or more of the following: (downward) upward XaaS NAS traffic encryption (decryption) for data forwarding, privacy protection calculation for data processing, based on the selected NAS security and / or privacy algorithms.

[0331] In some aspects, process 1700 may further include CN 1750 generating (1714) CN - assisted security information. In some aspects, the CN - assisted security information may include one or more of the following: CN - assisted information about the AS security mode and CN - assisted security parameters.

[0332] According to one aspect, the CN - assisted information about the AS security mode may help the RAN (e.g., CU and XC units) further determine the AS security mode. The assisted security parameters may be used by the RAN (e.g., CU and XC units) to derive the AS security parameters (e.g., AS security keys) of the PF unit, including the PF sub - layer and the PDCP sub - layer. The CN - assisted security parameters may include one or more of the following: the security key Kx, which is used by the AS to derive the AS security parameters of the PF sub - layer (referred to as the PF sub - layer - related security key), and the security key Kc, which is used by the AS to derive the AS security parameters of the PDCP sub - layer (referred to as the PDCP sub - layer - related security key). In some aspects, Kx and Kc may be the same or different. In some aspects, one or more security keys may refer to one or more of the following: the key of the privacy protection algorithm for privacy protection and the key of the security protection algorithm for security protection.

[0333] In some aspects, process 1700 may further include CN 1750 sending, for example, via an initial UE context setup request or an XaaS PDU session setup request message 1716 to the RAN 1740, one or more of the following: the previously received UE - supported security capabilities 1704 and the CN - assisted security information.

[0334] In some aspects, process 1700 may further include the RAN 1740 performing (1718) AS security mode selection. The selected AS security mode may include one or more of the following: overlapping privacy algorithms supported by the UE and the CN in data processing, and overlapping security algorithms supported by the UE and the CN in data forwarding. In some aspects, the selection may be based on one or more of the following: algorithm priority and the XaaS QoS requirements sent by the UE to the CN (e.g., one or more XaaS QoS requirements received by the RAN before the RAN performs (1718) AS security mode selection). In some aspects, the RAN 1740 may also perform AS security parameter derivation (e.g., AS security keys) for one or more security and / or privacy algorithms of the selected security mode. In some aspects, one or more security keys may refer to one or more of the following: the key of the privacy protection algorithm for privacy protection and the key of the security protection algorithm for security protection.

[0335] In some aspects, if the selected NAS security mode indicates that privacy protection for data processing or security protection for data forwarding is not required, the corresponding algorithms may not be included.

[0336] In some aspects, process 1700 may further include the RAN 1740 sending an AS security configuration to the UE, for example, via the AS security mode command message 1720. The message 1720 may include one or more of the following: the selected AS security algorithms for data processing and data forwarding. In some aspects, each selected AS security algorithm may be identified by a security algorithm ID. In some aspects, the AS security parameters may also be included in the message 1720.

[0337] In some aspects, process 1700 may further include the RAN performing (1722) XaaS AS UP traffic security protection. According to one aspect, the RAN 1740 may perform one or more of the following: (upward) downward encryption (decryption) on the PDCP sublayer of the XDB on XaaS UP, privacy protection calculation on the PF sublayer, or encryption (decryption) on the PDCP sublayer and privacy protection calculation on the PF sublayer, based on the selected AS security mode and / or privacy algorithm.

[0338] In some aspects, the RAN 1740 may perform XaaS AS signaling security protection. The RAN 1740 may perform one or more of the following: (upward) downward encryption (decryption) on the PDCP sublayer of the XSB on XaaS CP, privacy protection calculation on the XC sublayer, or encryption (decryption) on the PDCP sublayer and privacy protection calculation on the XC sublayer, based on the selected AS security mode and / or privacy algorithm.

[0339] In some aspects, process 1700 may further include the UE performing (1724) XaaS AS UP traffic security protection. According to one aspect, the UE 1730 may perform one or more of the following: (downward) upward encryption (decryption) on the PDCP sublayer of the XDB on XaaS UP, privacy protection calculation on the PF sublayer, or encryption (decryption) on the PDCP sublayer and privacy protection calculation on the PF sublayer, based on the selected AS security and / or privacy algorithm.

[0340] In some aspects, the UE 1730 may also perform signaling security protection for XaaS AS. The UE 1730 may perform one or more of the following: perform (downlink) uplink encryption (decryption) on the PDCP sublayer of the XSB on the XaaS CP, perform privacy protection calculations on the XC sublayer, or perform encryption (decryption) on the PDCP sublayer and perform privacy protection calculations on the XC sublayer, based on selected AS security and / or privacy algorithms.

[0341] In some aspects, when sending or receiving a security mode command message, the security protection for one or more of NAS traffic, XDB, and XSB may not start immediately at one or more of the CN, RAN, and UE. In some aspects, for example, after the RAN and CN send an activation indication to the UE for one or more of NAS traffic, XDB, and XSB, the security protection may be activated.

[0342] Some aspects of the present invention may provide interface management for a split RAN architecture. Some aspects of the present invention may provide the establishment of one or more of the following: XaaS sessions and XaaS bearers. Some aspects of the present invention may provide security protection schemes and privacy protection schemes.

[0343] As referenced Figure 9 as described, one or more nodes (e.g., UE, DU, CU, XC unit, and PF unit) may provide or support different XaaS services to service customers. In some aspects, each XaaS service (e.g., NET4AI service, DAM service) may be identified using an XaaS ID. In some aspects, different nodes may provide XaaS services to the UE via different networks, and each network may be identified using a Public Land Mobile Network (PLMN) ID or a Non-Public Network (NPN) ID.

[0344] In one aspect, each of the multiple nodes may align with and communicate with other nodes among the multiple nodes, and the node capabilities in terms of XaaS services are supported through an interface management process. The alignment and communication of the capabilities supported by the nodes may allow mutual mode selection among the multiple nodes in one or more subsequent processes, such as in the UE initial access process and the UE XaaS bearer establishment process for XaaS services, based on the supported capabilities.

[0345] Figure 18 An interface management process 1800 for a split RAN provided by one aspect is shown. The process 1800 may provide the workflows for T1, T2, and T3 interface management and provide network notifications to the UE.

[0346] According to one aspect, process 1800 may include one or more PF units 1844 sending a T3 establishment request message 1802 to XC unit 1846 to establish a T3 interface. In some aspects, the T3 establishment request message 1802 may include one or more of the following: PF unit ID, XaaS ID, network ID (e.g., PLMN ID, NPN ID). In some aspects, the T3 establishment request message 1802 may indicate that the PF unit identified by the PF unit ID supports the XaaS service identified by the XaaS ID over the network identified by the network ID. In some aspects, the T3 establishment request message may also include a list of XaaS IDs and network IDs.

[0347] In some aspects, process 1800 may further include XC unit 1846 sending a T3 establishment response message 1804 to one or more PF units 1844 to notify of the successful establishment of the T3 interface. In some aspects, the T3 establishment response message 1804 may include one or more of the following: XC unit ID, XaaS ID, network ID (e.g., PLMN ID, NPN ID). In some aspects, the T3 establishment response message 1804 may indicate that the XC unit identified by the XC unit ID supports the XaaS service identified by the XaaS ID over the network identified by the network ID. In some aspects, the T3 establishment response message 1804 may also include a list of XaaS IDs and network IDs. In some aspects, the XaaS IDs and network IDs included in the T3 establishment response message 1804 may overlap or be common with the XaaS IDs and network IDs indicated in the T3 establishment request message 1802 of one or more PF units 1844. Thus, the overlapping XaaS IDs and network IDs may indicate the XaaS supported by one or more PF units 1844 and XC unit 1846.

[0348] In some aspects, if the XaaS IDs and network IDs in the T3 establishment response message 1804 are different from the XaaS IDs and network IDs that one or more PF units 1844 have provided in the T3 establishment request message 1802, then one or more PF units 1844 may consider the difference and may use those IDs that overlap (e.g., one or more XaaS IDs and one or more network IDs).

[0349] In some aspects, after receiving the T3 establishment request message 1802, if XC unit 1846 determines that it has no overlapping capabilities with one or more PF units 1844 (i.e., does not support the XaaS indicated by the T3 establishment request message 1802), then XC unit 1846 may send a T3 establishment failure message to notify one or more PF units of the failure to establish the T3 interface.

[0350] In one aspect, the T3 establishment process may align the capabilities of the XC unit in terms of XaaS services with the capabilities of one or more PF units in terms of XaaS services. This alignment of XaaS service capabilities may facilitate the mutual selection (between the PF unit and the XC unit) based on the co-supported capabilities in subsequent processes, such as in the UE initial access process for XaaS services and the UE XaaS bearer establishment process.

[0351] In some aspects, process 1800 may further include the XC unit 1846 sending a T2 establishment request message 1806 to the CU 1848 to establish the T2 interface. The T2 establishment request message 1806 may include one or more of the following: XC unit ID, XaaS ID, network ID (e.g., PLMN ID, NPN ID). The T2 establishment request message 1806 may indicate that the XC unit identified by the XC unit ID supports the XaaS service identified by the XaaS ID via the network identified by the network ID. The T2 establishment request message 1806 may further include one or more lists of XaaS ID and network ID. The one or more lists of XaaS ID and network ID included may be supported by the XC unit and one or more PF units connected to the XC unit.

[0352] In some aspects, process 1800 may further include the CU 1848 sending a T2 establishment response message 1808 to the XC unit 1846 to notify the successful establishment of the T2 interface. The T2 establishment response message 1808 may include one or more of the following: CU ID, XaaS ID, network ID (e.g., PLMN ID, NPN ID). The T2 establishment response message 1808 may indicate that the CU identified by the CU ID supports the XaaS service identified by the XaaS ID via the network identified by the network ID. The T2 establishment response message 1808 may include one or more lists of XaaS ID and network ID supported by the CU. The one or more XaaS ID and network ID included in the T2 establishment response message may overlap with the one or more XaaS ID and network ID supported by the XC 1846 (i.e., included in the T2 establishment request message 1806). If the XaaS ID and network ID included in the T2 establishment response message 1808 are different from the XaaS ID and network ID provided by the XC unit 1846 in the T2 establishment request message 1806, the XC unit 1846 may consider the difference and use those that overlap (e.g., XaaS ID and network ID).

[0353] In some aspects, after receiving the T2 establishment request message 1806, if the CU 1848 determines that it does not have overlapping capabilities with the XC unit 1846, the CU 1848 may send a T2 establishment failure message to notify the XC unit 1846 of the failure to establish the T2 interface.

[0354] According to one aspect, the T2 establishment process may align the capabilities of the XC unit and the CU in terms of XaaS services, which may help (the CU unit and the XC unit) to mutually select each other in subsequent processes, such as in the UE initial access process and the UE XaaS bearer establishment process for XaaS services, based on the supported capabilities.

[0355] In some aspects, the process 1800 may involve two modes for T1-C and T1-U interface management. In some aspects, for T1-C interface establishment, the XC unit 1846 and one or more DUs 1842 may establish a connection on the user plane (T1-U interface) under the control of the CU 1848. In some aspects, for T1-U interface establishment or XaaS bearer management on T1-U, one or more DUs 1842 (under the control of the CU 1848) and one or more PF units 1844 (under the control of the XC unit 1846) may establish a user plane (T1-U interface) connection, during which the XC unit and the CU may interact with each other to transmit necessary information. For example, one or more DUs 1842 may establish a user plane (T1-U interface) connection with one or more PF units 1844 under the control of the CU 1848, and one or more PF units may establish a user plane (T1-U interface) connection with one or more DUs 1842 under the control of the XC unit 1846, and the CU 1848 and the XC unit 1846 may interact with each other to transmit necessary information between one or more DUs 1842 and one or more PF units 1844.

[0356] According to the first mode, Mode 1, one or more DUs may directly interact with the CU on the control plane through the F1 interface.

[0357] According to one aspect, in Mode 1, the process 1800 may further include one or more DUs sending an F1 establishment request message 1810 to the CU to establish the F1 interface. The F1 establishment request message 1810 may include one or more of the following: DU ID, cell ID, XaaS ID, and network ID (e.g., PLMN ID, NPN ID). The F1 establishment request message 1810 may indicate that the DU identified by the DU ID supports the XaaS service identified by the XaaS ID through the network identified by the network ID and the cell identified by the cell ID. The F1 establishment request message 1810 may also include a list of cell ID, XaaS ID, and network ID.

[0358] According to one aspect, in Mode 1, the procedure 1800 may further include the CU 1848 sending an F1 establishment response message 1812 to one or more DUs 1842 to notify the successful establishment of the F1 interface. The F1 establishment response message 1812 may include one or more of the following: CU ID, cell ID, XaaS ID, and network ID (e.g., PLMN ID, NPN ID). The F1 establishment response message 1812 may indicate that the CU identified by the CU ID supports the XaaS service identified by the XaaS ID through the network identified by the network ID and the cell identified by the cell ID. The F1 establishment response message 1812 may also include one or more lists of cell IDs, XaaS IDs, and network IDs supported by the CU. The cell ID, XaaS ID, and network ID included in the F1 establishment response message 1812 may overlap with the cell ID, XaaS ID, and network ID supported at one or more DUs (i.e., included in the F1 establishment request message 1810). In some aspects, if the XaaS ID and network ID are different from the XaaS ID and network ID provided by one or more DUs in the F1 establishment request message 1810, the CU 1848 may consider the difference and use those overlapping cell ID, XaaS ID, and network ID.

[0359] In some aspects, after receiving the F1 establishment request message 1810, if the CU 1848 determines that it has no overlapping capabilities with one or more DUs, the CU 1848 may send an F1 establishment failure message to notify one or more DUs of the failure to establish the F1 interface.

[0360] In some aspects, the F1 establishment procedure may align the capabilities of one or more DUs in terms of XaaS services with the capabilities of the CU in terms of XaaS services, which may help the CU and one or more DUs to perform mutual selection (e.g., mutual node selection) based on the supported capabilities in subsequent procedures, such as in the UE initial access procedure and the UE XaaS bearer establishment procedure for the XaaS service.

[0361] According to one aspect, in the second mode, i.e., Mode 2, one or more DUs 1842 may interact with the XC unit 1846 on the CP through the T1-C interface as described herein.

[0362] In some aspects, process 1800 may involve T1-U interface establishment or XaaS bearer management on T1-U, where one or more DUs 1842 and one or more PFs 1844 may establish a user plane (T1-U interface) connection under the single control of an XC unit or a CU. For example, one of the XC unit 1846 or the CU 1848 may control one or more DUs 1842 and one or more PF units 1844 to establish a user plane (T1-U interface) connection.

[0363] According to one aspect, in mode 2, process 1800 may further include one or more DUs 1842 sending a T1 establishment request message 1814 to the XC unit 1846 to establish a T1 interface. The T1 establishment request message 1814 may include one or more of the following: DU ID, cell ID, XaaS ID, and network ID (e.g., PLMN ID, NPN ID). The T1 establishment request message 1814 may indicate that the DU identified by the DU ID supports the XaaS service identified by the XaaS ID through the network identified by the network ID and the cell identified by the cell ID. In some aspects, the T1 establishment request message 1814 may further include a list of cell ID, XaaS ID, and network ID.

[0364] In some aspects, in mode 2, process 1800 may further include the XC unit 1846 sending a T1 establishment response message 1816 to one or more DUs 1842 to notify the successful establishment of the T1 interface. The T1 establishment response message 1816 may include one or more of the following: XC ID, cell ID, XaaS ID, and network ID (e.g., PLMN ID, NPN ID). In some aspects, the T1 establishment response message 1816 may indicate that the XC identified by the XC ID supports the XaaS service identified by the XaaS ID through the network identified by the network ID and the cell identified by the cell ID.

[0365] In some aspects, the T1 establishment response message 1816 may include one or more lists of cell ID, XaaS ID, and network ID supported at the XC unit 1846. In some aspects, one or more of the cell ID, XaaS ID, and network ID included in the T1 establishment response message 1816 may overlap with the cell ID, XaaS ID, and network ID supported at one or more DUs (i.e., included in the T1 establishment request message 1816).

[0366] In some aspects, if the XaaS ID and network ID received by one or more DUs are different from the XaaS ID and network ID provided by one or more DUs 1842 in the T1 establishment request message 1814, one or more DUs 1842 may consider the difference and use those overlapping IDs (e.g., the XaaS ID and network ID provided in the T1 establishment response message 1816).

[0367] In some aspects, after receiving the T1 establishment request message 1814, if the XC unit 1846 determines that it has no overlapping capabilities with one or more DUs 1842, the XC unit 1846 may notify one or more DUs 1842 of the failure to establish the T1 interface, for example, via a T1 establishment failure message.

[0368] According to one aspect, the T1 establishment process may align the capabilities of one or more DUs and the XC unit in terms of XaaS services, which may help (the XC unit and one or more DUs) to mutually select based on the supported capabilities in subsequent processes, such as in the UE initial access process and the UE XaaS bearer establishment process for XaaS services.

[0369] In some aspects, the process 1800 may further include one or more DUs 1842 sending a supported service message 1818 indicating the supported XaaS services to one or more UEs 1830. In some aspects, the supported service message may be sent via a unicast message (a dedicated radio resource control (RRC) message) or a multicast / broadcast message (e.g., system information block 1 (SIB1) or other system information (SI) such as other SIBs). In some aspects, the unicast or multicast / broadcast message (as appropriate) may include one or more of the following: cell ID, XaaS ID, and network ID (e.g., PLMN ID, NPN ID). In some aspects, the unicast or multicast / broadcast message (as appropriate) may indicate the supported XaaS service identified by the XaaS ID and may be accessed via the network identified by the network ID and the cell identified by the cell ID. In some aspects, the unicast or multicast / broadcast message (as appropriate) may further include one or more lists of cell ID, XaaS ID, and network ID. The one or more included cell IDs, XaaS IDs, and network IDs may be those IDs aligned among one or more DUs, PF units, XC units, and CUs as described herein.

[0370] In some aspects, the process 1800 may further include: after receiving the message, one or more UEs 1830 select a suitable cell and network to access the XaaS service.

[0371] In some aspects, the XaaS ID and the network ID can be integrated. For example, the XaaS ID can include information related to the network ID. In this case, the network ID may not be sent when the XaaS ID is sent.

[0372] In some aspects, the T3 establishment process can be triggered by the XC unit 1846 sending a T3 establishment request message, and then, one or more PF units 1844 can send a T3 establishment response message.

[0373] In some aspects, the T2 establishment process can be triggered by the CU 1848 sending a T2 establishment request message, and then, the XC unit 1846 can send a T2 establishment response message.

[0374] In some aspects, the F1 establishment process can be triggered by the CU 1848 sending an F1 establishment request message, and then, one or more DUs can send an F1 establishment response message.

[0375] In some aspects, the T1 establishment process can be triggered by the XC unit 1846 sending a T1 establishment request message, and then, one or more DUs can send a T1 establishment response message.

[0376] In some aspects, the UE can select a suitable cell and network to access or request XaaS services. In some aspects, the UE can request XaaS services after process 1800. For example, the UE can request XaaS services from the RAN and the CN.

[0377] According to one aspect, after receiving the request, the CN and the RAN can establish an XaaS session and an XaaS bearer associated with the requested XaaS service to serve the UE. Figure 19A and Figure 19B Shows a process for the establishment of an XaaS session and an XaaS bearer provided by one aspect.

[0378] According to one aspect, process 1900 can include the UE 1930 sending an XaaS service request message 1901 to the XC unit 1946 to request XaaS services. In some aspects, the UE 1930 can refer to two or more UEs. In some aspects, the XaaS service request message 1901 can be sent, for example, via an RRC message or a dedicated XaaS signaling message. The XaaS service request message 1901 can include one or more of the following: XaaS session ID, XaaS QoS flow ID, XaaS QoS requirements (e.g., data forwarding parameters and data processing parameters). The XaaS QoS requirements can be indicated by one or more of the following: slice ID, XaaS ID, network ID (e.g., PLMN ID, NPN ID), cell ID, and UE ID or UE group ID.

[0379] The XaaS session ID can identify the XaaS session through which the UE 1930 can receive the XaaS service. In some aspects, the range of session ID values (e.g., one or more session ID values) can be reserved at one or more participating entities (e.g., UE, network node, and network function) to identify the XaaS session.

[0380] The XaaS QoS flow ID can identify the XaaS QoS flow included in the XaaS session. The range of QoS flow ID values (e.g., one or more QoS flow ID values) can be reserved at one or more participating entities (e.g., UE, network node, and network function) to identify the XaaS QoS flow. In some aspects, a list of XaaS QoS flow IDs can be included in the XaaS service request message 1901.

[0381] The XaaS QoS requirements (which can include one or more of the following: data forwarding parameters and data processing parameters) can indicate, for example, the XaaS service requirements for one or more of the data forwarding handling parameters and data processing handling parameters. The XaaS QoS requirements can be indicated by a specific slice ID.

[0382] The XaaS ID can identify the XaaS service required by the UE. The network ID (e.g., PLMN ID, NPN ID) can identify the network selected by the UE through which the UE can receive the XaaS service. In some aspects, the information used to receive the XaaS service (e.g., network ID) can be preconfigured locally and stored at the UE, e.g., as subscription information.

[0383] The cell ID can identify the cell selected by the UE through which the UE can receive the XaaS service. The UE ID or UE group ID can identify the UE or the UE group to which the UE belongs, respectively.

[0384] In some aspects, process 1900 can include, after receiving the XaaS service request 1901, the RAN (i.e., XC1946) determining whether the requested XaaS service can be provided and completed by the RAN alone. In some aspects, if XC 1946 determines that the RAN can provide the XaaS service on its own, the XaaS session can terminate at the RAN and the CN does not need to participate. For example, an XaaS bearer can be established.

[0385] According to some aspects, process 1900 may further include XC unit 1946 sending an XaaS service request message 1903 to CU 1948 to notify the CU of the UE's request for the XaaS service. The XaaS service request message 1903 may include one or more of the following: XaaS session ID, XaaS QoS flow ID, XaaS QoS requirement, XaaS ID, network ID, cell ID, UE ID, or UE group ID. In some aspects, before sending the XaaS service request message 1903, XC unit 1946 may select a suitable CU 1948 based on the XaaS service requested by the UE and the XaaS services supported by the CU. In some aspects, if XC 1946 determines that the RAN can provide the XaaS service by itself and the CN does not need to participate, the XaaS service request message 1903 may include an indication to the CU that the CN does not need to participate. After receiving this indication, the CU may no longer send further messages to the CN. That is, in aspects where the CN may not participate in providing the XaaS service, process 1900 may skip the operations described in references 1904, 1905, 1906, and 1907 and continue with the operations described in reference 1908.

[0386] In some aspects, if the RAN cannot provide the XaaS service by itself, for example, the CN may need to be involved, process 1900 may continue with the operations described in reference 1904.

[0387] According to some aspects, process 1900 may further include CU 1948 sending an XaaS service request message 1904 to CN 1950 to notify the CN of the UE's request for the XaaS service. The XaaS service request message 1904 may include one or more of the following: XaaS session ID, XaaS QoS flow ID, XaaS QoS requirement, XaaS ID, network ID, UE ID, or UE group ID.

[0388] In some aspects, after receiving the XaaS service request message 1904, CN 1950 may determine whether to allow UE 1930 to access the XaaS service, for example, based on the UE's request and the UE's subscription information (e.g., allowed networks, allowed XaaS services) stored in CN 1950.

[0389] In some aspects, process 1900 may further include, after receiving the XaaS service request message 1904, the CN 1950 determining (1905) whether the CN should participate in the XaaS service. In some aspects, if the CN 1950 determines that it should participate, the CN 1950 may establish the required XaaS session. In some aspects, the XaaS session may be established at the CN function (e.g., the CN PF unit) or the data network (DN).

[0390] In some aspects, process 1900 may further include the CN 1950 sending an initial context establishment request or an XaaS session establishment request message 1906 to the RAN (e.g., the CU 1948) to notify the RAN to establish resources for the XaaS service requested for the UE.

[0391] In some aspects, if the CN 1950 determines that the required XaaS service should be provided and completed jointly by the RAN side and the CN, the initial context establishment request or the XaaS session establishment request message 1906 may include one or more of the following: UE ID or UE group ID, XaaS session ID, XaaS QoS flow ID, XaaS QoS requirements, and the node address for receiving XaaS data (e.g., the UP transport network layer (TNL) information on the CN side).

[0392] In some aspects, the UE ID or UE group ID, XaaS session ID, XaaS QoS flow ID, and XaaS QoS requirements in the initial context establishment request or the XaaS session establishment request message 1906 may be the same as or aligned with the operations described in the reference XaaS service request messages 1901, 1903, and 1904 to notify one or more associated resources for establishing the XaaS service required for the UE or UE group.

[0393] In some aspects, the node address (e.g., the UP transport network layer (TNL) information) may be used by the RAN to forward the XaaS data to the CN node (e.g., the CN PF unit).

[0394] In some aspects, if the CN 1950 determines that the required XaaS service should be provided and completed solely by the RAN side and the CN does not need to participate, the initial context establishment request or the XaaS session establishment request message 1906 may include one or more of the following: UE ID or UE group ID, XaaS session ID, XaaS QoS flow ID, XaaS QoS requirements, and an indication.

[0395] In some aspects, an indication (e.g., a string or the value 0) can inform that the required XaaS service can be provided and completed solely by the RAN side, and the CN does not need to participate. In some aspects, the indication of how to provide the XaaS service can be notified by a default method. For example, if the UP TNL information is not included in message 1906, or includes XaaS QoS requirements but does not include the XaaS session ID and XaaS QoS flow ID, the indication can imply or indicate that the required XaaS service can be provided and completed solely by the RAN side without CN participation.

[0396] In some aspects, after receiving the initial context establishment request or the XaaS session establishment request message 1906, the SDAP sublayer of the CU 1948 can perform (1907) the mapping between one or more XaaS QoS flows and one or more XaaS bearers. As referenced Figure 20 and Figure 21 described, one XaaS QoS flow of an XaaS session can be mapped to one or more XaaS data bearers, for example, by the SDAP sublayer, given or based on the XaaS QoS requirements (e.g., data forwarding requirements and data processing requirements). In some aspects, one XaaS bearer can transport the data of one or more XaaS QoS flows from the same or different XaaS sessions.

[0397] In some aspects, after receiving the initial context establishment request or the XaaS session establishment request message 1906, a UP tunnel can be established for the RAN to send XaaS data to the CN.

[0398] In some aspects, the XaaS session establishment can be triggered by the UE performing the operations described in action 2001 of reference Figure 20 In some aspects, the XaaS session establishment can be triggered by the CN 1950 performing the operations described in reference action 1906 (i.e., the CN 1950 sends the initial context establishment request or the XaaS session establishment request message 1906).

[0399] In some aspects, process 1900 may further include CU 1948 sending a UE bearer context establishment request 1908 to XC unit 1946 to notify the XC unit to establish resources for the XaaS service requested by the UE. The UE bearer context establishment request 1908 may include one or more of the following: XaaS bearer ID, mapped XaaS QoS flow ID, mapped XaaS session ID, UE ID or UE group ID served by the XaaS bearer, XaaS QoS requirements for the XaaS bearer or XaaS QoS flow, and the node address on the CU side (e.g., T2-U TNL information on the CU side). In some aspects, the UE bearer context establishment request 1908 may further include one or more lists of the XaaS bearer ID, mapped XaaS QoS flow ID, and mapped XaaS session ID.

[0400] The XaaS bearer ID may identify the XaaS bearer to be established. The mapped XaaS QoS flow ID may identify the XaaS QoS flow mapped to the XaaS bearer. In some aspects, the mapped XaaS session ID may identify the XaaS session mapped to the XaaS bearer, and the XaaS QoS flow identified by the XaaS QoS flow ID may belong to the XaaS session identified by the XaaS session ID.

[0401] In some aspects, the UE ID or UE group ID may identify one or more UEs served by the XaaS bearer. In some aspects, the XaaS QoS requirements for the XaaS bearer or XaaS QoS flow may correspondingly indicate the XaaS QoS requirements for the XaaS bearer or the mapped XaaS QoS flow.

[0402] In some aspects, the node address on the CU side (e.g., T2-U TNL information on the CU side) may indicate the XaaS module (e.g., PF unit) to forward XaaS data to the CU (e.g., CU-UP).

[0403] In some aspects, process 1900 may further include, after receiving the UE bearer context establishment request 1908, XC unit 1946 selecting (1909) one or more suitable PF units from the set of PF units it is connected to, e.g., based on the XaaS service requested by the UE and the XaaS services supported by the PF units.

[0404] In some aspects, process 1900 may further include XC unit 1946 assisting the PF unit in determining one or more of the following: the mapping between the PF entity and the PDCP entity, and the relevant configuration parameters of the PF entity and the PDCP entity (e.g., security parameters, buffer size). XC unit 1946 may assist the PF unit by providing information for mapping purposes.

[0405] In some aspects, process 1900 may further include XC unit 1946 sending a UE context establishment request message 1910 to PF unit 1944 to notify the PF unit to establish resources for the XaaS service requested by the UE. In some aspects, PF unit 1944 may refer to multiple PF units.

[0406] The UE context establishment request message 1910 may include one or more of the following: XaaS bearer ID, mapped XaaS QoS flow ID, mapped XaaS session ID, UE ID or UE group ID of the XaaS bearer service, XaaS QoS requirements for the XaaS bearer or XaaS QoS flow, node address (e.g., T2-U TNL information on the CU side) used by the PF unit to forward XaaS data to the CU side of the CU. In some aspects, the UE context establishment request message 1910 may further include one or more lists of the XaaS bearer ID, mapped XaaS QoS flow ID, and mapped XaaS session ID.

[0407] In some aspects, after receiving the UE context establishment request message 1910, process 1900 may further include PF unit 1944 performing (1911) one or more of the following: determining the mapping between the PF entity and the PDCP entity, establishing and configuring the PF entity and the PDCP entity for the XaaS bearer (e.g., security parameters, buffer size).

[0408] After receiving the UE context establishment request message 1910, a UP tunnel for the PF unit to send XaaS data to the CU may be established.

[0409] In some aspects, process 1900 may further include PF unit 1944 sending a UE context establishment response message 1912 to XC unit 1946 to notify the successful establishment of the XaaS bearer. The UE context establishment response message 1912 may include one or more of the following: XaaS bearer ID, PF entity and PDCP entity configuration information, node address on the PF side (e.g., T1-U TNL information, T2-U TNL information).

[0410] In some aspects, an XaaS bearer can be mapped to a new type of radio bearer (NRB) to carry the data of the XaaS bearer. The NRB can be used for point-to-multipoint data transmission between the network and the UE, for example, using multicast or broadcast methods. According to one aspect, the NRB can be configured with a PDCP entity. Thus, the data of a PF entity can be mapped to a PDCP entity configured for a UE group. In some aspects, the mapping can be based on XaaS QoS requirements, such as data forwarding handling requirements and data processing handling requirements. The mapping information between the XaaS bearer and the NRB can be configured through dedicated XaaS signaling messages or RRC messages, for example, configured by the XC sublayer or other control plane functions through XSB. In some aspects, an NRB can carry the data of only one XaaS bearer. In some aspects, the NRB can be a Multimedia Broadcast Multicast Service (MBMS) point-to-multipoint radio bearer (MRB).

[0411] In some aspects, the PF entity and PDCP entity configuration information can include one or more of the following: XaaS bearer and DRB mapping information, XaaS bearer and NRB mapping information, PF data splitting information, PDCP data splitting information, PF entity parameters, PDCP entity parameters.

[0412] The XaaS bearer and DRB mapping information (for example, PF entity and PDCP entity mapping information) can be used to map the XaaS bearer (for example, identified by the XaaS bearer ID) to the DRB of the UE (for example, identified by the DRB ID). The XaaS bearer and NRB mapping information can be used to map the XaaS bearer to the radio bearer of the UE group. The PF data splitting information can be used to split the PF sublayer data to multiple PDCP entities. The PDCP data splitting information can be used to split the PDCP sublayer data to multiple RLC entities. The PF entity parameters can include, for example, data privacy protection algorithms, AI inference models, buffer sizes, etc. The PDCP entity parameters can include, for example, security parameters.

[0413] The node address on the PF side (for example, T1-U TNL information) can be used for the DU to forward XaaS data to the PF unit. The node address on the PF side (for example, T2-U TNL information) can be used for the CU to forward XaaS data to the PF entity.

[0414] In some aspects, process 1900 may further include XC unit 1946 sending a UE bearer context establishment response message 1913 to CU to notify the successful establishment of the XaaS bearer. The UE bearer context establishment response message 1913 may include one or more of the following: XaaS bearer ID, PF entity and PDCP entity configuration information, node address on the PF side (e.g., T1-U TNL information, T2-U TNL information).

[0415] In some aspects, after receiving the UE bearer context establishment response message 1913, a UP tunnel for the CU to send XaaS data to the PF entity may be established.

[0416] Reference Figure 19B , in some aspects, process 1900 may further include CU 1950 sending a UE context establishment request message 1914 to DU 1942 to notify DU to establish resources for the XaaS service requested for the UE. The UE context establishment request message 1914 may include one or more of the following: DRB ID or NRB ID, mapped XaaS bearer ID, XaaS QoS requirement for the DRB, cell ID, UE ID or UE group ID served by the DRB or NRB, PDCP entity and RLC entity mapping information, and node address on the PF side (e.g., T1-U TNL information on the PF side). In some aspects, the UE context establishment request message 1914 further includes one or more lists of XaaS bearer IDs.

[0417] The DRB ID or NRB ID may identify the DRB or NRB to be established. The mapped XaaS bearer ID may identify the XaaS bearer mapped to the DRB or NRB. The XaaS QoS requirement for the DRB may indicate the XaaS QoS requirement for the DRB (e.g., data forwarding disposition). The cell ID may identify the serving cell of the UE through which the UE may receive the XaaS service. The UE ID or UE group ID may identify one or more UEs served by the DRB or NRB. The PDCP entity and RLC entity mapping information may indicate how the data of the PDCP entity on the PF unit side is mapped to the RLC entity on the DU side. The node address on the PF side (e.g., T1-U TNL information on the PF side) may be used by the DU to forward XaaS data to the PF unit.

[0418] In some aspects, process 1900 may further include, after receiving the UE context establishment request message 1914, DU 1942 performing an action 1915 to establish and configure one or more of the following, for example, based on the mapping information and the XaaS QoS requirement for the DRB or NRB: RLC sublayer, MAC sublayer, and PHY layer.

[0419] In some aspects, after receiving the UE context establishment request message 1914, a UP tunnel for the DU to send XaaS data to the FP unit may be established.

[0420] In some aspects, process 1900 may further include the DU 1942 sending a UE context establishment response message 1916 to the CU 1948 to notify the successful establishment of the DRB or NRB. The UE context establishment response message 1916 may include one or more of the following: DRB ID or NRB ID, mapped XaaS bearer ID, RLC sublayer, MAC sublayer, PHY layer (e.g., via an RRC container) configuration information, and the node address on the DU side (e.g., T1-U TNL information on the DU side). The node address on the DU side (e.g., T1-U TNL information) may be used by the PF unit to forward XaaS data to the DU.

[0421] In some aspects, process 1900 may further include the CU 1948 sending a UE bearer context update request message 1917 to the XC unit 1946 to update the configuration of the XaaS bearer. Among them, the UE bearer context update request message 1917 may include one or more of the following: DRB ID or NRB ID, mapped XaaS bearer ID, T1-U TNL information on the DU side.

[0422] In some aspects, the DRB ID or NRB ID may identify the established DRB or the NRB to be updated. The mapped XaaS bearer ID may identify the XaaS bearer mapped to the DRB or NRB. In some aspects, the UE bearer context update request message 1917 may include one or more lists of XaaS bearer IDs. The node address on the DU side (e.g., T1-U TNL information on the DU side) may be used by the PF to forward XaaS data to the DU.

[0423] In some aspects, process 1900 may further include the XC unit 1946 sending a UE context update request message 1918 to the PF unit 1944 to update the configuration of the XaaS bearer. The UE context update request message 1918 may include one or more of the following: DRB ID or NRB ID, mapped XaaS bearer ID, and T1-U TNL information on the DU side.

[0424] In some aspects, after receiving the UE context update request message 1918, a UP tunnel for the FP unit to send XaaS data to the DU may be established.

[0425] In some aspects, process 1900 may further include the XC unit 1946 or the CU 1948 configuring the necessary information of the UE.

[0426] According to one aspect, process 1900 may further include the CU 1948 sending the XaaS service response message 1919 to the UE 1930, for example, via an RRC reconfiguration message or other dedicated RRC message between the UE and the CU, to configure the UE for the requested XaaS service. The XaaS service response message 1919 may include one or more of the following: XaaS session ID, XaaS QoS flow ID, XaaS bearer ID, DRB ID, and NRB ID. In some aspects, a list of one or more of the following may be included in the XaaS service response message 1919: XaaS session ID, XaaS QoS flow ID, XaaS bearer ID, DRB ID, and NRB ID. In some aspects, the XaaS service response message 1919 may notify the UE that the XaaS session, XaaS QoS flow, XaaS bearer, and DRB / NRB have been successfully established so that the UE can receive the requested XaaS service.

[0427] In some aspects, the XaaS service response message 1919 may further include mapping information related to the XaaS session, XaaS QoS flow, XaaS bearer, and DRB / NRB, for example, XaaS session and XaaS bearer mapping information (e.g., XaaS session ID and XaaS bearer ID mapping).

[0428] In some aspects, the XaaS service response message 1919 may further include L2 layer configurations, such as configuration parameters of different L2 entities, and the mapping between the PF entity and the PDCP entity. In some aspects, the XaaS service response message 1919 may further include L1 layer configurations, such as physical resource blocks.

[0429] In some aspects, process 1900 may further include the XC unit 1946 sending the XaaS service response message 1920 to the UE 1930, for example, via a dedicated XaaS signaling message between the XC unit and the UE, to configure the UE for the requested XaaS service. The XaaS service response message 1920 may include one or more of the information included in the XaaS service response message 1919.

[0430] Some aspects of the present invention may provide joint PF sublayer and PDCP sublayer security configurations based on a preconfigured security mode.

[0431] According to one aspect, in a split RAN architecture, as Figure 5 、 Figure 7 and Figure 12 shown, for XaaS services, both the PF sublayer and (all or part of) the PDCP sublayer may be deployed on the PF unit.

[0432] In some aspects, the configuration of the PF sublayer (including security configuration) can be assigned to the XC unit, while the configuration of the PDCP sublayer can be retained at the CU or assigned to the XC unit.

[0433] In some aspects, if the configuration of the PDCP sublayer is retained at the CU, the CU and the XC unit may need to cooperate to configure the PF unit for the PDCP sublayer and the PF sublayer respectively.

[0434] In some aspects, if the configuration of the PDCP sublayer is assigned to the XC unit, the XC unit can configure the PF unit for the PDCP sublayer and the PF sublayer.

[0435] Figure 20 A process for joint security configuration of the PDCP sublayer and the PF sublayer based on a preconfigured security mode provided by one aspect is shown. Process 2000 can provide security configuration for the PDCP sublayer and / or the PF sublayer in a split RAN architecture.

[0436] According to one aspect, each network node (UE 2030, CN 2050, XC unit 2046, PF unit 2044, CU 2048) can be preconfigured, for example, through a subscription or network management process, with one or more lists of security modes supported for data processing and data forwarding. In some aspects, the supported security modes can be notified to different nodes and aligned among different nodes.

[0437] Based on the preconfigured security capabilities, in some aspects, the UE 2030 and the network (e.g., CN 2050, XC unit 2046, PF unit 2044, CU 2050) can perform one or more of the following: NAS security mode and AS security mode selection, and perform security protection for data forwarding and data processing of XaaS XSB, XDB, and XaaS NAS traffic.

[0438] In some aspects, one or more AS security parameters (e.g., security keys for XaaS bearers XSB and XDB) can be derived from the RAN node key. The RAN node key can be derived based on the CN key, and the CN key is processed by the upper layer. In some aspects, the CU 2048 can forward one or more of the RAN node key and the CN key to the XaaS module to enable the XaaS module to encrypt, decrypt, and parse data.

[0439] According to one aspect, a workflow or process 2000 may include a UE reporting or sending, e.g., via a registration request message, its supported security modes (e.g., identified by a security mode ID) 2001 for data processing and data forwarding to a CN. The supported security modes 2001 may include one or more of the AS security modes and NAS security modes described herein.

[0440] In some aspects, one or more UEs (including UE 2020) may subscribe to a configuration with one or more lists of security modes for data processing and data forwarding. The one or more lists may be sorted according to priorities determined by the operator.

[0441] UE 2030 may report its supported security modes 2001 to the network (e.g., CN) by various methods. In some aspects, UE 2030 may report its supported security modes to XC unit 2046 and CU 2048 separately. That is, the UE sends its supported security modes to the XC unit in a first message, and then the UE sends the same supported security modes to the CU in a separate second message. Then, XC unit 2046 and CU 2048 may also forward the UE supported security modes to CN 2050.

[0442] In some aspects, UE 2030 may report its supported security modes to XC unit 2046, and the XC unit 2046 forwards the UE supported security modes to CU 2048. Then, CU 2048 may forward the UE supported security modes to CN 2050.

[0443] In some aspects, UE 2030 may report its supported security modes to CU 2048, and the CU 2048 forwards the UE supported security modes to XC unit 2046. Then, XC unit 2046 may forward the UE supported security modes to CN 2050.

[0444] In some aspects, UE 2030 may report its supported security modes to the CN, and the CN forwards the UE supported security modes to one or more of XC unit 2046 and CU 2048. If the CN forwards the UE supported security modes to XC unit 2046, the XC unit 2046 may forward the received UE supported security modes to CU 2048. Similarly, if the CN forwards the UE supported security modes to CU 2048, the CU 2048 may forward the received UE supported security modes to XC unit 2046.

[0445] In some aspects, UE 2030 may report the security modes it supports to the DU, and the DU may forward the received UE-supported security modes to the CU and / or the XC unit. If the DU forwards the UE-supported security modes to the XC unit, the XC unit may forward the received UE-supported security modes to the CU. Similarly, if the DU forwards the UE-supported security modes to the CU, the CU may forward the received UE-supported security modes to the XC unit. Then, one or more of the XC unit and the CU may forward the UE-supported security modes to the CN.

[0446] In some aspects, procedure 2000 may further include the PF unit 2044 reporting the supported AS security mode 2002 (e.g., identified by the AS security mode ID) it supports to the XC unit. In some aspects, the priorities of different security modes may also be reported. In some aspects, the PF unit 2044 may refer to multiple PF units.

[0447] In some aspects, one or more PF units may be configured through a network management procedure with one or more lists of security modes for data processing and data forwarding. The one or more lists may be sorted according to priorities determined by the operator.

[0448] In some aspects, procedure 2000 may further include the XC unit 2046 reporting the supported AS security mode 2003 (e.g., identified by the AS security mode ID) for data forwarding of XaaS to the CU. In some aspects, the priorities of different encryption algorithms and integrity protection algorithms may also be reported. The supported AS security mode 2003 may indicate one or more AS security modes supported at one or more of the following: PF 2044 and XC unit 2046. In some aspects, the supported AS security mode 2003 may include one or more AS security modes supported at the XC unit 2046 and at least one PF 2044 connected to the XC 2046 (e.g., overlapping AS security modes between the XC unit and at least one PF).

[0449] In some aspects, the included supported AS security mode 2003 may be supported by at least one PF unit connected to the XC unit. Alternatively, the AS security mode 2003 may be an overlapping security mode supported at the XC unit 2046 and at least one of the PF units 2044 connected to the XC unit.

[0450] In some aspects, procedure 2000 may further include the CN sending, e.g., to the UE via a NAS security mode command message 2004, a selected NAS security mode (e.g., identified by a NAS security mode ID). In some aspects, the selected security mode may be used to protect the control plane between the UE and the CN and / or the CN XaaS data on the user (data) plane, e.g., to protect the NAS traffic of XaaS.

[0451] In some aspects, the CN 2050 may be configured via network management with one or more lists of security modes for data processing and data forwarding. According to one aspect, based on the received UE-supported security modes and the configured CN-supported security modes, the CN 2050 may select a suitable security mode for data processing and data forwarding, e.g., a security mode that overlaps with the security modes supported by the UE and the CN and may have a high or the highest priority.

[0452] In some aspects, when sending its supported security mode 2001, the UE may request the establishment or creation of an XaaS PDU session, e.g., via an XaaS PDU session establishment request. In some aspects, the XaaS PDU session establishment request may include one or more XaaS QoS parameters (e.g., security level, privacy level) regarding the XaaS service.

[0453] According to one aspect, based on the XaaS QoS parameters and the received UE security capabilities, the CN 2050 may decide on the data forwarding disposition and the data processing disposition for the XaaS PDU session. For example, based on the XaaS QoS parameters and the UE security capabilities, the CN 2050 may perform one or more of the following: determine or select a CN security mode regarding data processing and data forwarding, and generate one or more security parameters for the CN XaaS traffic.

[0454] In some aspects, procedure 2000 may further include the CN sending, e.g., to the CU 2048 via an initial UE context establishment request or an XaaS PDU session establishment request message 2005, one or more of the following: the UE-supported security mode 2001 and CN auxiliary security information. The CN auxiliary security information may include one or more of the following: CN auxiliary information regarding the AS security mode and CN auxiliary security parameters.

[0455] In some aspects, the CN assistance information regarding the AS security mode can provide information for the CU and XC units to further determine the AS security mode. In some aspects, the assistance security parameters can be used by the CU and / or XC units to derive the AS security parameters (e.g., AS security keys) for the PF unit including the PF sublayer and the PDCP sublayer. The CN assistance security parameters can include one or more of the following: the security key Kx, which is used by one or more of the CU, XC unit, and PF unit to derive the AS security parameters of the PF sublayer (referred to as the PF sublayer-related security key), and the security key Kc, which is used by one or more of the CU, XC unit, and PF unit to derive the AS security parameters of the PDCP sublayer (referred to as the PDCP sublayer-related security key). In some aspects, Kx and Kc can be the same or different. In some aspects, one or more keys can refer to one or more of the following: the key for the privacy protection algorithm for privacy protection and the key for the security protection algorithm for security protection.

[0456] In some aspects, if the configuration of the PDCP sublayer is assigned to the CU, the process 2000 may further include the CU 2048 selecting (2006) a suitable security mode for data forwarding on the PDCP sublayer based on one or more of the following: the supported security modes 2003 received from the XC 2046, the UE-supported security modes 2005 received from the CN, and the CN assistance security information. In some aspects, the selected security mode can be a security mode supported by both the UE and the XC and can have a high or the highest priority.

[0457] In some aspects, the selected security mode can be used to protect the PDCP sublayer XaaS data on one or more of the control plane or the user (data) plane between the UE and the PF unit. In some aspects, for example, based on the PDCP sublayer-related security key Kc, the CU 2048 can also generate one or more security parameters corresponding to the selected security algorithm (e.g., the encryption key Kpd-u, which can be used for PDCP sublayer data, e.g., for XSB on the CP or XDB on the UP).

[0458] In some aspects, the CU 2048 can also perform one or more of the following: generate CU assistance information regarding the AS security mode, and assist the XC unit in further determining the AS security mode. In some aspects, there can be one or more rounds of interaction and negotiation between the CU and the XC unit to collaboratively determine the AS security mode.

[0459] In some aspects, the CU 2048 can assist the XC unit in determining the AS security mode by providing information (e.g., CU assistance information regarding the AS security mode), which can include a list of preferred security modes for data forwarding on the PDCP sublayer (e.g., indicating one or more of the following: encryption algorithm and integrity protection algorithm). In some aspects, the CU 2048 can send a list of preferred security modes for the PDCP sublayer to the XC unit 2046, and the XC unit 2046 can select one or more preferred security modes from the list and feedback the selected one or more preferred security modes to the CU. In some aspects, the CU 2048 can also select one or more preferred security modes received from the XC unit and feedback the selected one or more preferred security modes to the XC. The XC 2046 and the CU 2048 can continue the back-and-forth feedback of the selected security modes in one or more rounds to reach a consensus between the CU and the XC.

[0460] In some aspects, the process 2000 can further include the CU 2048 sending an XaaS bearer establishment request message 2007 to the XC unit 2046. The XaaS bearer establishment request message 2007 can include one or more of the following: the security mode of the UE, CU assistance security information, and CN assistance security information included in the request message 2005.

[0461] In some aspects, if the configuration of the PDCP sublayer is assigned to the CU 2048, the CU 2048 can also send one or more of the following to the XC 2046 in the XaaS bearer establishment request message 2007 or a different message: the selected security mode for data forwarding on the PDCP sublayer (e.g., indicating the encryption algorithm, integrity protection algorithm), security parameters (e.g., encryption key Kpd-u), and CU assistance information regarding the AS security mode.

[0462] In some aspects, if or when the CU determines that the PDCP sublayer does not require security protection, one or more of the following can occur: the CU may not send a security algorithm to the XC unit, or the CU may send a default value or a null value to the XC unit as a security parameter.

[0463] In some aspects, the process 2000 can further include the XC 2046 performing (2008) one or more of the following: selecting a PF unit and selecting an AS security mode. In some aspects, the XC 2046 can select a PF unit that has overlapping supported security modes with the UE.

[0464] In some aspects, XC 2046 may select an AS security mode based on one or more of the following: information received in the XaaS bearer establishment request message 2007 and information received in the supported AS security modes 2002. In some aspects, XC 2046 may select an AS security mode based on one or more of the following: XaaS QoS requirements, CN assistance information regarding the AS security mode, CU assistance information, etc.

[0465] In some aspects, based on the selected AS security mode, the XC unit 2046 may further derive or generate one or more AS security parameters (e.g., based on one or more of the following: CU assistance security information and CN assistance security parameters). In some aspects, one or more derived AS security parameters may correspond to AS security algorithms for the PF unit to perform security protection in one or more of the PF sublayer and the PDCP sublayer.

[0466] In some aspects, the XC unit may select one or more suitable AS security algorithms corresponding to the security mode. For example, the security mode may indicate that security protection should not be performed at the PF sublayer and the PDCP sublayer, or security protection should be performed at one or more of the PF sublayer and the PDCP sublayer. Based on the security mode, the XC unit may select one or more security algorithms associated with the PDCP sublayer and / or the PF sublayer. In some aspects, based on the security mode, e.g., when security protection should not be performed at the PDCP sublayer and the PF sublayer, the XC unit may not select security algorithms for the PDCP sublayer and the PF sublayer.

[0467] According to one aspect, the XC unit 2046 may derive one or more AS security parameters based on relevant security keys. For example, the XC unit 2046 may derive an AS security key Kpf-u for PF sublayer security between the PF unit and the UE based on the PF sublayer-related security key Kx. The XC unit 2046 may also derive a security key Kpf-pf for PF sublayer security between different PF units based on the PF sublayer-related security key Kx. The XC unit 2046 may also derive an AS security key Kxc-u for XC sublayer security between the XC unit and the UE.

[0468] In some aspects, if the configuration of the PDCP sublayer is assigned to the XC unit, the XC unit 2046 may also derive an AS security key Kpd-u for PDCP sublayer security between the UE and the PF unit based on the PDCP sublayer-related security key Kc.

[0469] According to one aspect, the selected security mode and the derived security parameters corresponding to the security algorithms may be used to protect data on the XDB and XSB (e.g., to protect data privacy).

[0470] In some aspects, process 2000 may further include XC unit 2046 sending AS security configuration information 2009 to PF 2044. The AS security configuration information may include a selected AS security mode (e.g., identified by a security mode ID) and AS security parameters (e.g., AS security keys Kpf-u, Kpf-pf, Kpd-u).

[0471] In some aspects, the XC unit may send a selected security mode (e.g., identified by a security mode ID) and CN-assisted security parameters (e.g., PF sublayer-related security key Kx and PDCP sublayer-related security key Kc) to the PF. Thus, process 2000 may further include PF 2044 deriving or generating (2010) AS security parameters (e.g., AS security keys Kpf-u, Kpf-pf, Kpf-u). Based on the AS security mode and the AS security parameters, PF unit 2044 may perform security protection on one or more of the PF sublayer data and the PDCP sublayer data.

[0472] In some aspects, process 2000 may further include XC unit 2046 sending an AS security configuration message 2011. The AS security configuration message 2011 may include one or more of the following: a selected AS security mode (e.g., identified by a security mode ID) and AS security parameters. In some aspects, the AS security configuration message 2011 may be sent between the XC unit and the UE via, for example, an AS security mode command message or other XaaS signaling messages on the XSB. The AS security configuration message 2011 may be sent to the UE for the UE to perform security protection between the UE and the PF unit at one or more of the PF sublayer and the PDCP sublayer. In some aspects, for example, when the UE can derive the AS security parameters by itself, the AS security configuration message 2011 may not include the AS security parameters.

[0473] In some aspects, process 2000 may further include XC unit 2046 sending an AS security configuration information message 2012 to CU 2048. The AS security configuration information message may include one or more of the following: a selected AS security mode (e.g., identified by a security mode ID) and AS security parameters (e.g., AS security keys Kpf-u, Kpf-pf, Kpd-u).

[0474] In some aspects, process 2000 may further include CU 2048 sending an AS security configuration message 2013 to the UE. The AS security configuration message 2013 may include one or more of the following: a selected AS security mode (e.g., identified by a security mode ID) and AS security parameters. In some aspects, the AS security configuration message 2013 may be sent between the CU and the UE via an AS security mode command message or other XaaS signaling messages on the SRB. In some aspects, the AS security configuration message 2013 may be sent to the UE for the UE to perform security protection between the UE and the PF unit at one or more of the PF sublayer and the PDCP sublayer. In some aspects, for example, when the UE can derive the AS security parameters by itself, the AS security configuration message 2011 may not include the AS security parameters.

[0475] In some aspects, the operations described with reference to AS security configuration messages 2012 and 2013 may be alternatives to the operations described with reference to AS security configuration message 2011.

[0476] Some aspects of the present invention may provide joint PF sublayer and PDCP sublayer security configuration based on preconfigured security capabilities.

[0477] Reference Figure 21 , in some aspects, one or more network nodes (UE 2130, CN 2150, XC unit 2146, PF unit 2144, CU 2148) may be preconfigured, for example, via a subscription or a network management process, with one or more lists of security capabilities supported in data processing and data forwarding (i.e., supported security algorithms).

[0478] Based on the preconfigured security capabilities, the UE 2130 and the network (e.g., CN 2150, XC unit 2146, PF unit 2144, CU 2148) may perform one or more of the following: security capability alignment, security mode selection, and security algorithm negotiation, and perform security protection on the data forwarding and data processing of XaaS XSB, XDB, and XaaS NAS traffic.

[0479] Figure 21 A process of joint PDCP sublayer and PF sublayer security configuration based on preconfigured security capabilities provided by one aspect is shown. Process 2100 may provide security configuration for the PDCP sublayer and / or the PF sublayer in a split RAN architecture.

[0480] According to one aspect, a workflow or process 2100 may include the UE 2130 reporting or sending its security capabilities in data processing and data forwarding to the CN 2150, for example, via a registration request message 2101. The registration request message 2101 may include the security capabilities of the UE in supporting data processing in XaaS (e.g., supported privacy protection algorithms), which may be used for one or more of the following: the PF sublayer and XaaS NAS traffic (e.g., NAS signaling and / or NAS UP traffic) between the UE and the CN. In some aspects, the registration request message 2101 may further include the security capabilities of the UE in supporting data forwarding in XaaS (e.g., supported encryption algorithms and integrity protection algorithms), which may be used for one or more of the following: the PDCP sublayer and XaaS NAS traffic (e.g., NAS signaling and / or NAS UP traffic) between the UE and the CN.

[0481] In some aspects, the registration request message 2101 may further include the priorities of the algorithms indicated in the security capabilities of the UE in one or more aspects of data forwarding and data processing.

[0482] In some aspects, one or more UEs (including the UE 2130) may subscribe to one or more lists configured with security algorithms available for data processing and data forwarding. The one or more lists may include a first set of lists for data processing and a second set of lists for data forwarding. The one or more lists may be sorted according to priorities determined by the operator.

[0483] In some aspects, the UE 2130 reporting its security capabilities to the network (e.g., the CN) may involve one or more operations. In some aspects, the UE 2130 may report the security capabilities of the UE in data processing in XaaS (e.g., for privacy protection) and the security capabilities of the UE in data forwarding in XaaS to the XC unit 2146 and the CU 2146, respectively. Then, the XC unit 2146 and the CU 2148 may also forward the UE security capabilities to the CN 2150.

[0484] In some aspects, the UE 2130 may report the security capabilities of the UE in data processing in XaaS and the security capabilities of the UE in data forwarding in XaaS to the XC unit 2146. The XC unit 2146 may locally store the security capabilities of the UE in data processing in XaaS. The XC unit 2146 may also forward the security capabilities of the UE in data forwarding in XaaS to the CU 2148. Then, the XC 2146 may also forward the security capabilities of the UE in data processing in XaaS and the security capabilities of the UE in data forwarding in XaaS to the CN 2150.

[0485] In some aspects, the UE 2130 may report to the CU 2148 the security capabilities of the UE in data processing for XaaS and the security capabilities of the UE in data forwarding for XaaS. The CU 2148 may locally store the security capabilities of the UE in data forwarding for XaaS. The CU 2148 may also forward to the XC unit 2146 the security capabilities of the UE in data processing for XaaS. Then, the CU 2148 may also forward to the CN 2150 the security capabilities of the UE in data processing for XaaS and the security capabilities of the UE in data forwarding for XaaS.

[0486] In some aspects, the UE 2130 may report to the CN 2150 the security capabilities of the UE in data processing for XaaS and / or the security capabilities of the UE in data forwarding for XaaS. The CN 2150 may notify or send to the XC unit 2146 one or more of the following: the security capabilities of the UE in data processing for XaaS and the security capabilities of the UE in data forwarding for XaaS. If received, the XC unit 2146 may locally store the security capabilities of the UE in data processing for XaaS. If the XC unit 2146 also receives from the CN 2150 the security capabilities of the UE in data forwarding for XaaS, the XC unit 2146 may also forward to the CU 2148 the security capabilities of the UE in data forwarding for XaaS.

[0487] In some aspects, the UE 2130 may report to the CN 2150 the security capabilities of the UE in data processing for XaaS and / or the security capabilities of the UE in data forwarding for XaaS. The CN 2150 may also notify or send to the CU 2148 one or more of the following: the security capabilities of the UE in data processing for XaaS and the security capabilities of the UE in forwarding data for XaaS. If received, the CU 2148 may locally store the security capabilities of the UE in data forwarding for XaaS. If the CU 2148 also receives from the CN 2150 the security capabilities of the UE in XaaS data processing, the CU 2148 may further forward to the XC unit 2146 the security capabilities of the UE in XaaS data processing.

[0488] In some aspects, the UE 2130 may report to the DU the security capabilities of the UE in terms of data processing in XaaS and / or the security capabilities of the UE in terms of data forwarding in XaaS. Then, the DU may forward to the XC unit 2146 the security capabilities of the UE in terms of data processing in XaaS and / or the security capabilities of the UE in terms of data forwarding in XaaS. If received, the XC unit 2146 may locally store the security capabilities of the UE in terms of data processing in XaaS. If the XC unit 2146 also receives the security capabilities of the UE in terms of data forwarding in XaaS, the XC unit 2146 may further forward to the CU 2148 the security capabilities of the UE in terms of data forwarding in XaaS. The XC unit 2146 and / or the CU 2148 may also forward to the CN the security capabilities of the UE in terms of data processing in XaaS and / or the security capabilities of the UE in terms of data forwarding in XaaS.

[0489] In some aspects, the UE 2130 may report to the DU the security capabilities of the UE in terms of data processing in XaaS and / or the security capabilities of the UE in terms of data forwarding in XaaS. Then, the DU may forward to the CU 2148 the security capabilities of the UE in terms of data processing in XaaS and / or the security capabilities of the UE in terms of data forwarding in XaaS. If received, the CU 2148 may locally store the security capabilities of the UE in terms of data forwarding in XaaS. If the CU 2148 also receives the security capabilities of the UE in terms of data processing in XaaS, the CU 2148 may further forward to the XC unit 2146 the security capabilities of the UE in terms of data processing in XaaS. The XC unit 2146 and / or the CU 2148 may also forward to the CN the security capabilities of the UE in terms of data processing in XaaS and / or the security capabilities of the UE in terms of data forwarding in XaaS.

[0490] In some aspects, the UE 2130 may report to the DU the security capabilities of the UE in terms of data processing in XaaS and / or the security capabilities of the UE in terms of data forwarding in XaaS. Then, the DU may forward to the XC unit 2146 and the CU 2148 the security capabilities of the UE in terms of data processing in XaaS and / or the security capabilities of the UE in terms of data forwarding in XaaS. If received, the XC unit 2146 may locally store the security capabilities of the UE in terms of data processing in XaaS. In some aspects, if received, the XC unit 2146 may also forward to the CU 2148 the security capabilities of the UE in terms of data forwarding in XaaS. Similarly, if received, the CU 2148 may locally store the security capabilities of the UE in terms of data forwarding in XaaS. Additionally, if received, the CU 2148 may also forward to the XC unit 2146 the security capabilities of the UE in terms of data processing in XaaS. The XC unit 2146 and / or the CU 2148 may also forward to the CN the security capabilities of the UE in terms of data processing in XaaS and / or the security capabilities of the UE in terms of data forwarding in XaaS.

[0491] In some aspects, the process 2100 may further include the PF unit 2144 reporting or sending its security capabilities 2102 to the XC unit 2146. In some aspects, the security capabilities 2102 may include the security capabilities in terms of data processing in XaaS. The security capabilities 2102 in terms of data processing in XaaS may include one or more of the following: privacy protection algorithms supported by the PF sublayer and the priorities of different algorithms. In some aspects, the security capabilities 2102 may further include the security capabilities of the PF unit in terms of data forwarding. The security capabilities in terms of data forwarding may include one or more of the following: encryption algorithms supported by the PDCP sublayer, integrity protection algorithms of the PDCP sublayer, and the priorities of different encryption algorithms and integrity protection algorithms.

[0492] In some aspects, each PF may be configured via network management with one or more lists of security algorithms for data processing and data forwarding. The one or more lists may include a first set of lists for data processing and a second set of lists for data forwarding. In some aspects, the one or more lists may be sorted according to priorities determined by the operator.

[0493] In some aspects, process 2100 may further include XC unit 2146 reporting or sending the security capabilities 2103 of one or more PF units 2144 to CU 2148. The security capabilities of the XC unit may include security capabilities in the data forwarding of XaaS. The security capabilities in the data forwarding of XaaS may include one or more of the following: encryption algorithms and integrity protection algorithms supported by the PDCP sublayer and the priorities of different encryption algorithms and integrity protection algorithms. The security capabilities 2103 may indicate one or more security capabilities supported at one or more of the following: PF 2144 and XC unit 2146. In some aspects, the security capabilities 2103 may include one or more security capabilities supported at XC unit 2146 and at least one PF 2144 connected to XC 2046 (e.g., overlapping security capabilities between the XC unit and at least one PF).

[0494] Thus, in some aspects, the security capabilities 2103 may be supported at one or more PF units 2144 connected to the XC unit. Alternatively, the security capabilities 2103 may be overlapping security capabilities supported at XC unit 2146 and at least one PF unit among the PF units connected to the XC unit.

[0495] In some aspects, process 2100 may further include CN 2150 sending one or more selected security algorithms to UE 2130, for example, via NAS security mode command message 2104. The one or more selected security algorithms may be used to protect the control plane and / or the user (data) plane of the CN XaaS data between the UE and the CN, e.g., to protect the NAS traffic of XaaS.

[0496] In some aspects, CN 2150 may be configured via network management with one or more lists of security algorithms for data processing and data forwarding. The one or more lists may include a first list for data processing and a second list for data forwarding. The one or more lists may be sorted according to priorities determined by the operator.

[0497] In some aspects, based on the received UE-supported security algorithms (in the registration request message 2101) and the configured CN-supported security algorithms, CN 2150 may select one or more of the following: a suitable security algorithm for data processing and a suitable security algorithm for data forwarding. For example, these algorithms may be overlapping security algorithms supported by the UE and the CN and having a high or the highest priority.

[0498] According to one aspect, when sending a registration request message 2101, the UE may request the establishment or creation of an XaaS PDU session, for example, through an XaaS PUD session establishment request. In some aspects, the XaaS PDU session establishment request may include one or more XaaS QoS parameters (e.g., security level, privacy level) regarding the XaaS service.

[0499] According to one aspect, based on the XaaS QoS parameters and the received UE security capabilities, the CN 2150 may determine the data forwarding disposition and data processing disposition for the XaaS PDU session. For example, based on the XaaS QoS parameters and the UE security capabilities, the CN 2150 may perform one or more of the following: determine the CN security algorithms regarding data processing and data forwarding, and generate security parameters for the CN XaaS traffic.

[0500] In some aspects, the procedure 2100 may include the CN 2150 sending one or more of the following to the CU 2148, for example, through an initial UE context establishment request or an XaaS PDU session establishment request message 2105: the UE supported security capabilities received in the registration request message 2101 and the CN assisted security information. The CN assisted security information may include one or more of the following: the CN assisted information regarding the AS security mode and the CN assisted security parameters.

[0501] In some aspects, the CN assisted information regarding the AS security mode may provide information for the CU and the XC unit to further determine the AS security mode. In some aspects, the assisted security parameters may be used by the CU and / or the XC unit to derive the AS security parameters (e.g., AS security keys) of the PF unit including the PF sublayer and the PDCP sublayer. The CN assisted security parameters may include one or more of the following: the security key Kx, which is used by one or more of the CU, the XC unit, and the PF unit to derive the AS security parameters of the PF sublayer (referred to as the PF sublayer related security key), and the security key Kc, which is used by one or more of the CU, the XC unit, and the PF unit to derive the AS security parameters of the PDCP sublayer (referred to as the PDCP sublayer related security key). In some aspects, Kx and Kc may be the same or different.

[0502] In some aspects, if the configuration of the PDCP sublayer is allocated to the CU, procedure 2100 may further include the CU 2148 selecting (2106) a suitable algorithm for data forwarding on the PDCP sublayer based on one or more of the following: the security capabilities 2103 received from the XC, the UE-supported security capabilities received in the UE context establishment request 2105, and the CN-assisted security information. In some aspects, the CU may select a suitable algorithm for data forwarding on the PDCP sublayer. For example, the algorithm may overlap with the security algorithms supported by the UE and the XC and may have a high or the highest priority.

[0503] In some aspects, the selected security algorithm may be used to protect the PDCP sublayer XaaS data on one or more of the control plane or the user (data) plane between the UE and the PF unit. In some aspects, for example, based on the PDCP sublayer-related security key Kc, the CU 2148 may generate one or more security parameters corresponding to the selected security algorithm (e.g., the encryption key Kpd-u, which can be used for PDCP sublayer data, e.g., for XSB on the CP or XDB on the UP).

[0504] In some aspects, the CU 2148 may also perform one or more of the following: generate CU-assisted information about the AS security mode and assist the XC unit in further determining the AS security mode. In some aspects, there may be one or more rounds of interaction and negotiation between the CU and the XC unit to collaboratively determine the AS security mode.

[0505] In some aspects, the CU 2148 may assist the XC unit 2146 in determining the AS security mode by providing information (e.g., CU-assisted information about the AS security mode), which may include a list of preferred security modes for data forwarding on the PDCP sublayer (e.g., indicating one or more of the following: encryption algorithm and integrity protection algorithm). In some aspects, the CU 2148 may send a list of preferred security modes for the PDCP sublayer to the XC unit 2146, and the XC unit 2146 may select one or more preferred security modes from the list and feedback the selected one or more preferred security modes to the CU. In some aspects, the CU 2148 may also select one or more preferred security modes received from the XC unit and feedback the selected one or more preferred security modes to the XC. The XC 2146 and the CU 2148 may continue the back-and-forth feedback of the selected security modes in one or more rounds to reach a consensus between the CU and the XC.

[0506] In some aspects, process 2100 may further include the CU 2148 sending an XaaS bearer establishment request message 2107 to the XC unit 2146. The XaaS bearer establishment request message 2107 may include one or more of the following: the security capabilities of the UE and the CN-assisted security information received in the UE context establishment request 2105.

[0507] In some aspects, if the configuration of the PDCP sublayer is assigned to the CU 2148, the CU 2148 may also send one or more of the following to the XC 2146 in the XaaS bearer establishment request message 2107 or a different message: selected security algorithms for data forwarding on the PDCP sublayer (e.g., encryption algorithm, integrity protection algorithm), security parameters (e.g., encryption key Kpd-u), and CU-assisted information regarding the AS security mode.

[0508] In some aspects, if or when the CU determines that the PDCP sublayer does not require security protection, one or more of the following may occur: the CU may not send the selected security algorithm to the XC unit, and the CU may send a default value or a null value to the XC unit as the security parameter.

[0509] In some aspects, process 2100 may further include the XC performing (2108) one or more of the following: selecting a PF unit and selecting an AS security mode. In some aspects, the XC 2146 may select a PF unit that has overlapping supported security capabilities with the UE.

[0510] In some aspects, the XC 2146 may select the AS security mode based on one or more of the following: the information received in the XaaS bearer establishment request message 2107 and the information received in the security capabilities 2102. In some aspects, the XC 2146 may further select the AS security mode based on one or more of the following: XaaS QoS requirements, CN-assisted information regarding the AS security mode, CU-assisted information, etc.

[0511] In some aspects, based on the selected AS security mode, the XC unit may select one or more suitable AS security algorithms for the PF unit to perform security protection in one or more of the PF sublayer and the PDCP sublayer. The selection of one or more AS security algorithms may be based on, for example, security algorithms that may overlap with the security algorithms supported by the UE and the PF unit and algorithm priorities. In some aspects, based on the selected AS security mode, the XC unit may also derive one or more AS security parameters (e.g., based on CN-assisted security parameters).

[0512] As described herein, the XC unit can select one or more suitable AS security algorithms corresponding to the selected security mode. For example, the selected security mode can indicate that security protection should not be performed at the PF sublayer and the PDCP sublayer, or that security protection should be performed at one or more of the PF sublayer and the PDCP sublayer. Based on the security mode, the XC unit can select one or more security algorithms associated with the PDCP sublayer and / or the PF sublayer. In some aspects, based on the security mode, for example, when security protection should not be performed at the PDCP sublayer and the PF sublayer, the XC unit can not select security algorithms for the PDCP sublayer and the PF sublayer.

[0513] In some aspects, the XC unit 2146 can derive one or more AS security parameters based on the relevant security keys. For example, the XC unit 2046 can derive, based on the PF sublayer-related security key Kx, an AS security key Kpf-u for PF sublayer security, for example, between the PF unit and the UE. The XC unit 2046 can also derive, based on the PF sublayer-related security key Kx, a security key Kpf-pf for PF sublayer security, for example, between different PF units. The XC unit 2046 can also derive an AS security key Kxc-u for XC sublayer security, for example, between the XC unit and the UE.

[0514] In some aspects, if the configuration of the PDCP sublayer is assigned to the XC unit, the XC unit 2146 can also derive an AS security key Kpd-u for PDCP sublayer security between the UE and the PF unit based on the PDCP sublayer-related security key Kc.

[0515] According to one aspect, the selected security algorithms and the derived security parameters can be used to protect the data on the XDB and XSB (e.g., to protect data privacy).

[0516] In some aspects, the process 2100 can further include the XC unit sending an AS security configuration information message 2109 to the PF 2144. The AS security configuration information message 2109 can include one or more of the following: the selected AS security mode, the selected AS security algorithms, and the AS security parameters (e.g., the AS security keys Kpf-u, Kpf-pf, Kpd-u).

[0517] In some aspects, the XC unit can send a security mode, an AS security algorithm, and CN-assisted security parameters (e.g., the PF sublayer-related security key Kx and the PDCP sublayer-related security key Kc) to the PF, and the PF 2144 can derive (2110) the AS security parameters (e.g., the AS security keys Kpf-u, Kpf-pf, Kpf-u). According to one aspect, based on one or more of the AS security mode, the AS security algorithm, and the AS security parameters, the PF unit 2144 can perform security protection on one or more of the PF sublayer data and the PDCP sublayer data.

[0518] In some aspects, the process 2100 may further include the XC unit 2146 sending an AS security configuration information message 2111 to the UE 2130. The AS security configuration message may include one or more of the following: a selected AS security mode, a selected AS security algorithm, and AS security parameters sent to the UE. The AS security configuration message may be sent between the XC unit and the UE via, for example, an AS security mode command message or another XaaS signaling message on the XSB. The AS security configuration information message may be sent to the UE for the UE to perform security protection between the UE and the PF unit at one or more of the PF sublayer and the PDCP sublayer. In some aspects, for example, when the UE can derive the AS security parameters by itself, the AS security configuration message 2111 may not include the AS security parameters.

[0519] In some aspects, the process 2100 may further include the XC unit 2146 sending an AS security configuration information message 2112 to the CU 2148. The AS security information message may include one or more of the following: a selected AS security mode, a selected AS security algorithm, and AS security parameters (e.g., the AS security keys Kpf-u, Kpf-pf, Kpd-u).

[0520] In some aspects, the process 2100 may further include the CU 2148 sending an AS security configuration message 2110 to the UE 2130. The AS security configuration message 2113 may include one or more of the following: a selected AS security mode, a selected AS security algorithm, and AS security parameters. In some aspects, the AS security configuration message 2013 may be sent between the CU and the UE via, for example, an AS security mode command message or another XaaS signaling message on the SRB for the UE to perform security protection between the UE and the PF unit at one or more of the PF sublayer and the PDCP sublayer. In some aspects, for example, when the UE can derive the AS security parameters by itself, the AS security configuration message 2113 may not include the AS security parameters.

[0521] In some aspects, the operations described with reference to AS security configuration messages 2112 and 2113 can be alternatives to the operations described with reference to AS security configuration message 2111.

[0522] Aspects of the present invention can provide one or more interface designs between network nodes (e.g., CU, DU, PF unit, and XC unit entities) in a split RAN architecture, where the XaaS module is an internal component of the RAN. Some aspects of the present invention can provide an XaaS ID for identifying the XaaS service. Some aspects of the present invention can provide an interface management process, e.g., for XaaS capability alignment between the CU, DU, PF unit, and XC unit. Some aspects of the present invention can provide an enhanced protocol stack design for one or more network nodes (e.g., PF unit, SC unit, CU, and DU) in the XaaS service and their interfaces.

[0523] Some aspects can deploy a plug-and-play XaaS module in a split RAN for future XaaS services. According to one aspect, the units for data forwarding (CU and DU) and the units for data processing (PF unit and XC unit) can be joined to each other. Aspects of the present invention may have a relatively small impact on the current connection-oriented split RAN architecture for data forwarding services.

[0524] Some aspects can enable the UE to discover and access the network to obtain the XaaS service. Correspondingly, aspects of the present invention provide an XaaS ID design and notification to the UE. Other aspects can provide an XaaS session and XaaS bearer establishment process design.

[0525] Some aspects can provide one or more of the following: NAS security mode and AS security mode for data processing and data forwarding. Other aspects can provide a selection of one or more of the following: NAS security mode and AS security mode.

[0526] Some aspects can provide joint security configuration for the PDCP and PF sublayers based on a preconfigured security mode (NAS security mode, AS security mode). Other aspects can provide joint security configuration for the PDCP and PF sublayers based on preconfigured supported security capabilities.

[0527] One or more aspects of the present invention can implement security protection for XDB, XSB, and XaaS NAS traffic in future XaaS services (e.g., data encryption and integrity protection for data forwarding, and data privacy protection for data processing).

[0528] Figure 22Apparatus 2200 provided by different aspects of the present invention can perform any or all of the operations of the above-described methods and features explicitly or implicitly described herein. For example, a computer equipped with network capabilities can be used as apparatus 2200. In some aspects, apparatus 2200 can be an XaaS module, an XC node or unit, a PF, a CU node or unit, a DU node or unit, a network node, a RAN node, a CN function, or any other entity described herein, as appropriate. In some aspects, apparatus 2200 can be a device connected to a network infrastructure through a wireless interface, such as a mobile phone, a smart phone, or other such devices that can be classified as user equipment (UE). In some aspects, apparatus 2200 can be a machine-type communication (MTC) device (also known as a machine-to-machine (M2M) device) or other such devices that can be classified as UE (although not providing direct services to users). In some aspects, apparatus 2200 can be used to implement one or more aspects described herein. In some aspects, apparatus 2200 can be used to perform operations of one or more entities or functions described herein.

[0529] As shown in the figure, apparatus 2200 can include a processor 2210, such as a central processing unit (CPU) or a dedicated processor, such as a graphics processing unit (GPU) or other such processor units, a memory 2220, a non-transitory mass storage 2230, an input-output interface 2240, a network interface 2250, and a transceiver 2260, all of which are communicatively coupled via a bidirectional bus 2270. According to certain aspects, any or all of the described elements can be used, or only a subset of the elements. In addition, apparatus 2200 can include multiple instances of certain elements, such as multiple processors, multiple memories, or multiple transceivers. In addition, the elements of the hardware device can be directly coupled to other elements without a bidirectional bus. In addition to or in place of the processor and the memory, other electronic devices (such as integrated circuits) can be used to perform the required logical operations.

[0530] Memory 2220 can include any type of non-transitory memory, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), read-only memory (ROM), or any combination thereof, etc. Mass storage element 2230 can include any type of non-transitory storage device, such as a solid-state disk, a hard disk drive, a disk drive, an optical disk drive, a USB drive, or any computer program product for storing data and machine-executable program code. According to certain aspects, statements and instructions executable by processor 2210 for performing any of the above method operations can be recorded on memory 2220 or mass storage 2230.

[0531] Aspects of the present invention can be implemented using electronic hardware, software, or a combination thereof. In some aspects, this can be implemented by one or more computer processors executing program instructions stored in a memory. In some aspects, parts or all of the present invention are implemented in hardware, such as using one or more field programmable gate arrays (FPGAs) or application specific integrated circuits (ASICs) to perform processing operations quickly.

[0532] It should be understood that although specific aspects of the technology have been described herein for purposes of illustration, various modifications can be made without departing from the scope of the technology. Accordingly, the specification and drawings are to be regarded only as an illustration of the invention as defined by the appended claims, and are expected to cover any and all modifications, variations, combinations, or equivalents within the scope of the invention. Specifically, a computer program product or program element for storing machine-readable signals, or a program storage or storage device such as magnetic wire, magnetic tape, disk, or optical wire, optical tape, or optical disc, is within the scope of the present technology for controlling the operation of a computer in accordance with the method of the present technology and / or constructing part or all of its components in accordance with the system of the present technology.

[0533] The actions associated with the methods described herein can be implemented as encoded instructions in a computer program product. In other words, the computer program product is a computer-readable medium having software code recorded thereon for performing the methods when the computer program product is loaded into a memory and executed on a microprocessor of the wireless communication device.

[0534] In addition, each operation of the method can be performed on any computing device such as a personal computer, server, PDA, etc., and in accordance with one or more program units, modules, or objects generated from any programming language such as C++, Java, etc., or a part of the one or more program units, modules, or objects. In addition, each operation can be performed by dedicated hardware or a circuit module designed for this purpose, or a file or object implementing each such operation, etc.

[0535] Through the above description of aspects, the present invention can be implemented only by hardware, or can be implemented by software and a necessary general hardware platform. Based on this understanding, the technical solution of the present invention can be embodied in the form of a software product. The software product can be stored in a non-volatile or non-transitory storage medium, and the non-volatile or non-transitory storage medium can be a compact disc read-only memory (CD-ROM), a USB flash drive, or a removable hard disk. The software product includes a number of instructions that enable a computer device (personal computer, server, or network device) to execute the methods provided in the aspects of the present invention. For example, such execution can correspond to the simulation of the logical operations described herein. According to an aspect of the present invention, the software product can additionally or alternatively include a number of instructions that enable a computer device to perform operations for configuring or programming a digital logic device.

[0536] Although the present invention has been described with reference to specific features and aspects of the present invention, it is obvious that various modifications and combinations of the present invention can be made without departing from the present invention. Therefore, the specification and the drawings are only regarded as an illustration of the present invention defined by the appended claims, and it is expected to cover any and all modifications, variations, combinations, or equivalents within the scope of the present invention.

Claims

1. A communication network, characterized in that, Comprising: A radio access network (RAN) having a central unit (CU) and one or more distributed units (DU); One or more service modules deployed between the CU and the one or more DUs, the one or more service modules being configured to provide one or more network services for data processing.

2. The communication network according to claim [0076], wherein: The data processing includes at least one of the following: data analysis, artificial intelligence (AI) training, AI inference, data privacy protection, data collection, data purification, data processing, data management, data cleaning, data normalization, useless data filtering, data feature engineering, data compression, data embedding, data representation learning, and data feature extraction.

3. The communication network according to claim 2, wherein: The one or more service modules are deployed in one or more of the following: the RAN, the core network (CN), and the user equipment (UE).

4. The communication network according to claim 3, wherein: Each service module of the one or more service modules includes: One or more service controller units for controlling the one or more network services, One or more processing function (PF) units for performing one or more tasks associated with the one or more network services; The one or more service controller units are deployed on the control plane; The one or more PF units are deployed on the user plane, data plane, computing plane, or data processing plane; The one or more PF units are configured to perform the data processing under the control of the one or more service controller units; The one or more service controller units are configured to control and configure the one or more PF units for the data processing.

5. The communication network according to claim 1, characterized in that, The one or more DUs are connected to the one or more service modules via a T1 interface.

6. The communication network according to claim 1, wherein: The CU is connected to each service module of the one or more service modules via a T2 interface.

7. The communication network according to claim 4 or 5, wherein: One of the one or more service controller units is connected to the one or more DUs via a T1 interface (T1-C interface) on the control plane.

8. The communication network according to claim 4 or 5, wherein: The one or more PF units are connected to the one or more DUs via a T1 interface (T1-U interface) on the user plane, data plane, computing plane, or data processing plane.

9. The communication network according to claim 4 or 6, wherein: The one or more service controller units are connected to the CU via a T2 interface (T2-C interface) on the control plane.

10. The communication network according to claim 4 or 6, wherein: The one or more PF units are connected to the CU via a T2 interface (T2-U interface) on the user plane, data plane, computing plane, or data processing plane.

11. The communication network according to claim 4, wherein: One PF unit among the one or more PF units is connected to one service controller unit among the one or more service controller units through the T3 interface.

12. The communication network according to claim 4, wherein: One service controller unit among the one or more service controller units is connected to the one or more PF units through the T3 interface.

13. The communication network according to claim 4, wherein: The same service module among the one or more service modules or different PF units among different service modules are interconnected through the T4 interface.

14. The communication network according to claim 4, wherein: The same service module among the one or more service modules or different service controller units among different service modules are interconnected through the T5 interface.

15. The communication network according to claim 4, wherein: One PF unit among the one or more PF units is directly or indirectly connected to the CN function (CNF) through the T6 interface.

16. The communication network according to claim 15, wherein: The one PF unit among the one or more PF units is indirectly connected to the CNF through an intermediate CU through the T6 interface.

17. The communication network according to claim 4, wherein: One service controller unit among the one or more service controller units is directly or indirectly connected to the CN function (CNF) through the T7 interface.

18. The communication network according to claim 17, wherein: The one service controller unit among the one or more service controller units is indirectly connected to the CNF through an intermediate CU through the T7 interface.

19. The communication network according to any one of claims 15 to 18, wherein: The CNF is one of the following: a service module in the CN, a PF unit in the CN, a service controller unit in the CN, and a function for data forwarding; The function for data forwarding is one of the following: a user plane function (UPF), an evolved UPF, or a gateway function.

20. The communication network according to any one of claims 1 to 3, wherein: Different service modules among the one or more service modules are interconnected through the T8 interface.

21. The communication network according to claim 20, wherein: The T8 interface is an integration of the T4 interface and the T5 interface.

22. The communication network according to any one of claims 1 to 21, wherein: The one or more DUs are connected to the CU through the F1 interface.

23. The communication network according to claim 4, wherein: The application layer signaling protocol on the control plane has interfaces T1, T2, T3, T5, T7, and T8, and the application layer signaling protocols are respectively referred to as T1 Application Protocol (T1AP), T2 Application Protocol (T2AP), T3 Application Protocol (T3AP), T5 Application Protocol (T5AP), T7 Application Protocol (T7AP), and T8 Application Protocol (T8AP); The underlying protocol stack of one or more of the T1AP, the T2AP, the T3AP, the T5AP, the T7AP, and the T8AP includes one or more of the following: General Packet Radio Service (GPRS) User Plane Tunneling Protocol (GTP-U), User Datagram Protocol (UDP), Internet Protocol (IP), Quick UDP Internet Connections (QUIC) protocol, Hypertext Transfer Protocol (HTTP), Stream Control Transmission Protocol (SCTP), Segment Routing over IPv6 (SRv6) protocol.

24. The communication network according to claim 4, characterized in that, The underlying protocol stack on the user plane for one or more of the T1 interface, T2 interface, T4 interface, T6 interface, and T8 interface includes one or more of the following: General Packet Radio Service (GPRS) User Plane Tunneling Protocol (GTP-U), User Datagram Protocol (UDP), Internet Protocol (IP), Quick UDP Internet Connections (QUIC) protocol, Hypertext Transfer Protocol (HTTP), Stream Control Transmission Protocol (SCTP), Segment Routing over IPv6 (SRv6) protocol.

25. The communication network according to claim 23 or 24, characterized in that, On the user plane, the data plane, the computing plane, or the data processing plane, above the underlying protocol stack, further includes: The PF sublayer, deployed above the Packet Data Convergence Protocol (PDCP) sublayer at the one or more PF units; The corresponding PF sublayer, deployed at the UE: Above the corresponding PDCP sublayer; or Between the SDAP sublayer and the corresponding PDCP sublayer; The Radio Link Control (RLC) sublayer and the Medium Access Control (MAC) sublayer, deployed at the UE; The Physical (PHY) layer, deployed at the UE; The RLC sublayer and the MAC sublayer, deployed at the one or more DUs; The PHY layer, deployed at the one or more DUs; The corresponding SDAP sublayer, deployed at the CU.

26. The communication network according to claim 23 or 24, characterized in that, On the control plane, above the underlying protocol stack, further includes: The service controller sublayer, deployed above the Packet Data Convergence Protocol (PDCP) sublayer at the one or more service controller units; The corresponding service controller sublayer, deployed at the UE above the PDCP sublayer; The Radio Link Control (RLC) sublayer and the Medium Access Control (MAC) sublayer, deployed at the UE; The Physical (physical, PHY) layer, deployed at the UE; The RLC sublayer and the MAC sublayer, deployed at the one or more DUs; The PHY layer, deployed at the one or more DUs.

27. The communication network according to claim 23 or 24, characterized in that, The one or more PF units are integrated into the CU, and the communication network further includes: On the user plane, data plane, computing plane, or data processing plane, above the underlying protocol stack: The PF sublayer is deployed at the CU: Above the Packet Data Convergence Protocol (PDCP) sublayer, or Between the PDCP sublayer and the Service Data Adaptation Protocol (SDAP) sublayer; The RLC sublayer, MAC sublayer, and PHY layer are deployed at the one or more DUs; At the UE: The PF sublayer: Above the PDCP sublayer, or Between the PDCP sublayer and the SDAP sublayer; The RLC sublayer; The MAC sublayer; The PHY layer.

28. The communication network according to claim 23 or 24, characterized in that, The one or more control units are integrated into the CU. On the control plane, above the underlying protocol stack, the communication network further includes: At the CU: The service controller sublayer is deployed: Above the Packet Data Convergence Protocol (PDCP) sublayer; or Between the PDCP sublayer and the Radio Resource Control (RRC) sublayer; or Above the RRC sublayer; At the one or more DUs: The deployed PHY layer, RLC sublayer, and MAC sublayer; At the UE: The service controller sublayer is deployed: Above the PDCP sublayer; or Between the PDCP sublayer and the RRC sublayer; or Above the RRC sublayer; The RLC sublayer, MAC sublayer, and PHY layer.

29. The communication network according to claim 23 or 24, wherein: The one or more PF units are deployed between the one or more DUs and the CU; The first PF unit among the one or more PF units includes: The PF sublayer: Deployed above the Packet Data Convergence Protocol (PDCP) sublayer; corresponding to the PF sublayer of the UE; The PDCP sublayer, corresponding to the PDCP sublayer of the UE.

30. The communication network according to claim 29, characterized in that, Further included is: The second PF unit among the one or more PF units, deployed between the one or more DUs and the CU, wherein the first PF unit further includes: The second PF sublayer, corresponding to the PF sublayer of the second PF unit, and the second PF sublayer is deployed above the second PDCP sublayer of the first PF unit.

31. The communication network according to claim 24, wherein: The CU is configured to perform at least one of the following: One or more functions of the Packet Data Convergence Protocol (PDCP) sublayer for (de)compression of headers; Sequence numbering of PDCP service data units (SDUs); The one or more PF units are configured to perform one or more functions of the PDCP sublayer for security protection, wherein the one or more functions are related to one or more of the following: integrity protection and encryption.

32. The communication network according to claim 1, wherein: The network service in the one or more network services is identified by a network service identifier (ID); The network service ID includes one or more of the following: Service type ID, Task ID, Task set ID, Network ID; The service type ID identifies the network type of the network service; The task ID identifies the data processing task that the network service is used to execute; The task set ID identifies the task set that the network service is used to execute, and the task set includes one or more tasks in the tasks; The network ID identifies the network that provides the network service.

33. The communication network according to claim 4, characterized in that, It further includes a plurality of network nodes, where: Two network nodes among the plurality of network nodes are used to exchange the capabilities of the two network nodes in terms of the one or more network services; Each of the two network nodes is one of the following: A service module in the one or more service modules, A PF unit in the one or more PF units, A service controller unit in the one or more service controller units, A DU in the one or more DUs, The CU.

34. The communication network according to claim 32, wherein: The two network nodes are used to exchange the capabilities of the two network nodes by causing a first node among the two network nodes to send a first message to a second node among the two network nodes, and the message includes one or more of the following: A node identifier (ID) that identifies the first node, A cell ID that identifies the cell that provides the network service in the one or more network services, A tracking area ID that identifies the tracking area that provides the network service in the one or more network services, A network service ID that identifies the network service, A network ID that identifies the network that provides the network service, where the network ID is one of the following: a public land mobile network (PLMN) ID or a non-public network (NPN) ID.

35. The communication network according to claim 33, wherein: The two network nodes are used to exchange the capabilities of the two network nodes by further causing the second node to send a second message to the first node, and the second message includes one or more of the following: A node ID that identifies the second node, A second cell ID, A second tracking area ID, A second network service ID, A second network ID.

36. The communication network according to claim 34, wherein: One or more of the node ID, the second cell ID, the second network service ID, and the second network ID included in the second message that identify the second node are the same as one or more of the node ID, the cell ID, the network service ID, and the network ID included in the first message.

37. The communication network according to claim 33, wherein: The second node is used to send a failure message to the first node when the second node determines that the capabilities of the second node to provide the network service do not overlap with the capabilities of the first node to provide the network service.

38. The communication network according to claim 33, wherein: A network node among the multiple network nodes sends a message to the UE to identify the one or more network services, and the message includes one or more of the following: a cell identifier (ID), a network service ID, and a network ID; The network ID is one of the following: a public land mobile network (PLMN) ID or a non-public network (NPN) ID.

39. The communication network according to claim 38, wherein, The message is either a unicast message or a multicast / broadcast message.

40. The communication network according to claim 39, characterized in that, The message is a unicast message, and the message is either a dedicated radio resource control (RRC) message or a dedicated signaling message.

41. The communication network according to claim 39, wherein, The message is a multicast / broadcast message, and the message is a system information (SI) message.

42. The communication network according to claim 38, wherein: After receiving the message, the UE selects a network service from the one or more network services for access and sends a second message to the network node; The second message includes one or more of the following: a network service ID associated with the selected network service, a network ID associated with the selected network service, and a cell ID associated with the selected network service; The second message is a dedicated radio resource control (RRC) message or a dedicated signaling message of the network service.

43. The communication network according to any one of claims 25, 27 to 29, wherein: The PF sublayer is used to perform privacy protection on data processing at one or more of the following: the one or more PF units, the UE, and the CU; The PDCP sublayer is used to perform security protection on data forwarding at one or more of the following: the one or more PF units, the one or more service controller units, the CU, and the UE.

44. The communication network according to claim 4, characterized in that, The communication network supports one or more access stratum (AS) security modes, and each AS security mode indicates that security protection and privacy protection will not be performed on the one or more network services on the user plane (UP) and / or the control plane (CP), or security protection and / or privacy protection will be performed on the one or more network services on the user plane (UP) and / or the control plane (CP).

45. The communication network according to claim 44, characterized in that, The one or more AS security modes indicate that: The packet data convergence protocol (PDCP) sublayer (e.g., for encryption and integrity) will perform the security protection on the one or more network services on the UP; or The PF sublayer (e.g., for privacy protection) will perform the privacy protection on the one or more network services on the UP; or The PDCP sublayer will perform the security protection on the one or more network services on the UP, and the PF sublayer will perform the privacy protection on the one or more network services on the UP; or The PDCP sublayer and the PF sublayer will not perform the security protection or the privacy protection on the network services on the UP.

46. The communication network according to claim 44, characterized in that, The one or more AS security modes indicate that: The Packet Data Convergence Protocol (PDCP) sublayer will perform the security protection on the one or more network services on the CP; or The service controller sublayer will perform the privacy protection on the one or more network services on the CP; or The PDCP sublayer will perform the security protection on the one or more network services on the CP, and the service controller sublayer will perform the privacy protection on the network services on the CP; or The PDCP sublayer and the service controller sublayer will not perform the security protection or the privacy protection on the one or more network services on the CP.

47. The communication network according to claim 44, wherein: The one or more AS security mode indications will perform one or more security algorithms based on which the security protection and / or the privacy protection are to be performed; The one or more security algorithms include one or more of the following: Encryption algorithms and integrity algorithms on the Packet Data Convergence Protocol (PDCP) sublayer; Privacy protection algorithms on the PF sublayer; Privacy protection algorithms on the controller sublayer.

48. The communication network according to claim 44, wherein: The one or more supported AS security modes are configured at one or more of the following: the one or more service modules, the one or more PF units, the UE, the CU, the one or more service controller units, and the aggregated RAN node; the aggregated RAN node includes two or more of the following: the one or more service modules, the one or more PF units, the CU, the one or more service controller units, and the one or more DUs.

49. The communication network according to claim 48, wherein: The first network node notifies the second network node of one or more AS security modes supported at the first network node through the AS security mode notification process.

50. The communication network according to claim 49, wherein: The AS security mode notification process includes: the first network node sending a message to the second network node; The message includes one or more of the following: One or more AS security mode IDs, each AS security mode ID identifying the AS security mode supported by the first node, The priority of each supported AS security mode among the supported AS security modes, The corresponding quality of service (QoS) guaranteed by each supported AS security mode among the supported AS security modes for the one or more network services.

51. The communication network according to claim 50, wherein: The first network node is the UE; The second network node is one of the following: a service module among the one or more service modules, the CU, a service controller unit among the one or more service controller units, the integrated RAN node, and the CN function (CNF); The first network node sending a message to the second network node includes: the UE sending a report to the second network node, the report indicating one or more supported AS security modes of the UE.

52. The communication network according to claim 51, characterized in that, The AS security mode notification process further includes: after receiving the report from the UE, the second network node selecting an AS security mode for the UE and sending an AS security configuration to the UE; The AS security configuration includes one or more of the following: the selected AS security mode and AS security parameters; Wherein, the AS security configuration is sent to the UE through one or more of the following: a dedicated radio resource control (RRC) message, a dedicated signaling message for the one or more network services, and a non-access stratum (NAS) message.

53. The communication network according to claim 52, characterized in that, The dedicated RRC message is an AS security mode command message.

54. The communication network according to claim 53, characterized in that, The AS security mode notification process further includes: based on the AS security configuration, on the UP, the UE performing one or more of the following: Performing uplink encryption on a packet data convergence protocol (PDCP) sublayer for securing data forwarding; Performing downlink decryption on the PDCP sublayer for securing data forwarding; Performing uplink encryption on a PF sublayer for protecting data processing privacy; Performing downlink decryption on the PF sublayer for protecting data processing privacy.

55. The communication network according to claim 53 or 54, characterized in that, The AS security mode notification process further includes: based on the AS security configuration, on the CP, the UE performing one or more of the following: Performing uplink encryption on a packet data convergence protocol (PDCP) sublayer for security protection; Performing downlink decryption on the PDCP sublayer for security protection; Performing uplink encryption on a service controller sublayer for privacy protection; Performing downlink decryption on the service controller sublayer for privacy protection.

56. The communication network according to claim 53 or 54, characterized in that, The AS security mode notification process further includes: based on the AS security configuration, on the UP, the second network node performing one or more of the following: Performing downlink encryption on a packet data convergence protocol (PDCP) sublayer for securing data forwarding; Performing uplink decryption on the PDCP sublayer for securing data forwarding; Performing downlink encryption on a PF sublayer for protecting data processing privacy; Performing uplink decryption on the PF sublayer for protecting data processing privacy.

57. The communication network according to claim 53 or 54, characterized in that, The AS security mode notification process further includes: based on the AS security configuration, on the CP, the second network node performing one or more of the following: Performing downlink encryption on a packet data convergence protocol (PDCP) sublayer for security protection; Performing uplink decryption on the PDCP sublayer for security protection; Performing downlink encryption on a service controller sublayer for privacy protection; Performing uplink decryption on the service controller sublayer for privacy protection.

58. The communication network according to any one of claims 53 to 57, characterized in that, The AS security mode notification process further includes: based on the selected AS security mode, the RAN performs one or more of the following: Perform downlink encryption on one or more of the following: The packet data convergence protocol (PDCP) sublayer for data forwarding, associated with the service data bearer (XDB) on the serving UP; The PF sublayer, associated with the XDB on the serving UP; Perform uplink decryption on one or more of the following: The PDCP sublayer for data forwarding, associated with the XDB on the serving UP; The PF sublayer, associated with the XDB on the serving UP; Perform downlink encryption on one or more of the following: The PDCP sublayer, associated with the service signaling bearer (XSB) on the serving CP; The service controller sublayer, associated with the XSB on the serving CP; Perform uplink decryption on one or more of the following: The PDCP sublayer, associated with the XSB on the serving CP; The service controller sublayer, associated with the XSB on the serving CP.

59. The communication network according to claim 50, wherein: The first network node is one or more PF units, and the second network node is the service controller unit of one or more service controllers; Each PF unit among the one or more PF units sends a message to the service controller unit.

60. The communication network according to claim 52, wherein: The second network node is the service controller unit among the one or more service controller units; The service controller unit selects a PF unit among the one or more PF units to serve the UE; The selected PF unit supports one or more AS security modes that overlap with the one or more AS security modes supported by the UE; The service controller unit selects an AS security mode supported by one or more of the following: the UE, the selected PF unit, and the service controller.

61. The communication network according to claim 60, wherein: The service controller unit sends the AS security configuration corresponding to the AS security configuration of the UE to the PF unit.

62. The communication network according to claim 61, wherein Based on the AS security configuration received from the service controller unit, the selected PF unit performs one or more of the following: On the user plane (UP), perform downlink encryption on one or more of the following: the packet data convergence protocol (PDCP) sublayer and the PF sublayer; On the UP, perform uplink decryption on one or more of the following: the PDCP sublayer and the PF sublayer; On the control plane (CP), perform downlink encryption on one or more of the following: the PDCP sublayer and the service controller sublayer; On the control plane (CP), perform uplink decryption on one or more of the following: the PDCP sublayer and the service controller sublayer.

63. The communication network according to any one of claims 4, 7 to 19, 24, 26, 28, 31, 37 to 42, 44, 46, 48 to 53, 55, 57, 59 to 61 and 62, characterized in that: The data bearer for the one or more network services is established between the UE and the service module among the one or more service modules on the RAN.

64. The communication network according to claim 63, characterized in that: The data bearer for the one or more network services is established between the PF protocol layer on the UE side of the service module among the one or more service modules and the PF protocol layer on the PF unit side; The PF protocol layer on the UE side and the PF protocol layer on the PF unit side belong to the data bearer.

65. The communication network according to any one of claims 4, 7 to 19, 23 to 25, 29 to 31, 33 to 35, 37 to 45, 48 to 54, 59 to 61, 63 and 64, characterized in that: The instruction bearer for the one or more network services is established between the UE and the service module among the one or more service modules on the RAN.

66. The communication network according to claim 65, characterized in that: The signaling bearer for the one or more network services is established between the service controller protocol layer on the UE side of the service module and the service controller protocol layer on the service controller unit side; The service controller protocol layer on the UE side and the service controller protocol layer on the service controller unit side belong to the signaling bearer.

67. The communication network according to any one of claims 63 to 66, characterized in that: Security protection for data forwarding and / or privacy protection for data processing is performed on one or more of the following: the data bearer for the one or more network services and the signaling bearer for the one or more network services.

68. The communication network according to claim 48, characterized in that: After receiving the second message, the network node establishes one or more of the following for the selected network service: a data bearer and a signaling bearer; The network node sends bearer configuration information to the UE.

69. The communication network according to claim 68, characterized in that: The bearer configuration information includes AS security configuration; The AS security configuration includes one or more of the following: a selected AS security mode and AS security parameters.

70. The communication network according to any one of claims 1 to 64, characterized in that, The service module among the one or more service modules is directly or connected to the CN function (CNF) through the CU.

71. The communication network according to claim 4, wherein, One or more sessions are also established on the user plane to provide the one or more network services to the UE, and the one or more sessions involve one or more of the following: one or more service modules on the RAN side, one or more service modules on the CN side, the one or more DUs, one or more CUs, one or more PF units on the RAN side, one or more PF units on the CN side, and the UE.

72. The communication network according to claim 71, wherein: The one or more sessions include one or more QoS flows in the quality of service (QoS) flows of the one or more network services, and a single QoS flow in the one or more QoS flows is the finest granularity for QoS differentiation in the session; Traffic in the same QoS flow among the one or more QoS flows receives the same data forwarding handling and data processing handling.

73. The communication network according to claim 71 or 72, wherein: The one or more QoS flows are mapped by a service data adaptation protocol sublayer to one or more data bearers of the one or more network services.

74. The communication network according to any one of claims 71 to 73, wherein: The UE sends a request message to the communication network to establish the one or more sessions; The request message includes one or more of the following: session identifier (ID), QoS flow ID, QoS requirement, network service ID, network ID, UE ID, and UE group ID.

Images