Terminal, network node device, and communication method

Abstract

A terminal is provided with: a control unit that, for a network node device that processes mobility control or connection control, hides a first message relating to authentication control or service provision control and performs integrity protection; and a transmission unit that includes the first message on which the concealment and integrity protection have been performed in a second message relating to movement control or connection control, and transmits the second message to a network.

Description

TECHNICAL FIELD

[0001] The present application relates to a terminal, a network node device, and a communication method in a wireless communication system. BACKGROUND

[0002] In the 3GPP (registered trademark) (3rd Generation Partnership Project: 3rd Generation Partnership Project), in order to realize further large capacity of system capacity, further high speed of data transmission speed, further low delay in a wireless section, and the like, a wireless communication system called 5G or NR (New Radio: New Radio) is introduced (hereinafter, this wireless communication system is referred to as "5G" or "NR"). In 5G, in order to satisfy the requirement conditions of realizing a throughput of 10 Gbps or more and making the delay in the wireless section 1 ms or less, various wireless technologies are researched.

[0003] In NR, a network architecture including 5GC (5G Core Network: 5G Core Network) corresponding to EPC (Evolved Packet Core: Evolved Packet Core) which is a core network in a network architecture of LTE (Long Term Evolution: Long Term Evolution) and NG-RAN (Next Generation - Radio Access Network: Next Generation - Radio Access Network) corresponding to E-UTRAN (Evolved Universal Terrestrial Radio Access Network: Evolved Universal Terrestrial Radio Access Network) which is a RAN (Radio Access Network: Radio Access Network) in a network architecture of LTE is introduced (for example, Non-Patent Literature 1).

[0004] Prior Art Documents

[0005] Non-Patent Literature

[0006] Non-Patent Literature 1: 3GPP TS 23.501 V18.0.0 (2022-12) SUMMARY

[0007] Problems to be Solved by the Invention

[0008] A terminal that joins a certain home operator (HPLMN: Home Public Land Mobile Networks: home public land mobile network) is referred to as a VPLMN (Visited PLMN: visited PLMN) of an operator that the terminal camps at a destination where the terminal roams. In the related art, an architecture of a mobile communication system is constituted on the premise that "HPLMN trusts VPLMN".

[0009] On the other hand, in a future mobile communication system (for example, 6G), it is possible to premise "HPLMN does not trust VPLMN". However, in the related art, there is no mobile communication system that premises "HPLMN does not trust VPLMN".

[0010] The present application was made in view of the above problems, and an object thereof is to provide a technology in which a terminal can securely communicate while roaming even in a case where HPLMN does not trust VPLMN.

[0011] Means for solving the problem

[0012] According to the disclosed technology, a terminal is provided, which has:

[0013] a control section that, with respect to a network node device that handles mobility control or connection control, performs concealment and integrity protection on a first message related to authentication control or service provision control; and

[0014] a transmission section that transmits the first message on which concealment and integrity protection have been performed to the network in a second message related to mobility control or connection control.

[0015] Effects of the invention

[0016] According to the disclosed technology, a technology in which a terminal can securely communicate while roaming even in a case where HPLMN does not trust VPLMN is provided. BRIEF DESCRIPTION OF DRAWINGS

[0017] Figure 1 is a diagram for explaining an example of a communication system.

[0018] Figure 2 is a diagram for explaining an example of a communication system in a roaming environment.

[0019] Figure 3 is a diagram for explaining an example of a communication system.

[0020] Figure 4 is a diagram showing an example of a user plane protocol stack.

[0021] Figure 5is a diagram showing communication between the terminal 20 and the hUPF 90 using a UPF SP.

[0022] Figure 6 is a diagram for explaining an initial registration procedure at the time of roaming.

[0023] Figure 7 is a diagram for explaining an initial registration procedure at the time of roaming.

[0024] Figure 8 is a diagram for explaining an initial registration procedure at the time of roaming.

[0025] Figure 9 is a diagram for explaining an initial registration procedure at the time of roaming.

[0026] Figure 10 is a diagram for explaining an initial registration procedure at the time of roaming.

[0027] Figure 11 is a diagram for explaining an initial registration procedure at the time of roaming.

[0028] Figure 12 is a diagram for explaining an initial registration procedure at the time of roaming.

[0029] Figure 13 is a diagram for explaining an initial registration procedure at the time of roaming.

[0030] Figure 14 is a diagram for explaining a mobile registration procedure at the time of roaming.

[0031] Figure 15 is a diagram for explaining a mobile registration procedure at the time of roaming.

[0032] Figure 16 is a diagram for explaining a mobile registration procedure at the time of roaming.

[0033] Figure 17 is a diagram for explaining a PDU session establishment procedure at the time of roaming.

[0034] Figure 18 is a diagram for explaining a PDU session establishment procedure at the time of roaming.

[0035] Figure 19 is a diagram for explaining a PDU session establishment procedure at the time of roaming.

[0036] Figure 20 is a diagram for explaining a terminal initiated service request procedure at the time of roaming.

[0037] Figure 21 is a diagram for explaining a terminal initiated service request procedure at the time of roaming.

[0038] Figure 22FIG. 1 is a diagram for explaining a terminal start service request procedure at the time of roaming.

[0039] Figure 23 FIG. 4 is a diagram for explaining UL data transmission using a PDU session at the time of roaming.

[0040] Figure 24 FIG. 5 is a diagram for explaining DL data transmission using a PDU session at the time of roaming.

[0041] Figure 25 FIG. 6 is a diagram for explaining a PDU session establishment procedure at the time of roaming.

[0042] Figure 26 FIG. 7 is a diagram for explaining a PDU session establishment procedure at the time of roaming.

[0043] Figure 27 FIG. 8 is a diagram for explaining a PDU session establishment procedure at the time of roaming.

[0044] Figure 28 FIG. 9 is a diagram for explaining a case of NEF-based non-IP data transfer.

[0045] Figure 29 FIG. 10 is a diagram for explaining NEF-based non-IP data transfer (terminal-originated).

[0046] Figure 30 FIG. 11 is a diagram for explaining NEF-based non-IP data transfer (terminal-terminated).

[0047] Figure 31 FIG. 12 is a diagram showing an example of a functional structure of a network node apparatus 5 according to an embodiment of the present application.

[0048] Figure 32 FIG. 13 is a diagram showing an example of a functional structure of a terminal 20 according to an embodiment of the present application.

[0049] Figure 33 FIG. 14 is a diagram showing an example of a hardware structure of an apparatus according to an embodiment of the present application.

[0050] Figure 34 FIG. 15 is a diagram showing an example of a structure of a vehicle according to an embodiment of the present application. DETAILED DESCRIPTION

[0051] Hereinafter, an embodiment of the present application will be described with reference to the accompanying drawings. Note that the following embodiment is merely an example, and the embodiment to which the present application is applied is not limited to the following embodiment.

[0052] In the operation of the wireless communication system according to the embodiment of the present application, a conventional technology is appropriately used. The conventional technology is, for example, the existing LTE or the existing NR (5G), but is not limited to the existing LTE or the existing NR.

[0053] In addition, the names of messages used in the following description are examples. For example, in the case where "h" or "H" indicating HPLMN or "v" or "V" indicating VPLMN is added to the name of a message, the name of the message from which the character ("h", "H", "v", or "V") is deleted can be used instead of the name of the message. In addition, the name of the message in which the character ("h", "H", "v", or "V") is replaced with another character can be used instead of the name of the message.

[0054] In addition, the names of network node apparatuses used in the following description are examples. For example, in the case where "h" or "H" indicating HPLMN or "v" or "V" indicating VPLMN is added to the name of a network node apparatus, the name of the network node apparatus from which the character ("h", "H", "v", or "V") is deleted can be used instead of the name of the network node apparatus. In addition, the name of the network node apparatus in which the character ("h", "H", "v", or "V") is replaced with another character can be used instead of the name of the network node apparatus.

[0055] (System configuration example)

[0056] Figure 1 is a diagram for explaining an example of a communication system. As shown in Figure 1 , the communication system is configured of a UE which is a terminal 20 and a plurality of network node apparatuses. Hereinafter, it is assumed that one network node apparatus corresponds to each function, but a plurality of functions can be implemented by one network node apparatus, and one function can be implemented by a plurality of network node apparatuses. In addition, "connection" described below can be logical connection or physical connection.

[0057] A RAN (Radio Access Network) is a network node device having a radio access function, and can include a base station, and is connected to a UE, an AMF (Access and Mobility Management Function), and a UPF (User plane function). The AMF is a network node device having a function of a termination of a RAN interface, a termination of a NAS (Non-Access Stratum), a registration management, a connection management, a reachability management, a mobility management, and the like. The UPF is a network node device having a function of a PDU (Protocol Data Unit) session point for an external, a packet routing and forwarding, a QoS (Quality of Service) processing of a user plane, and the like, which are connected to a DN (Data Network). The UPF and the DN constitute a network slice. In the wireless communication network of the embodiment of the present disclosure, a plurality of network slices are constructed.

[0058] The AMF is connected to a UE, a RAN, an SMF (Session Management function), an NSSF (Network Slice Selection Function), an NEF (Network Exposure Function), an NRF (Network Repository Function), a UDM (Unified Data Management), a UDR (Unified Data Repository), an AUSF (Authentication Server Function), a PCF (Policy Control Function), and an AF (Application Function). The AMF, the SMF, the NSSF, the NEF, the NRF, the UDM, the UDR, the AUSF, the PCF, and the AF are network node devices connected to each other via interfaces, that is, Namf, Nsmf, Nnssf, Nnef, Nnrf, Nudm, Nudr, Nausf, Npcf, and Naf based on respective services.

[0059] The SMF is a network node device having functions of session management, IP (Internet Protocol) address allocation and management of a UE, DHCP (Dynamic Host Configuration Protocol) function, ARP (Address Resolution Protocol) proxy, roaming function, and the like. The NEF is a network node device having a function of notifying capabilities and events to other NFs (Network Functions). The NSSF is a network node device having functions of selecting a network slice to which a UE is connected, deciding an allowed NSSAI (Network Slice Selection Assistance Information), deciding a set NSSAI, deciding a set of AMFs to which the UE is connected, and the like. The PCF is a network node device having a function of performing policy control of a network. The AF is a network node device having a function of controlling an application server. The NRF is a network node device having a function of discovering NF instances that provide services. The UDM is a network node device that manages subscriber data, authentication data, and the like. In the UDM, dynamic information corresponding to a connection status of the terminal 20 and the like is also stored (managed). The UDM is connected with a UDR (User Data Repository) that holds data.

[0060] Figure 2 is a diagram for explaining an example of a communication system in a roaming environment. In addition, Figure 2 shows an example of a structure in a conventional roaming environment. As shown in Figure 2 , the network is composed of a UE that is a terminal 20, and a plurality of network node devices.

[0061] The RAN is a network node device having a radio access function, and is connected with the UE, the AMF, and the UPF. The AMF is a network node device having functions of termination of a RAN interface, termination of NAS, registration management, connection management, reachability management, mobility management, and the like. The UPF is a network node device having functions of a PDU session point for an external that is mutually connected with a DN, routing and forwarding of packets, user plane QoS processing, and the like. The UPF and the DN constitute a network slice. In the wireless communication network of the present embodiment, a plurality of network slices are constructed.

[0062] The AMF is connected to the UE, RAN, SMF, NSSF, NEF, NRF, UDM, AUSF, PCF, AF, and SEPP (Security Edge Protection Proxy). The AMF, SMF, NSSF, NEF, NRF, UDM, AUSF, PCF, and AF are network node devices interconnected via their respective service-based interfaces: Namf, Nsmf, Nnssf, Nnef, Nnrf, Nudm, Nausf, Npcf, and Naf.

[0063] SMF is a network node device with functions such as session management, UE IP address allocation and management, DHCP function, ARP proxy, roaming function, etc. NEF is a network node device with the function of notifying other NFs of capabilities and events. NSSF is a network node device with functions such as selecting the network slice to which the UE is connected, determining the allowed NSSAI, determining the set NSSAI, and determining the AMF set to which the UE is connected. PCF is a network node device with the function of performing network policy control. AF is a network node device with the function of controlling application servers. NRF is a network node device with the function of discovering NF instances that provide services. SEPP is a non-transparent proxy used to filter control plane messages between PLMNs (Public Land Mobile Network). Figure 2 The vSEPP shown is the SEPP in the visited network, and the hSEPP is the SEPP in the home network.

[0064] like Figure 2 As shown, the UE is in a roaming environment in a VPLMN (Visited PLMN), connected to the RAN and AMF. The VPLMN and HPLMN (Home PLMN) are connected via vSEPP and hSEPP. The UE can communicate with the UDM of the HPLMN via the AMF of the VPLMN, for example.

[0065] The following describes the first and second embodiments. The second embodiment is based on the first embodiment, with some changes to the structure and operation of the first embodiment. However, the technology involved in the second embodiment can also be implemented independently of the first embodiment.

[0066] (Problems of the First Embodiment)

[0067] A terminal 20 that joins a certain home operator (HPLMN: Home Public Land Mobile Networks: home public land mobile network) is referred to as a VPLMN (Visited PLMN: visited PLMN) at an operator that the terminal 20 camps on at a destination to which the terminal 20 roams.

[0068] The architecture of a mobile communication system before 5GS is constituted on the premise that a threat (eavesdropping or impersonation, etc.) is outside the cooperation of PLMNs, that is, "HPLMN trusts VPLMN".

[0069] For example, the VPLMN AMF obtains the SUPI (Subscription Permanent Identifier) of the terminal 20 from the HPLMN AUSF after authentication of the terminal, and in addition, the VPLMN AMF obtains the subscriber information of the terminal 20 from the HPLMN UDM. Since NAS security is terminated at the VPLMN AMF, the VPLMN AMF can see all messages between the terminal 20 and the HPLMN NF.

[0070] In the discussion of 5GS, the idea of "HPLMN does not trust VPLMN" has emerged from the middle of the way. In 5GS, with regard to messages of SOR (Steering of Roaming) and UPU (UE Parameters Update) that the HPLMN sends to the terminal 20 via the VPLMN, there is a concern about rewriting of the contents in the VPLMN, and integrity protection is performed. However, a VPLMN AMF with malice can accumulate the communication preferences or communication history of a terminal 20 with a certain SUPI by monitoring the contents and subscriber information of all messages related to the terminal 20 with the SUPI, or provide inappropriate services by operating messages other than (SOR or UPU). That is, 5GS has not yet formed a suitable architecture in the case of "HPLMN does not trust VPLMN".

[0071] In future mobile communication systems (for example, 6G), it can also be necessary to design an architecture on the premise of "HPLMN does not trust VPLMN". However, there is no such architecture in the current prior art.

[0072] Hereinafter, a system structure and an operation for solving the above problem will be described.

[0073] (System structure example of the present embodiment)

[0074] In the present embodiment, a situation in which the terminal 20 roams to a certain PLMN (VPLMN) is assumed. Figure 3 An example of a system structure (device group included in the system) in this situation is shown.Figure 3 This is common to the first and second embodiments.

[0075] like Figure 3 As shown, the VPLMN includes a terminal 20, RAN 10, vAMF 30, vSMF 40, vUPF 50, and vUDM 60, and the HPLMN includes hAMF 70, hSMF 80, hUPF 90, AUSF 100, hUDM 110, and NEF 120. The operation of each device will be described in the sequence diagrams and the like described later.

[0076] (Overview of the First Embodiment)

[0077] In this embodiment, in order to solve the above-mentioned problems, the following functions are introduced from the control plane viewpoint and the user plane viewpoint.

[0078] <Control Surface View>

[0079] A mechanism is introduced to enable anonymous processing in the VPLMN by concealing and integrity-protecting messages related to authentication or service provision between the terminal 20 and the HPLMN. Specifically, the following mechanisms are introduced regarding (1) the AMF and (2) the SMF.

[0080] (1) AMF

[0081] The AMF is divided into the vAMF 30 arranged in the VPLMN and the hAMF arranged in the HPLMN.

[0082] (1-1)vAMF30

[0083] vAMF30 has the following functions.

[0084] vNAS security is terminated.

[0085] · Based on the request from the HPLMN, anonymous processing objects are processed.

[0086] · Carry out home network registration control.

[0087] Performs connection control including location registration and paging, as well as HO control.

[0088] Regarding a series of processes related to NAS, the following process 1 and process 2 are executed.

[0089] Process 1: Receive the message sent by the VPLMN NF to the HPLMN NF and forward it to the hAMF70.

[0090] Process 2: Receive a message sent from the hAMF 70 to the VPLMN NF by the HPLMN NF, and distribute it to the VPLMN NF.

[0091] (1-2) hAMF 70

[0092] The hAMF 70 has the following functions.

[0093] • hNAS security termination.

[0094] • Possess a SEAF (Security Anchor Function) and perform authentication, and perform processing aware of SUPI.

[0095] • Perform home network registration control.

[0096] • Process service provision control based on subscriber information.

[0097] In addition, regarding service provision control, in addition to the control performed by the hAMF 70, the hAMF 70 relays messages related to control performed by an SMF or an SMSF (Short Message Service Function) in the HPLMN.

[0098] • Regarding a series of procedures related to NAS, perform the following Process 1 and Process 2.

[0099] Process 1: Receive a message sent from the HPLMN NF to the VPLMN NF, and forward it to the vAMF 30.

[0100] Process 2: Receive a message sent from the VPLMN NF to the HPLMN NF from the vAMF 30, and distribute it to the HPLMN NF.

[0101] (2) SMF

[0102] Regarding the SMF, the functions of the vSMF 40 provided in the VPLMN and the hSMF provided in the HPLMN have changed from the past.

[0103] (2-1) vSMF 40

[0104] The vSMF 40 has the following functions.

[0105] • Indicate a data relay path setting of a PDU session to the vUPF 50 based on an instruction from the hSMF 80. Further, in the related art, conversely, the vSMF 40 instructs the hSMF 80.

[0106] • Process the anonymous processing target. That is, process without grasping the SUPI of the processing target. Further, in the related art, the vSMF 40 grasps the SUPI.

[0107] (2-2) hSMF 80

[0108] The hSMF 80 has the following functions.

[0109] • Terminate the PDU session establishment request transmitted by the terminal 20. In addition, in the related art, the vSMF 40 terminates the PDU session establishment request.

[0110] • Indicate the data path setting of the PDU session to the hUPF 90. Indication is also made to the vSMF 40. Further, in the related art, the indication is made in the opposite direction from the vSMF 40 to the hSMF 80.

[0111] <From the viewpoint of the user plane>

[0112] Anonymity and integrity protection between the terminal 20 and the HPLMN UPF are introduced in the user plane. Details are as described below.

[0113] • The hSMF 80 controls the establishment of the communication path that is anonymized and integrity protected.

[0114] • The terminal 20 and the hUPF 90 each have a UPFSP (= UPF security protocol layer) on the SDAP (Service Data Adaptation Protocol) in the user plane protocol stack. In the terminal 20 and the hUPF 90, the actions related to the SDAP and the UPFSP are as described below, respectively.

[0115] The UPFSP performs integrity protection and encryption for each packet of the QoS flow, in addition to the 5tuple (five tuple), and delivers it to the SDAP. In addition, the "5tuple = originating / destination IP address, transport protocol type, originating / destination port number". The UPFSP decrypts and verifies the integrity of the packet obtained from the SDAP and returns it to the QoS flow.

[0116] Figure 4 An example of the user plane protocol stack of the terminal 20 and the hUPF 90 is shown. In addition, in the hUPF 90, the protocol layer below the UPFSP can not be the SDAP. Figure 5 A schematic diagram showing the anonymized and integrity protected communication using the UPFSP between the terminal 20 and the hUPF 90 is shown.

[0117] The following describes actions that are essential to the use of the above-described functions, and then describes detailed process examples. In the first embodiment, the actions essential to the use of the functions are Actions 1 to 3 described below.

[0118] (Action 1: Action related to hNAS concealment and integrity protection)

[0119] <terminal 20>

[0120] In Action 1, the terminal 20 distinguishes the core network-facing messages into messages related to authentication control or service provision control (= hNAS) and messages related to mobile control or connection control (= vNAS), performs concealment and integrity protection on the former messages (= hNAS) for the network node of the core network that handles mobile control or connection control (= vAMF 30), and transmits them to the network in the latter messages (= vNAS).

[0121] <hamf70>

[0122] In Action 1, the hAMF 70 performs confidentiality and integrity protection of the terminal 20-oriented message related to authentication control or service provision control, and sends it to the terminal 20 via the network node (= vAMF 30) of the core network handling the mobility control or the connection control. The vAMF 30 is in the VPLMN, and the vAMF 30 is in the HPLMN.

[0123] <vamf30>

[0124] In Action 1, the vAMF 30 receives a message related to mobility control or connection control from the terminal 20, determines the necessity of reauthentication based on a key set identifier (= ngKSI) contained therein, and forwards the message to a network node of a core network that handles authentication control or service provision control (= hAMF 70) in the case where reauthentication is necessary.

[0125] (Action 2: Action related to SUPI non-disclosure)

[0126] <vamf30>

[0127] In Action 2, the vAMF 30 performs the process of mobility control or connection control using an identifier (=vAMF to hAMF UE ID) that cooperates with the terminal context within the network node (=hAMF 70) of the core network that handles the authentication control or the service provision control, without using the permanent identifier (=SUPI) of the terminal 20.

[0128] <vsmf40>

[0129] In Action 2, the vSMF 40 receives an instruction from a network node (= hSMF 80) of a core network that decides establishment of a PDU session, performs a process of mobile control or connection control, considering subscriber information from the terminal 20, using a terminal temporary identifier (= 5G-VGUTI) allocated in association with the above-described collaboration identifier (= vAMF to hAMF UE ID) and an identifier of a PDU session (= PDU session ID) allocated by the terminal 20, without using a permanent identifier (= SUPI) of the terminal 20 to identify the object PDU session, and sets a data relay path related to the PDU session. The hSMF 80 is located in the HPLMN, and the vSMF 40 is located in the VPLMN.

[0130] (Action 3: Action related to concealment and integrity protection between terminal and UPF)

[0131] <hsmf80>

[0132] In Action 3, the hSMF 80 receives the terminal security capabilities and keys from the network node (= hAMF 70) of the core network that handles authentication control or service provision control, selects a security algorithm to be used, derives a confidentiality key and an integrity protection key, sends the selected security algorithm, the two keys to the hUPF 90, sends the selected security algorithm to the terminal 20, and establishes a secure communication path between the terminal 20 and the hUPF 90,

[0133] <terminal 20>

[0134] As for the terminal UPF-to-UPF confidentiality and integrity protection, the essential actions of the terminal 20 are the actions described above as "user plane perspective".

[0135] (Example of processing procedure of the first embodiment)

[0136] Hereinafter, an example of a processing procedure performed in the communication system of the first embodiment will be described with reference to the drawings. As for the procedures of the first embodiment (and the second embodiment), messages / procedures of existing specifications already disclosed before the application are partly used. The names of the existing specifications are shown in parentheses.

[0137] In addition, as for the step numbers of the procedures below, from the viewpoint of easy understanding, each relatively complete procedure starts from S1 (Step 1). For example, the initial registration procedure at the time of roaming starts from S1 and ends at S59, and then, the mobile registration procedure at the time of roaming starts from S1.

[0138] (initial registration procedure at the time of roaming)

[0139] First, the initial registration procedure at the time of roaming will be described.

[0140] <s1>

[0141] In Figure 6 In S1, the terminal 20 decides to send a registration request to the vAMF 30 using the mechanism of initial NAS message protection (TS 23.502, 4.2.2.2.2, step 1) (TS 33.501, 6.4.6 step 1).

[0142] This registration request message is in clear and only includes the SUCI (Subscription Concealed Identifier), the terminal security capabilities, the ngKSI (Key Set Identifier in 5G). The value of this ngKSI is here "no key available".

[0143] In the following, this registration request message is called "registration request (initial NAS part)". This registration request message is a vNAS (= NAS message that is terminated in the vAMF 30).

[0144] <S2~S5>

[0145] In S2, the terminal 20 sends an RRCSetupRequest to the RAN 10 (TS 38.331, 5.3.3.1). In S3, the RAN 10 sends an RRCSetup to the terminal 20 (TS 38.331, 5.3.3.1).

[0146] In S4, the terminal 20 sends an RRCSetupComplete to the RAN 10 (TS 38.331, 5.3.3.1). This RRCSetupComplete message contains the registration request (initial NAS part).

[0147] In S5, the RAN 10 sends an NGAP Initial UE message to the vAMF 30 (TS 38.413, 8.6.1.2). This NGAP Initial UE message includes the registration request (initial NAS part).

[0148] <s6>

[0149] In S6, the vAMF 30 decides on the PLMN to which the registration request (initial NAS part) shall be forwarded based on the home network identifier (= MCC + MNC) within the SUCI (TS 23.003, 2.2B). In addition, the vAMF 30 discovers and selects the destination hAMF 70 based on local information or information retrieved via the NRF.

[0150] <s7>

[0151] In S7, the vAMF 30 allocates a "vAMF to hAMF UE ID" to the hAMF 70. This ID is an ID allocated by the vAMF 30, and is an ID used by the vAMF 30 to identify the terminal 20 within the hAMF 70 through an SBI (Service Based Interface).

[0152] <s8>

[0153] In S8, the vAMF 30 transmits Nhamf_Communication_CreateUEContext to the hAMF 70. This message includes the registration request (initial NAS part) and "vAMF to hAMF UE ID". In addition, in the above message, in order to distinguish the vAMF 30 and the hAMF 70, it is written as Nhamf instead of Namf.

[0154] <S9, S10>

[0155] In S9, the hAMF 70 allocates 5G-GUTI (5G Global Unique Temporary Identifier) to the terminal 20. In S10, the hAMF 70 generates 5G-GUTI and the terminal context related to SUCI.

[0156] [Authentication procedure part: S11 ~ S26]

[0157] Next, the authentication procedure part is explained as S11 ~ S26. In the following procedure, in the case where the SEAF included in the hAMF 70 is involved in the processing, it is written as "hAMF / SEAF 70".

[0158] <s11>

[0159] In Figure 7 In S11, since the value of ngKSI is "No available key", the hAMF / SEAF 70 judges that the authentication procedure is needed.

[0160] <S12~S15>

[0161] In S12, the hAMF / SEAF 70 sends Nausf_UEAuthentication_Authenticate request to the AUSF 100 (TS 33.501, 6.1.2, step 2).

[0162] In S13, the AUSF 100 sends Nudm_UEAuthentication_Get request to the hUDM 110 (TS 33.501, 6.1.2, step 3). In S14, the hUDM 110 sends Nudm_UEAuthentication_Get response to the AUSF 100 (TS 33.501, 6.1.3.2.0, step 2).

[0163] In S15, the AUSF 100 sends Nausf_UEAuthentication_Authenticate response to the hAMF / SEAF 70 (TS 33.501, 6.1.3.2.0, step 5).

[0164] <S16~S17>

[0165] In S16, the hAMF 70 allocates "hAMF to vAMF UE ID" to the vAMF 30. This ID is an ID allocated by the hAMF 70, and is an ID that the hAMF 70 uses to identify the terminal 20 within the vAMF 30 through the SBI. In S17, the hAMF 70 allocates an arbitrary value to the ngKSI.

[0166] <s18>

[0167] In S18, the hAMF / SEAF 70 sends Nvamf_Communication_HtoV_HNl_MessageTransfer (TS 33.501, 6.1.3.2.0, step 6) to the vAMF 30.

[0168] This Nvamf_Communication_HtoV_HNl_MessageTransfer contains hNAS container, "vAMF to hAMF UE ID", "hAMF to vAMF UE ID". The hNAS container contains authentication request. The authentication request contains ngKSI.

[0169] Subsequent messages between the hAMF 70 and the vAMF 30 must include "vAMF to hAMF UE ID" and "hAMF to vAMF UE ID". However, for simplicity of writing, the following omits the description of the meaning of {including "vAMF to hAMF UE ID" and "hAMF to vAMF UE ID"}.

[0170] <S19, S20>

[0171] In S19, the vAMF 30 sends NGAP DL NAS transport to the RAN 10. This message includes vNAS DL NAS transport IE. In addition, this IE includes hNAS container. Figure 8 In S20, the RAN 10 sends DL information transfer to the terminal 20. This message includes vNAS DL NAS transport IE.

[0172] <S21, S22>

[0173] In S21, the terminal 20 sends UL information transfer to the RAN 10. This message includes vNAS UL NAS transport IE. This IE includes hNAS container. In addition, this hNAS container contains authentication response (TS 33.501, 6.1.3.2.0, step 8).

[0174] In S22, the RAN 10 sends NGAP UL NAS transport to the vAMF 30. This message includes vNAS UL NAS transport IE.

[0175] <S23~S25>

[0176]

[0177] ​In S23, the vAMF 30 sends a Nhamf_Communication_VtoH_HNl_MessageTransfer (TS 33.501, 6.1.3.2.0, step 8) to the hAMF / SEAF 70. This message includes the hNAS container.

[0178] In S24, the hAMF / SEAF 70 sends a Nausf_UEAuthentication_Authenticate request (TS 33.501, 6.1.3.2.0, step 10) to the AUSF 100.

[0179] In S25, the AUSF 10 sends a Nausf_UEAuthentication_Authenticate response (TS 33.501, 6.1.3.2.0, step 12) to the hAMF / SEAF 70. This message contains the SUPI, K SEAF .

[0180] <s26>

[0181] In S26, hAMF / SEAF70 binds the terminal context generated previously with respect to 5G-GUTI and SUCI to the SUPI of the terminal 20. The terminal context also includes K SEAF .

[0182] [Security settings section: S27~S36]

[0183] Next, the security setting portion will be described as S27 to S36.

[0184] <S27、S28>

[0185] exist Figure 9 In S27, hAMF / SEAF70 is derived from K SEAF Export K hAMF hAMF / SEAF70 deletion K SEAF In addition, K hAMF It can also be the existing standard K AMF In S28, hAMF / SEAF70 is transferred from K hAMF Export K vAMF .

[0186] <s29>

[0187] In S29, the hAMF / SEAF 70 sends an Nvamf_Communication_CreateVUEContext request to the vAMF 30. This message includes K vAMF , terminal security capabilities, ngKSI.

[0188] <S30, S31>

[0189] In S30, the vAMF 30 generates K vAMF from K gNB In S31, the vAMF 30 allocates a 5G-VGUTI to the terminal 30. In addition, this 5G-VGUTI is a globally unique temporary terminal identifier allocated by the vAMF 30.

[0190] <S32, S33>

[0191] In S32, the vAMF 30 generates a VPLMN terminal context with respect to the 5G-VGUTI. In S33, the vAMF 30 keeps the 5G-VGUTI, K vAMF , K gNB , terminal security capabilities, ngKSI in the VPLMN terminal context.

[0192] <S34~S36>

[0193] In S34, the vAMF 30 sends an NGAP Initial Context Setup request (TS 38.413, 9.2.2.1) to the RAN 10. This message includes K gNB , terminal security capabilities.

[0194] In S35, the RAN 10 allocates a C-RNTI to the terminal 20. In S36, the RAN 10 generates a terminal context with respect to the C-RNTI.

[0195] [AS security setup part: S37~S39]

[0196] In S37~S39, the AS security setup part is explained.

[0197] <S37~S39>

[0198] In S37, the RAN 10 sends an AS security mode command (TS 33.501, 6.7.4, step 1b) to the terminal 20. This message includes the selected AS security algorithms.

[0199] In S38, the terminal 20 sends an AS security mode complete to the RAN 10 (TS 33.501, 6.7.4, step 2b). In S39, the RAN 10 sends an NGAP Initial Context Setup Response to the vAMF 30 (TS 38.413, 9.2.2.2).

[0200] [vNAS security setting part: S40-S44]

[0201] Next, in S40-S44, the vNAS security setting part is explained.

[0202] <S40, S41>

[0203] In Figure 10 In S40, the vAMF 30 sends an NGAP DL NAS transport to the RAN 10. This message contains a vNAS security mode command (TS 33.501, 6.7.2, step 1b). This command includes the terminal security capabilities, the selected vNAS security algorithms.

[0204] In S41, the RAN 10 sends a DL information transfer to the terminal 20. This message contains a vNAS security mode command (TS 33.501, 6.7.2, step 1b).

[0205] <S42, S43>

[0206] In S42, the terminal 20 sends an UL information transfer to the RAN 10. This message contains a vNAS security mode complete (TS 33.501, 6.7.2, step 2b). This vNAS security mode complete includes the registration request in the registration request (initial NAS part), the registration request (vNAS part) (= information required by the vAMF 30 (e.g., final location area registration TAI)).

[0207] In S43, the RAN 10 sends an NGAP UL NAS transport to the vAMF 30. This message contains a vNAS security mode complete (TS 33.501, 6.7.2, step 2b).

[0208] <s44>

[0209] In S44, the vAMF 30 sends Nhamf_Communication_UpdateUEContext to the hAMF / SEAF 70. This message includes an AS / vNAS security completion notification IE. In addition, this IE is set so that the AS / vNAS security procedure and the hNAS security procedure do not occur at the same time.

[0210] [hNAS security setting section: S45-S50]

[0211] Next, the hNAS security setting section is described as S45-S50.

[0212] <s45>

[0213] In Figure 11 In S45, hAMF / SEAF 70 sends Nvamf_Communication_HtoV_HN1_MessageTransfer to vAMF 30. This message includes a hNAS container. This hNAS container contains a hNAS security mode command (TS 33.501, 6.7.2, step 1b). This command includes the terminal security capabilities, the selected hNAS security algorithms.

[0214] <S46, S47>

[0215] In S46, vAMF 30 sends NGAP DL NAS transport to RAN 10. This message includes a vNAS DL NAS transport IE. This IE includes a hNAS container.

[0216] In S47, RAN 10 sends DL information forwarding to terminal 20. This message includes a vNAS DL NAS transport IE.

[0217] <s48>

[0218] In S48, the terminal 20 sends an UL information transfer to the RAN 10. The message includes a vNAS UL NAS transport IE. The IE includes a hNAS container. The hNAS container includes a hNAS security mode complete (TS 33.501, 6.7.2, step 2b).

[0219] The hNAS security mode complete includes all information of the registration request. That is, it includes the registration request (initial NAS part), the registration request (vNAS part), the registration request (hNAS part) (= information required for the hAMF 70 (e.g., requested NSSAI)).

[0220] <S49, S50>

[0221] In S49, the RAN 10 sends an NGAP UL NAS transport to the vAMF 30. The message includes a vNAS UL NAS transport IE.

[0222] In S50, the vAMF 30 sends an Nhamf_Communication_VtoH_HN1_MessageTransfer to the hAMF / SEAF 70. The message contains a hNAS container (TS 33.501, 6.7.2, step 2b).

[0223] [Cooperation with UDM part: S51~S54]

[0224] Next, as S51~S54, the cooperation with the UDM part is explained.

[0225] <s51>

[0226] In Figure 12 In S51, the vAMF 30 (after AS / vNAS security completion) sends Nvudm_UECM_Registration (TS 23.502, 4.2.2.2.2, step 14a) to the vUDM 60. In case this message contains a terminal identifier, the 5G-VGUTI is included as the terminal identifier.

[0227] <S52~S54>

[0228] In S52, the hAMF 70 (after hNAS security completion) sends Nhudm_UECM_Registration (TS 23.502, 4.2.2.2.2, step 14a) to the hUDM 110. In case this message contains a terminal identifier, the SUPI is included as the terminal identifier.

[0229] In S53, the hAMF 70 sends Nhudm_SDM_Get request (TS 23.502, 4.2.2.2.2, step 14a) to the hUDM 110. In S54, the hUDM 110 sends Nhudm_SDM_Get response (TS 23.502, 4.2.2.2.2, step 14a) to the hAMF 70. This message contains the subscriber information.

[0230] [Registration response part: S55~S59]

[0231] Next, as S55~S59, the registration response part is explained.

[0232] <s55>

[0233] In Figure 13 In S55, the hAMF 70 generates a registration response (hNAS part) and performs encryption and integrity protection by hNAS security. The registration response (hNAS part) contains, in addition to the 5G-GUTI, a permitted NSSAI and the like related to service provision.

[0234] <s56>

[0235] In S56, the hAMF 70 sends an Nvamf_Communication_HtoV_HNl_MessageTransfer to the vAMF 30. This message includes a hNAS container. This hNAS container includes the registration response (hNAS part).

[0236] <s57>

[0237] In S57, the vAMF 30 generates a registration response (vNAS part). The registration response (vNAS part) contains a TAI list and the like related to connection control in addition to the 5G-VGUTI.

[0238] <S58, S59>

[0239] In S58, the vAMF 30 transmits an NGAP DL NAS transport to the RAN 10. The message includes the registration response. The vAMF 30 encrypts and integrity protects the registration response. The registration response includes the registration response (vNAS part), the hNAS container.

[0240] In S59, the RAN 10 transmits a DL information transfer to the terminal 20. The message includes the registration response.

[0241] Up to this point, the initial registration procedure at the time of roaming is completed.

[0242] (Mobile registration procedure at the time of roaming)

[0243] Next, the mobile registration procedure at the time of roaming is described. The mobile registration procedure at the time of roaming is completed in the VPLMN.

[0244] <s1>

[0245] In Figure 14 In S1, the terminal 20 decides to send a registration request to the vAMF 30 using the mechanism of initial NAS message protection (TS 23.502, 4.2.2.2.2, step 1) (TS 33.501, 6.4.6, step 1).

[0246] This registration request message is in clear and includes only the 5G-VGUTI, the terminal security capabilities, the ngKSI. In the following, this registration request message is called "registration request (initial NAS part)". This message is a vNAS (= NAS message that is terminated in the vAMF 30).

[0247] Here, the value of the ngKSI is the value that was last assigned by the hAMF 70 and saved in the VPLMN terminal context by the vAMF 30.

[0248] <S2~S4>

[0249] In S2, the terminal 20 sends an RRCSetupRequest to the RAN 10 (TS 38.331, 5.3.3.1). In S3, the RAN 10 sends an RRCSetup to the terminal 20 (TS 38.331, 5.3.3.1).

[0250] In S4, the terminal 20 sends an RRCSetupComplete to the RAN 10 (TS 38.331, 5.3.3.1). This message contains the registration request (initial NAS part).

[0251] <S5, S6>

[0252] In S5, the RAN 10 selects the vAMF 30 with the value of the 5G-VGUTI and sends an NGAP Initial UE message to the vAMF 30 (TS 38.413, 8.6.1.2). This message contains the registration request (initial NAS part).

[0253] In S6, the vAMF 30 judges that no authentication procedure is needed since the value of the ngKSI in the registration request (initial NAS part) coincides with the value of the ngKSI in the VPLMN terminal context of the 5G-VGUTI.

[0254] [Security setup part: S7~S8]

[0255] In S7~S8, the security setup part is explained.

[0256] <S7~S8>

[0257] In Figure 15 In S7, the vAMF 30 sends an NGAP Initial Context Setup request to the RAN 10 (TS 38.413, 9.2.2.1). This message includes K gNB , the terminal security capabilities.

[0258] In S8, the RAN 10 allocates a C-RNTI to the terminal 20. In S9, the RAN 10 generates a terminal context with respect to the C-RNTI.

[0259] [AS security setup part: S10-S12]

[0260] In S10-S12, the AS security setup part is explained.

[0261] <S10-S12>

[0262] In S10, the RAN 10 sends an AS security mode command to the terminal 20 (TS 33.501, 6.7.4, step 1b). This message includes the selected AS security algorithms.

[0263] In S11, the terminal 20 sends an AS security mode complete to the RAN 10 (TS 33.501, 6.7.4, step 2b). In S12, the RAN 10 sends an NGAP Initial Context Setup response to the vAMF 30 (TS 38.413, 9.2.2.2).

[0264] [vNAS security setup part: S13-S16]

[0265] In S13-S16, the vNAS security setup part is explained.

[0266] <S13, S14>

[0267] In S13, the vAMF 30 sends an NGAP DL NAS transport to the RAN 10. This message contains a vNAS security mode command (TS 33.501, 6.7.2, step 1b). This command includes the terminal security capabilities, the selected vNAS security algorithms.

[0268] In S14, the RAN 10 sends a DL information transfer to the terminal 20. This message contains a vNAS security mode command (TS 33.501, 6.7.2, step 1b).

[0269] <S15, S16>

[0270] In S15, the terminal 20 sends an UL information transfer to the RAN 10. This message contains the vNAS security mode complete (TS 33.501, 6.7.2, step 2b).

[0271] This vNAS security mode complete includes all information of the registration request. That is, it contains the registration request (initial NAS part), the registration request (vNAS part) (= information required for the vAMF (e.g. final location area registration TAI)).

[0272] In S16, the RAN 10 sends an NGAP UL NAS transport to the vAMF 30. This message contains the vNAS security mode complete (TS 33.501, 6.7.2, step 2b).

[0273] [Cooperation with UDM part: S17]

[0274] <s17>

[0275] In S17, the vAMF 30 (after AS / vNAS security completion) sends Nvudm_UECM_Registration (TS 23.502, 4.2.2.2.2, step 14a) to the vUDM 60. In case this message contains a terminal identifier, the 5G-VGUTI is included as this terminal identifier.

[0276] [Registration response part: S18-S20]

[0277] Next, in S18-S20, the registration response part is explained.

[0278] <s18>

[0279] In Figure 16 In S18, the vAMF 30 generates a registration response (vNAS part). The registration response (vNAS part) contains a TAI list and the like related to connection control in addition to the 5G-VGUTI.

[0280] <S19, S20>

[0281] In S19, the vAMF 30 transmits an NGAP DL NAS transport to the RAN 10. The message includes the registration response. Further, the vAMF 30 encrypts and integrity protects the registration response. The registration response contains the registration response (vNAS part).

[0282] In S20, the RAN 10 transmits a DL information transfer to the terminal 20. The message includes the registration response.

[0283] Thus far, the mobile registration procedure at the time of roaming is completed.

[0284] (PDU Session Establishment Procedure at the Time of Roaming)

[0285] Next, the PDU session establishment procedure at the time of roaming is described.

[0286] <S1, S2>

[0287] In Figure 17 In S1, the terminal 20 generates a PDU session establishment request. The message contains a PDU session ID (assigned by the terminal 20).

[0288] In S2, the terminal 20 encrypts and integrity protects the PDU session establishment request by hNAS security.

[0289] <s3>

[0290] In S3, the terminal 20 sends a UL information transfer to the RAN 10. The message includes a vNAS UL NAS transport IE. The vNAS UL NAS transport IE includes a hNAS container. The hNAS container contains a PDU session establishment request (TS 23.502, 4.3.2.2.1, step 1). In addition, the vNAS UL NAS transport IE includes the PDU session ID.

[0291] <S4~S6>

[0292] In S4, the RAN 10 sends a NGAP UL NAS transport to the vAMF 30. The message includes a vNAS UL NAS transport IE.

[0293] In S5, the vAMF 30 saves the PDU session ID in the VPLMN terminal context of the 5G-VGUTI.

[0294] In S6, the vAMF 30 sends a Nhamf_Communication_VtoH_HN1_MessageTransfer to the hAMF 70. The message includes a hNAS container, the PDU session ID.

[0295] <S7~S9>

[0296] In S7, the hAMF 70 saves the PDU session ID in the terminal context of the SUPI and 5G-GUTI. In S8, the hAMF 70 decrypts and integrity verifies the hNAS container. In S9, the hAMF 70 derives K hAMF derives K hSMF .

[0297] <s10>

[0298] In S10, hAMF70 sends Nhsmf_PDUSession_CreateSMContext request to hSMF80. This message includes PDU session establishment request, hSMF security information, SUPI, PDU session ID. The hSMF security information includes terminal security capabilities, K hSMF .

[0299] <S11~S13>

[0300] In S11, hSMF80 sends Nudm_SDM_Get request to hUDM110 using SUPI. In S12, hUDM110 sends Nhudm_SDM_Get response to hSMF80. This message contains session management subscriber information. In S13, hSMF80 receives the response from K hSMF Export K hUPenc , K hUPint .K hUPenc is the hidden key, K hUPint It is the key used for integrity protection.

[0301] <S14、S15>

[0302] exist Figure 18 In S14, hSMF80 sends a PFCP session establishment request to hUPF90. The message includes UPF security information. The UPF security information includes the selected UPF security algorithm, K hUPenc , K hUPint In S15 , hUPF 90 sends a PFCP session establishment response to hSMF 80 .

[0303] <s16>

[0304] In S16, the hSMF 80 sends an Nhamf_Communication_HnMessageTransfer to the hAMF 70.

[0305] The message includes an inter-SMF container. The inter-SMF container includes a PDU Session VSM Context Generation Request IE. The IE includes the content equivalent to the PDU Session Resource Setup Request Transfer IE (TS 38.413, 9.3.4.1) that the SMF sends to the RAN in the existing specification. In addition, the PDU Session VSM Context Generation Request IE includes the PDU Session ID.

[0306] In addition, the Nhamf_Communication_HnMessageTransfer includes an hNAS container. The hNAS container contains a PDU Session Establishment Accept (TS 24.501, 8.3.2), a UPF Security Mode Indication. The UPF Security Mode Indication includes the selected UPF security algorithms.

[0307] Further, the Nhamf_Communication_HnMessageTransfer includes the PDU Session ID.

[0308] <S17, S18>

[0309] In S17, the hAMF 70 encrypts and integrity protects the hNAS container by hNAS security.

[0310] In S18, the hAMF 70 sends an Nvamf_Communication_HtoV_HN1_MessageTransfer to the vAMF 30. The message includes the inter-SMF container, the hNAS container, the PDU Session ID.

[0311] <S19~S22>

[0312] In S19, the vAMF 30 sends an Nvamf_Communication_HnMessageNotify to the vSMF 40. The message includes the inter-SMF container, the hNAS container, the 5G-VGUTI, the PDU Session ID.

[0313] In S20, the vSMF 40 sends a PFCP Session Establishment Request to the vUPF 50. In S21, the vUPF 50 sends a PFCP Session Establishment Response to the vSMF 40.

[0314] In S22, the vSMF 40 sends Nvamf_Communication_N1N2MessageTransfer to the vAMF 30. This message includes PDU Session Resource Setup Request Transfer IE (TS 38.413, 9.3.4.1), hNAS container, PDU Session ID.

[0315] <s23>

[0316] In S23, the vAMF 30 sends a PDU Session Resource Setup Request (TS 38.413, 9.2.1.1) to the RAN 10. This message includes a PDU Session Resource Setup Request Transfer IE (TS 38.413, 9.3.4.1), a vNAS DL NAS Transport IE. In addition, the vNAS DL NAS Transport IE includes a hNAS container.

[0317] <S24, S25>

[0318] In S24, the RAN 10 sends an RRC Reconfiguration (TS 38.331, 5.3.5.1) to the terminal 20. This message includes a vNAS DL NAS Transport IE. Figure 19

[0319] In S25, the terminal 20 sends an RRC Reconfiguration Complete (TS 38.331, 5.3.5.1) to the RAN 10. This message includes a vNAS UL NAS Transport IE. This IE includes a hNAS container. This hNAS container includes a UPF Security Mode Complete. In addition, the RRC Reconfiguration Complete includes a PDU Session ID.

[0320] <s26>

[0321] In S26, the RAN 10 sends a PDU Session Resource Setup Response (TS 38.413, 9.2.1.3) to the vAMF 30. This message includes a PDU Session Resource Setup Response Transport IE (TS 38.413, 9.3.4.2), a vNAS UL NAS Transport IE.

[0322] <s27>

[0323] In S27, the vAMF 30 sends an Nvsmf_PDUSession_UpdateVSMContext request to the vSMF 40. This message includes a PDU Session Resource Setup Response Transfer IE (TS 38.413, 9.3.4.2), hNAS container, PDU Session ID.

[0324] <S28, S29>

[0325] In S28, the vSMF 40 sends a PFCP Session Modification Request to the vUPF 50. In S29, the vUPF 50 sends a PFCP Session Modification Response to the vSMF 40.

[0326] <s30>

[0327] In S30, the vSMF 40 sends Nvamf_Communication_VnMessageTransfer to the vAMF 30. This message includes an inter-SMF container. This inter-SMF container includes a PDU Session VSM Context Generation Response IE. This PDU Session VSM Context Generation Response IE includes the content equivalent to the PDU Session Resource Setup Response Transfer IE (TS 38.413, 9.3.4.2). In addition, this PDU Session VSM Context Generation Response IE includes the PDU Session ID.

[0328] In addition, this Nvamf_Communication_VnMessageTransfer includes an hNAS container. This Nvamf_Communication_VnMessageTransfer contains the PDU Session ID.

[0329] <S31~S34>

[0330] In S31, the vAMF 30 sends Nhamf_Communication_VtoH_HN1_MessageTransfer to the hAMF 70. This message includes an inter-SMF container, an hNAS container, and the PDU Session ID.

[0331] In S32, the hAMF 70 sends Nhsmf_PDUSession_UpdateSMContext Request to the hSMF 80. This message includes an inter-SMF container, an hNAS container, and the PDU Session ID.

[0332] In S33, the hSMF 80 sends PFCP Session Change Request to the hUPF 90. In S34, the hUPF 90 sends PFCP Session Change Response to the hSMF 80.

[0333] The above, the PDU session establishment procedure at the time of roaming is completed.

[0334] (Summary of messages between vAMF 30 and hAMF 70)

[0335] A summary of messages between vAMF 30 and hAMF 70 used in the above procedure is described below.

[0336] • Nhamf_Communication_VtoH_HN1_MessageTransfer

[0337] This message is initiated by the vAMF 30 and received by the hAMF 70, and is a message that carries signals from VPLMN NFs to HPLMN NFs or hNAS signals.

[0338] • Nvamf_Communication_HtoV_HN1_MessageTransfer

[0339] This message is initiated by the hAMF 70, received by the vAMF 30, and is a message carrying signals from HPLMN NF to VPLMN NF or hNAS signals.

[0340] • Nhamf_Communication_VnMessageNotify

[0341] This message is initiated by the hAMF 70, received by the HPLMN NF, and is a message carrying signals from VPLMN NF.

[0342] • Nvamf_Communication_HnMessageNotify

[0343] This message is initiated by the vAMF 30, received by the VPLMN NF, and is a message carrying signals from HPLMN NF.

[0344] • Nhamf_Communication_HnMessageTransfer

[0345] This message is initiated by the HPLMN NF, received by the hAMF, and is a message carrying signals from HPLMN NF to VPLMN NF.

[0346] • Nvamf_Communication_VnMessageTransfer

[0347] This message is initiated by the VPLMN NF, received by the vAMF 30, and is a message carrying signals from VPLMN NF to HPLMN NF.

[0348] (Termination initiated service request procedure at the time of roaming)

[0349] Next, the termination initiated service request procedure at the time of roaming is explained. This procedure is completed within the VPLMN.

[0350] <s1>

[0351] In Figure 20 In S1, the terminal 20 decides to send a service request to the vAMF 30 using the mechanism of initial NAS message protection (TS 23.502, 4.2.3.2, step 1) (TS 33.501, 6.4.6, step 1).

[0352] The message of this service request is in clear text and includes only the 5G-VS-TMSI, ngKSI. This message is called "service request (initial NAS part)" in the following. This message is a vNAS (= NAS message that is terminated in the vAMF 30).

[0353] Here, the value of the ngKSI is the value that was last assigned by the hAMF 70 and saved in the VPLMN terminal context by the vAMF 30. With respect to the 5G-VS-TMSI, the 5G-VS-TMSI is derived from the 5G-VGUTI such that the 5G-S-TMSI is derived from the 5G-GUTI (5G S-Temporary Mobile Subscriber Identity).

[0354] <S2~S4>

[0355] In S2, the terminal 20 sends an RRCSetupRequest to the RAN 10 (TS 38.331, 5.3.3.1). In S3, the RAN 10 sends an RRCSetup to the terminal 20 (TS 38.331, 5.3.3.1). In S4, the terminal 20 sends an RRCSetupComplete to the RAN 10 (TS 38.331, 5.3.3.1). This RRCSetupComplete message contains the service request (initial NAS part).

[0356] <S5, S6>

[0357] In S5, the RAN 10 selects the vAMF 30 using the value of the 5G-VS-TMSI and sends an NGAP Initial UE message to the vAMF 30 (TS 38.413, 8.6.1.2). This message contains the registration request (initial NAS part).

[0358] In S6, the vAMF 30 judges that no authentication procedure is required since the value of the ngKSI in the service request (initial NAS part) coincides with the value of the ngKSI in the VPLMN terminal context of the 5G-VGUTI to which the 5G-VS-TMSI corresponds.

[0359] [Security setting part: S7~S9]

[0360] The security setup part is explained in S7-S9.

[0361] <S7-S9>

[0362] In S7, the vAMF 30 sends an NGAP Initial Context Setup request to the RAN 10 (TS 38.413, 9.2.2.1). This message includes the K gNB , the terminal security capabilities.

[0363] In S8, the RAN 10 allocates a C-RNTI to the terminal 20. In S9, the RAN 10 generates a terminal context with respect to the C-RNTI.

[0364] [AS security setup part: S10-S12]

[0365] The AS security setup part is explained in S10-S12.

[0366] <S10-S12>

[0367] In S10 of the AS security setup part, Figure 21 , the RAN 10 sends an AS security mode command to the terminal 20 (TS 33.501, 6.7.4, step 1b). This message includes the selected AS security algorithms.

[0368] In S11, the terminal 20 sends an AS security mode complete to the RAN 10 (TS 33.501, 6.7.4, step 2b). In S12, the RAN 10 sends an NGAP Initial Context Setup response to the vAMF 30 (TS 38.413, 9.2.2.2).

[0369] [vNAS security setup part: S13-S16]

[0370] The vNAS security setup part is explained in S13-S16.

[0371] <S13, S14>

[0372] In S13, the vAMF 30 sends an NGAP DL NAS transport to the RAN 10. This message contains a vNAS security mode command (TS 33.501, 6.7.2, step 1b). This command includes the terminal security capabilities, the selected vNAS security algorithms.

[0373] In S14, the RAN 10 sends a DL information transfer to the terminal 20. This message contains a vNAS security mode command (TS 33.501, 6.7.2, step 1b).

[0374] <S15, S16>

[0375] In S15, the terminal 20 sends UL information transfer to the RAN 10. This message contains the vNAS security mode complete (TS 33.501, 6.7.2, step 2b). This vNAS security mode complete includes all information of the service request. That is, contains the service request (initial NAS part), service request (vNAS part).

[0376] In S16, the RAN 10 sends the NGAP UL NAS transport to the vAMF 30. This message contains the vNAS security mode complete (TS 33.501, 6.7.2, step 2b).

[0377] [Path activation part: S17~S27]

[0378] The path activation part is explained in S17~S27.

[0379] <S17~S20>

[0380] In Figure 22 S17, the vAMF 30 sends the Nvsmf_PDUSession_UpdateVSMContext request (TS 23.502, 4.2.3.2, step 4) to the vSMF 40.

[0381] In S18, the vSMF 40 sends the PFCP session modification request to the vUPF 50. In S19, the vUPF 50 sends the PFCP session modification response to the vSMF 40.

[0382] In S20, the vSMF 40 sends the Nvsmf_PDUSession_UpdateVSMContext response (TS 23.502, 4.2.3.2, step 11) to the vAMF 30. This message includes the PDU Session Resource Setup Request Transfer IE (TS 38.413, 9.3.4.1), vNAS SM information. This vNAS SM information contains the service grant.

[0383] <S21~S24>

[0384] In S21, the vAMF 30 sends the PDU Session Resource Setup Request (TS 38.413, 9.2.1.1) (TS 23.502, 4.2.3.2, step 12) to the RAN 10. This message includes the PDU Session Resource Setup Request Transfer IE (TS 38.413, 9.3.4.1), vNAS DL NAS transport IE. The vNAS DL NAS transport IE includes the vNAS SM information.

[0385] In S22, the RAN 10 transmits an RRC Reconfiguration (TS 38.331, 5.3.5.1) to the terminal 20. This message includes a vNAS DL NAS Transport IE.

[0386] In S23, the terminal 20 transmits an RRC Reconfiguration Complete (TS 38.331, 5.3.5.1) to the RAN 10. In S24, the RAN 10 transmits a PDU Session Resource Setup Response (TS 38.413, 9.2.1.3) (TS 23.502, 4.2.3.2, step 14) to the vAMF 30. This message includes a PDU Session Resource Setup Response Transport IE (TS 38.413, 9.3.4.2).

[0387] <S25~S27>

[0388] In S25, the vAMF 30 transmits an Nsmf_PDUSession_UpdateSMContext request (TS 23.502, 4.2.3.2, step 15) to the vSMF 40. This message includes a PDU Session Resource Setup Response Transport IE (TS 38.413, 9.3.4.2).

[0389] In S26, the vSMF 40 transmits a PFCP Session Modification Request to the vUPF 50. In S27, the vUPF 50 transmits a PFCP Session Modification Response to the vSMF 40.

[0390] Thus far, the terminal startup service request procedure at the time of roaming is completed.

[0391] (UL data transmission using PDU session at the time of roaming)

[0392] Next, UL data transmission using a PDU session at the time of roaming is explained.

[0393] In S1 of FIG. 8, the terminal 20 applies an UL transmission packet to a packet filter, and determines a QoS flow flowing through the UL transmission packet. Figure 23 In S2, the terminal 20 passes the UL transmission packet to the UPF SP entity inside the terminal. In S3, the UPF SP entity inside the terminal performs integrity protection and encryption in addition to a 5-tuple for the UL transmission packet, and passes it to the SDAP entity inside the terminal. Thereafter, in S4, the terminal 20 transmits the UL packet.

[0394]

[0395] ​In S5, the hUPF 90 receives the UL transmission packet, and the UPF-in UPFSP entity passes the received packet to the UPF-in SDAP entity. In S6, the UPF-in UPFSP entity decrypts and integrity verifies the packet, and returns to the QoS flow. After that, the existing processing is performed.

[0396] The UL data transmission using the PDU session at the time of roaming is completed as above.

[0397] (DL data transmission using the PDU session at the time of roaming)

[0398] Next, the DL data transmission using the PDU session at the time of roaming is described.

[0399] In Figure 24 In S1, the hUPF 90 applies the DL transmission packet to the packet filter, and determines the QoS flow flowing through the DL transmission packet.

[0400] In S2, the hUPF 90 passes the DL transmission packet to the UPF-in UPFSP entity. In S3, the UPF-in UPFSP entity performs integrity protection and encryption for the UL transmission packet in addition to the 5tuple, and passes it to the UPF-in SDAP entity. Then, in S4, the hUPF 90 transmits the DL packet.

[0401] In S5, the terminal 20 receives the DL transmission packet, and the terminal-in SDAP entity passes the received packet to the terminal-in UPFSP entity. In S6, the terminal-in UPFSP entity decrypts and integrity verifies the packet. After that, the existing processing is performed.

[0402] The DL data transmission using the PDU session at the time of roaming is completed as above.

[0403] According to the first embodiment described above, even in the case where the HPLMN does not trust the VPLMN, the terminal 20 can securely perform communication at the time of roaming. Next, the second embodiment is described.

[0404] (Problem of the second embodiment)

[0405] In the 5GS, as a transmission method of user small data, (i) SMS over NAS (TS 23.502, 4.13.3), (ii) Control Plane CIoT 5GS Optimization UPF Anchor Data Transmission (TS 23.502, 4.24), and (iii) NEF-based Non-IP Data Delivery (TS 23.502, 4.25) are standardized. They have the following problems with respect to roaming, respectively.

[0406] Regarding (i), there is no specification of the roaming architecture as it originally exists.

[0407] Regarding (ii) (iii), concealment and integrity protection are performed between the terminal and the AMF (configured in the VPLMN), but are not secure in the assumption of "HPLMN does not trust VPLMN".

[0408] In the first embodiment, a secure roaming architecture under the assumption of "HPLMN does not trust VPLMN" is explained. When the roaming architecture in the first embodiment is applied to the above (i) (ii) (iii), whether or not it is appropriate to act is described below.

[0409] (i) As explained in the first embodiment, by providing a structure in which the AMF in the existing non-roaming architecture specification is separated into the vAMF 30 and the hAMF 80, a secure roaming architecture can be easily constructed.

[0410] (ii) The terminal 20 cannot decrypt the DL user small data. The hUPF 90 cannot decrypt the UL user small data.

[0411] (iii) The roaming architecture is not used using the existing specification. By providing a structure in which the AMF in the existing non-roaming architecture specification is separated into the vAMF 30 and the hAMF 70, a secure roaming architecture can be easily constructed.

[0412] In order to construct a secure roaming architecture regarding (ii), the above problem needs to be solved. In the second embodiment, a technology for solving the problem is explained. In addition, the technology of the second embodiment is not limited to roaming and can be applied.

[0413] (Summary of the second embodiment)

[0414] In the second embodiment, the hSMF 80 decides at the time of PDU session establishment whether the PDU session is for "Control Plane CIoT 5GS Optimization UPF Anchor Data Transport" or for "NEF-based Non-IP Data Delivery" and notifies the terminal 20. The terminal 20 is oriented to the hUPF 90 in the former case and to the hAMF 70 in the latter case, and performs concealment and integrity protection on the user small data.

[0415] That is, in the second embodiment, the terminal 20 receives the identifier included in the PDU session establishment accept message indicating whether the PDU session is for "Control Plane CIoT 5GS optimization UPF anchor data transfer" or for "NEF based non-IP data transfer", and, at the time of the later reception and transmission of the user small data, performs the concealment and integrity protection of the user small data toward the hUPF 90 in the case of the former and toward the hAMF 70 in the case of the latter. That is, in the terminal 20, the communication object of the user small data, which has been subjected to the concealment and integrity protection, is the hUPF 90 in the case of the former and the hAMF 70 in the case of the latter.

[0416] (PDU session establishment procedure at the time of roaming)

[0417] First, the PDU session establishment procedure at the time of roaming will be described.

[0418] <S1, S2>

[0419] In Figure 25 S1, the terminal 20 generates a PDU session establishment request. This message includes a PDU session ID (assigned by the terminal). In S2, the terminal 20 encrypts the PDU session establishment request by hNAS security and performs integrity protection.

[0420] <s3>

[0421] In S3, the terminal 20 sends a UL information transfer to the RAN 10. The message includes a vNAS UL NAS transport IE. The vNAS UL NAS transport IE includes a hNAS container. The hNAS container contains a PDU session establishment request (TS 23.502, 4.3.2.2.1, step 1). In addition, the vNAS UL NAS transport IE includes the PDU session ID.

[0422] <S4~S6>

[0423] In S4, the RAN 10 sends a NGAP UL NAS transport to the vAMF 30. The message includes a vNAS UL NAS transport IE.

[0424] In S5, the vAMF 30 saves the PDU session ID in the VPLMN terminal context of the 5G-VGUTI.

[0425] In S6, the vAMF 30 sends a Nhamf_Communication_VtoH_HN1_MessageTransfer to the hAMF 70. The message includes a hNAS container, the PDU session ID.

[0426] <S7~S9>

[0427] In S7, the hAMF 70 saves the PDU session ID in the terminal context of the SUPI and 5G-GUTI. In S8, the hAMF 70 decrypts the hNAS container and performs integrity verification. In S9, the hAMF 70 derives K hAMF from K hSMF .

[0428] <s10>

[0429] In S10, hAMF 70 sends a Nhsmf_PDUSession_CreateSMContext request to hSMF 80. The message includes a PDU session establishment request, hSMF security information, SUPI, PDU session ID, and control plane CIoT indication.

[0430] The hSMF security information includes terminal security capabilities, K hSMF In addition, the hAMF 70 considers subscriber information and the like to determine whether a control plane CIoT indication (eg, cpCiotEnabled=true, cpOnlyInd=true) needs to be set (TS 29.502, 6.1.6.2.2).

[0431] <S11~S13>

[0432] In S11, hSMF 80 uses SUPI to send a Nudm_SDM_Get request to hUDM 110. In S12, hUDM 110 sends a Nudm_SDM_Get response to hSMF 80. This message contains session management subscriber information. This session management subscriber information may also contain a NEF identifier for NIDD.

[0433] In S13, hSMF80 considers NIDD using NEF identifier, etc. to decide whether to use control plane CIoT 5GS optimized UPF anchor data transmission or NEF-based non-IP data transmission.

[0434] (Control plane CIoT 5GS optimizes UPF anchor point data transmission)

[0435] The actions when using the control plane CIoT 5GS to optimize UPF anchor data transmission are as follows.

[0436] <S14~S16>

[0437] exist Figure 26 In S14, hSMF80 was found to be hSMF Export K hUPenc , K hUPint In S15, hSMF80 sends a PFCP session establishment request to hUPF90. The message includes UPF security information. The UPF security information includes the selected UPF security algorithm, K hUPenc , K hUPint In S16, hUPF90 sends a PFCP session establishment response to hSMF80.

[0438] <s17>

[0439] In S17, the hSMF 80 sends an Nhamf_Communication_HnMessageTransfer to the hAMF 70. This message includes an inter-SMF container. This inter-SMF container includes a PDU Session VSM Context Generation Request IE.

[0440] This PDU Session VSM Context Generation Request IE includes the content equivalent to the PDU Session Resource Setup Request Transfer IE (TS 38.413, 9.3.4.1) (which the SMF sends to the RAN in existing specifications). In addition, this PDU Session VSM Context Generation Request IE includes a PDU Session ID. In addition, this PDU Session VSM Context Generation Request IE includes a Control Plane CIoT indication (UPF anchor indication).

[0441] In addition, this Nhamf_Communication_HnMessageTransfer includes an hNAS container. This hNAS container contains a PDU Session Establishment Accept (TS 24.501, 8.3.2), a UPF Security Mode Indication. This PDU Session Establishment Accept includes only a Control Plane indication (UPF anchor indication). This UPF Security Mode Indication includes the selected UPF security algorithms.

[0442] In addition, this Nhamf_Communication_HnMessageTransfer contains a PDU Session ID.

[0443] <S18~S20>

[0444] In S18, the hAMF 70 encrypts and integrity protects the hNAS container by hNAS security.

[0445] In S19, the hAMF 70 sends an Nvamf_Communication_HtoV_HN1_MessageTransfer to the vAMF 30. This message includes an inter-SMF container, an hNAS container, a PDU Session ID.

[0446] In S20, the vAMF 30 sends an Nvamf_Communication_HnMessageNotify to the vSMF 40. This message includes an inter-SMF container, an hNAS container, a 5G-VGUTI, a PDU Session ID.

[0447] <S21~S23>

[0448] In S21, the vSMF 40 sends a PFCP Session Establishment Request to the vUPF 50. In S22, the vUPF 50 sends a PFCP Session Establishment Response to the vSMF 40.

[0449] In S23, the vSMF 40 sends an N2amf_Communication_N1N2MessageTransfer to the vAMF 30. This message includes the hNAS container, the PDU Session ID.

[0450] <S24~S25>

[0451] In S24, the vAMF 30 sends an NGAP DL NAS Transport (TS 38.413, 9.2.5.2) to the RAN 10. This message includes a vNAS DL NAS Transport IE. This vNAS DL NAS Transport IE includes the hNAS container.

[0452] In S25, the RAN 10 sends an RRC Reconfiguration (TS 38.331, 5.3.5.1) to the terminal 20. This message includes a vNAS DL NAS Transport IE.

[0453] <s26>

[0454] In Figure 27 In S26, since there is only a control plane indication (UPF anchor indication), the terminal 20 understands (assumes) that the CIoT user data container will be handled as a vNAS container afterwards, and performs handling of concealment and integrity protection according to the UPF security mode indication.

[0455] <s27>

[0456] In S27, the terminal 20 sends an RRC reconfiguration complete (TS 38.331, 5.3.5.1) to the RAN 10. The message includes a vNAS UL NAS transport IE. The vNAS UL NAS transport IE includes a hNAS container. The hNAS container includes a UPF security mode complete. Further, the message of the RRC reconfiguration complete includes a PDU session ID.

[0457] <S28, S29>

[0458] In S28, the RAN 10 sends an NGAP UL NAS transport (TS 38.413, 9.2.5.3) to the vAMF 30. The message includes a vNAS UL NAS transport IE.

[0459] In S29, the vAMF 30 sends an Nvsmf_PDUSession_UpdateVSMContext request to the vSMF 40. The message includes a hNAS container, a PDU session ID.

[0460] <s30>

[0461] In S30, the vSMF 40 sends Nvamf_Communication_VnMessageTransfer to the vAMF 30. This message includes an inter-SMF container. This inter-SMF container includes a PDU Session VSM Context Generation Response IE. This PDU Session VSM Context Generation Response IE includes the content equivalent to the PDU Session Resource Setup Response Transfer IE (TS 38.413, 9.3.4.2). This PDU Session VSM Context Generation Response IE includes the PDU Session ID.

[0462] In addition, this Nvamf_Communication_VnMessageTransfer message includes an hNAS container. In addition, this Nvamf_Communication_VnMessageTransfer contains the PDU Session ID.

[0463] <S31~S34>

[0464] In S31, the vAMF 30 sends Nhamf_Communication_VtoH_HN1_MessageTransfer to the hAMF 70. This message includes an inter-SMF container, an hNAS container, and the PDU Session ID.

[0465] In S32, the hAMF 70 sends Nhsmf_PDUSession_UpdateSMContext Request to the hSMF 80. This message includes an inter-SMF container, an hNAS container, and the PDU Session ID.

[0466] In S32, the hSMF 80 sends a PFCP Session Change Request to the hUPF. In S36, the hUPF 90 sends a PFCP Session Change Response to the hSMF 80.

[0467] Thus far, the PDU Session establishment procedure at the time of roaming is completed.

[0468] (Case of NEF-based non-IP data transfer)

[0469] Next, the case of using NEF-based non-IP data transfer will be described.

[0470] <S14, S15>

[0471] In Figure 28 In S14, the hSMF 80 sends an Nnef_SMContext_Create request to the NEF 120 (TS 23.502, 4.25.2, step 2). In S15, the NEF 120 sends an Nnef_SMContext_Create response to the hSMF 80 (TS 23.502, 4.25.2, step 3).

[0472] <s16>

[0473] In S16, the hSMF 80 sends Nhamf_Communication_HnMessageTransfer to the hAMF 70. This message includes the hNAS container. This hNAS container contains the PDU Session Establishment Accept (TS 24.501, 8.3.2). This PDU Session Establishment Accept includes only the control plane indication (NEF anchor point indication).

[0474] Further, this Nhamf_Communication_HnMessageTransfer message contains the PDU Session ID.

[0475] <S17, S18>

[0476] In S17, the hAMF 70 encrypts and integrity protects the hNAS container by hNAS security. In S18, the hAMF 70 sends Nvamf_Communication_HtoV_HN1_MessageTransfer to the vAMF 30. This message includes the hNAS container, the PDU Session ID.

[0477] <S19, S20, S21>

[0478] In S19, the vAMF 30 sends NGAP DL NAS Transport (TS 38.413, 9.2.5.2) to the RAN 10. This message includes the vNAS DL NAS Transport IE. This IE includes the hNAS container.

[0479] In S20, the RAN 10 sends DL Information Forwarding (TS 38.331, 5.7.1.1) to the terminal 20. This message includes the vNAS DL NAS Transport IE.

[0480] In S21, since there is only the control plane indication (NEF anchor point indication), the terminal 20 understands (assumes) that the CIoT user data container is handled as the hNAS container afterwards.

[0481] The above, the PDU session establishment procedure at the time of roaming is completed.

[0482] (Control plane CIoT 5GS optimized UPF anchor data transfer)

[0483] Regarding the control plane CIoT 5GS optimized UPF anchor data transfer of the present embodiment, in the terminal originating case, it is the same as TS 23.502, 4.24.1. However, the vAMF is used instead of the AMF. The terminal terminating case is the same as TS 23.502, 4.24.2. However, the vAMF is used instead of the AMF.

[0484] In the control plane CIoT 5GS optimization UPF anchor data transmission, the terminal 20 faces the hUPF 90, and the user small data is concealed and integrity protected. That is, in the terminal 20, the communication object of the concealed and integrity protected user small data is the hUPF 90.

[0485] (Based on NEF non-IP data transmission - terminal originated)

[0486] Next, the case of terminal originated in the NEF based non-IP data transmission is described.

[0487] (S1, S2)

[0488] In Figure 29 In S1, the terminal 20 generates an hNAS container. The hNAS container includes a CIoT user data container. In S2, the terminal 20 encrypts and integrity protects the hNAS container by hNAS security.

[0489] (S3 ~ S5)

[0490] In S3, the terminal 20 sends an UL information transfer to the RAN 10. The message includes a vNAS UL NAS transport IE. The vNAS UL NAS transport IE includes the hNAS container, the PDU session ID.

[0491] In S4, the RAN 10 sends an NGAP UL NAS transport to the vAMF 30. The message includes a vNAS UL NAS transport IE.

[0492] In S5, the vAMF 30 sends an Nhamf_Communication_VtoH_HN1_MessageTransfer to the hAMF 70. The message includes the hNAS container, the PDU session ID.

[0493] (S6 ~ S8)

[0494] In S6, the hAMF 70 decrypts the hNAS container and performs integrity verification. In S7, the hAMF 70 sends an Nhsmf_PDUSession_SendMOData (TS 23.502, 4.25.4, step 1) to the hSMF 80. The message includes the CIoT user data container, the PDU session ID.

[0495] In S8, the hSMF 80 sends an Nnef_SMContext_Delivery request (TS 23.502, 4.25.4, step 3) to the NEF 120. The message includes the CIoT user data container, the PDU session ID.

[0496] The above completes the NEF-based non-IP data transfer (terminal-originated).

[0497] (NEF-based non-IP data transfer - terminal-terminated)

[0498] Next, the case of terminal-terminated in the NEF-based non-IP data transfer is explained.

[0499] <S1, S2>

[0500] In Figure 30 In S1, the NEF 120 sends Nhsmf_NIDD_Delivery request to the hSMF 80 (TS 23.502, 4.25.5, step 3). The URI of this message includes the PDU Session Reference Number. In addition, the PDU Session Reference Number is provided by the SMF to the NEF previously. Furthermore, the message of this Nhsmf_NIDD_Delivery request includes the CIoT User Data Container.

[0501] In S2, the hSMF 80 sends Nhamf_Communication_HnMessageTransfer to the hAMF 70. This message includes the CIoT User Data Container, the PDU Session ID.

[0502] <S3, S4>

[0503] In S3, the hAMF 70 generates the hNAS Container. This hNAS Container includes the CIoT User Data Container. In S4, the hAMF 70 encrypts and integrity protects the hNAS Container by hNAS security.

[0504] <S5, S6>

[0505] In S5, the hAMF 70 sends Nvamf_Communication_HtoV_HN1_MessageTransfer to the vAMF 30. This message includes the hNAS Container, the PDU Session ID.

[0506] In S6, the vAMF 30 sends NGAP DL NAS Transport (TS 38.413, 9.2.5.2) to the RAN 10. This message includes the vNAS DL NAS Transport IE. This IE includes the hNAS Container, the PDU Session ID.

[0507] <S7~S10>

[0508] In S7, the RAN 10 transmits a DL information transfer (TS 38.331, 5.7.1.1) to the terminal 20. This message includes a vNAS DL NAS transport IE.

[0509] In S9, the terminal 20 decrypts and integrity verifies the vNAS DL NAS transport IE by vNAS security. In S10, the terminal 20 decrypts and integrity verifies the hNAS container by hNAS security.

[0510] With the above, the NEF-based non-IP data transfer (terminal-terminated) is completed.

[0511] According to the 2nd embodiment described above, the terminal 20 can securely perform the user small data transfer even in the case where the HPLMN does not trust the VPLMN.

[0512] In addition, as described in the 2nd embodiment, the terminal 20 receives the identifier included in the PDU session establishment accept message, which indicates whether the PDU session is for "Control Plane CIoT 5GS Optimization UPF Anchor Data Transfer" or for "NEF-based Non-IP Data Transfer", and discriminates the device-oriented (e.g., UPF, AMF) technology for the concealment and integrity protection of the user small data based on the identifier, not limited to the time of roaming, but also applicable to the time of non-roaming. Further, the technology of the 2nd embodiment can be applied to the user small data transfer mode other than "Control Plane CIoT 5GS Optimization UPF Anchor Data Transfer" and "NEF-based Non-IP Data Transfer" (e.g., a new transfer mode to be appeared in future).

[0513] (Device structure)

[0514] Next, a functional structure example of the network node device 5 and the terminal 20 that implement the processes and actions described above will be described.

[0515] <Network node device 5>

[0516] Figure 31 is a diagram showing an example of the functional structure of the network node device 5. The network node device 5 can be any one of the RAN 10 (base station 10), the vAMF 30, the vSMF 40, the vUPF 50, the vUDM 60, the hAMF 70, the hSMF 80, the hUPF 90, the AUSF 100, the hUDM 110, and the NEF 120.

[0517] As shown in Figure 31 , the network node device 5 has a transmission section 115, a reception section 125, a setting section 130, and a control section 140. Figure 31 The functional configuration shown is merely an example. The functional divisions and the names of the functional sections can be arbitrary as long as the actions of the embodiments of the present application can be implemented.

[0518] The transmission section 115 includes a function of generating information to be transmitted to the terminal 20 or another network node device and transmitting the information through wire or wirelessly. The reception section 125 receives various information transmitted from the terminal 20 or another network node device.

[0519] The setting section 130 stores various setting information in the storage device and reads out the setting information from the storage device as necessary.

[0520] The control section 140 performs control of the entire device. The functional section in the control section 140 related to information transmission can be included in the transmission section 110, and the functional section in the control section 140 related to information reception can be included in the reception section 120. Alternatively, the transmission section 115 can be referred to as a transmitter, and the reception section 125 can be referred to as a receiver.

[0521] <terminal 20>

[0522] Figure 32 is a diagram showing an example of the functional configuration of the terminal 20. As shown in Figure 32 The terminal 20 has a transmission section 210, a reception section 220, a setting section 230, and a control section 240. Figure 32 The functional configuration shown is merely an example. The functional divisions and the names of the functional sections can be arbitrary as long as the actions of the embodiments of the present application can be implemented. The transmission section 210 and the reception section 220 can be collectively referred to as a communication section.

[0523] The transmission section 210 generates a transmission signal from transmission data and transmits the transmission signal in a wireless manner. The reception section 220 receives various signals in a wireless manner and acquires higher layer signals from the received physical layer signals. Further, the reception section 220 has a function of receiving an NR-PSS, an NR-SSS, an NR-PBCH, a DL / UL / SL control signal, a PDCCH-based DCI, a PDSCH-based data, and the like, which are transmitted from the base station 10. Further, for example, the transmission section 210 can transmit a PSCCH (Physical Sidelink Control Channel), a PSSCH (Physical Sidelink Shared Channel), a PSDCH (Physical Sidelink Discovery Channel), a PSBCH (Physical Sidelink Broadcast Channel), and the like, as D2D communication to other terminal 20, and the reception section 220 can receive the PSCCH, the PSSCH, the PSDCH, the PSBCH, and the like, from the other terminal 20.

[0524] The setting section 230 saves various setting information received from the base station 10 or other terminals by the reception section 220 in a storage device included in the setting section 230 and reads out from the storage device as necessary. Further, the setting section 230 also stores setting information set in advance.

[0525] The control section 240 performs control of the terminal 20. It is also possible to include a functional section related to signal transmission in the control section 240 in the transmission section 210 and a functional section related to signal reception in the control section 240 in the reception section 220. In addition, the transmission section 210 can be referred to as a transmitter and the reception section 220 can be referred to as a receiver.

[0526] According to the present embodiment, at least the following Notes 1 to 4 are disclosed.

[0527] <Note 1>

[0528] (Note Item 1)

[0529] A terminal including:

[0530] a control section that, with respect to a network node device that handles mobility control or connection control, performs concealment and integrity protection on a first message related to authentication control or service provision control; and

[0531] a transmission unit that transmits the first message subjected to the concealment and the integrity protection to the network as a second message related to the mobility control or the connection control.

[0532] (Paragraph 2)

[0533] The terminal according to Paragraph 1, wherein the network node device is an AMF provided in a VPLMN.

[0534] (Paragraph 3)

[0535] A network node device having:

[0536] a control unit that, for another network node device that handles mobility control or connection control, conceals a message related to authentication control or service provision control and performs integrity protection; and

[0537] a transmission unit that transmits the message to a terminal via the other network node device.

[0538] (Paragraph 4)

[0539] The network node device according to Paragraph 3, wherein the network node device is provided in an HPLMN, and the other network node device is provided in a VPLMN.

[0540] (Paragraph 5)

[0541] A network node device having:

[0542] a control unit that receives a message related to mobility control or connection control from a terminal, and determines necessity of re-authentication based on a key set identifier included in the message; and

[0543] a transmission unit that, in the case where re-authentication is necessary, forwards the message to another network node device that handles authentication control or service provision control.

[0544] (Paragraph 6)

[0545] A communication method performed by a terminal, comprising:

[0546] concealing a first message related to authentication control or service provision control and performing integrity protection for a network node device that handles mobility control or connection control; and

[0547] transmitting the first message subjected to the concealment and the integrity protection to the network as a second message related to the mobility control or the connection control.

[0548] According to any one of the supplementary note 1 to the supplementary note 6, each provides a technology in which a terminal can securely communicate while roaming even in a case where a HPLMN does not trust a VPLMN. According to the supplementary note 2, the supplementary note 4, a network node device provided in the HPLMN / VPLMN becomes clear.

[0549] <supplementary note 2>

[0550] (Supplementary note 1)

[0551] A network node device has:

[0552] a transmission section that assigns an identifier that cooperates with a terminal context in another network node device that handles authentication control or service provision control to the other network node device, and transmits a message including the identifier to the other network node device; and

[0553] a control section that performs processing of mobile control or connection control using the identifier, not using a permanent identifier of a terminal.

[0554] (Supplementary note 2)

[0555] The network node device according to the supplementary note 1, wherein the other network node device is provided in a HPLMN, and the network node device is provided in a VPLMN.

[0556] (Supplementary note 3)

[0557] A network node device has:

[0558] a reception section that receives an instruction from a first network node device that decides establishment of a session based on a request from a terminal; and

[0559] a control section that sets a data relay path related to a session of an object based on the instruction, using a terminal temporary identifier assigned by a second network node device that performs processing of mobile control or connection control, and a session identifier assigned by a terminal, not using a permanent identifier of the terminal.

[0560] (Supplementary note 4)

[0561] The network node device according to the supplementary note 3, wherein the first network node device is provided in a HPLMN, and the second network node device and the network node device are provided in a VPLMN.

[0562] (Supplementary note 5)

[0563] A communication method executed by a network node device includes:

[0564] allocating an identifier that cooperates with a terminal context in another network node device that handles authentication control or service provision control to the other network node device, sending a message containing the identifier to the other network node device; and

[0565] The processing of the mobile control or the connection control is performed using the identifier without using a permanent identifier of the terminal.

[0566] According to any one of the Embodiment 1 to Embodiment 5, a technology is provided in which a terminal can securely communicate while roaming even in a case where a HPLMN does not trust a VPLMN. According to the Embodiment 2, the Embodiment 4, the network node device provided in the HPLMN / VPLMN is made clear.

[0567] <Embodiment 3>

[0568] (Embodiment 1)

[0569] A network node device has:

[0570] a receiving section that receives a terminal security capability and a key from a first network node device that handles authentication control or service provision control;

[0571] a control section that selects a security algorithm for secure communication between a terminal and a second network node device, and derives a confidentiality key and an integrity protection key; and

[0572] a sending section that sends the security algorithm, the confidentiality key, and the integrity protection key to the second network node device, and sends the security algorithm to the terminal.

[0573] (Embodiment 2)

[0574] The network node device according to Embodiment 1, wherein the first network node device is an AMF, and the second network node device is a UPF.

[0575] (Embodiment 3)

[0576] A terminal has:

[0577] a control section that, in a security protocol layer in a user plane protocol stack, performs encryption and integrity protection on each packet for a QoS flow, except for predetermined header information, and passes the packet on which the encryption and the integrity protection have been performed to a protocol layer below the security protocol layer; and

[0578] a sending section that sends each packet on which the encryption and the integrity protection have been performed.

[0579] (Embodiment 4)

[0580] The terminal according to the supplementary note 3, wherein the protocol layer below the security protocol layer is SDAP, and the control section decrypts a packet passed from the SDAP in the security protocol layer, and verifies the integrity of the packet.

[0581] (Supplementary note 5)

[0582] A communication method performed by a network node device, comprising:

[0583] receiving terminal security capabilities and keys from a first network node device that handles authentication control or service provision control;

[0584] selecting security algorithms for secure communication between the terminal and a second network node device, and deriving a confidentiality key and an integrity protection key; and

[0585] sending the security algorithms, the confidentiality key, and the integrity protection key to the second network node device, and sending the security algorithms to the terminal.

[0586] According to any one of the supplementary notes 1 to 5, each provides a technique in which a terminal can securely communicate while roaming even if a HPLMN does not trust a VPLMN. According to the supplementary note 2, the network node device becomes explicit. According to the supplementary note 4, the action at the time of verification becomes explicit.

[0587] <Supplementary note 4>

[0588] (Supplementary note 1)

[0589] A terminal having:

[0590] a reception section that receives a session establishment permission message from a network; and

[0591] a control section that decides a communication object of user small data that is subjected to confidentiality and integrity protection, based on an identifier that identifies a user small data transmission method included in the session establishment permission message.

[0592] (Supplementary note 2)

[0593] The terminal according to the supplementary note 1, wherein the user small data transmission method identified by the identifier is control plane CIoT 5GS optimization UPF anchor data transmission, or NEF-based non-IP data transmission.

[0594] (Supplementary note 3)

[0595] The terminal according to the supplementary note 2, wherein the communication object is a UPF when the user small data transmission method is a control plane CIoT 5GS optimization UPF anchor data transmission, and the communication object is an AMF when the user small data transmission method is a NEF-based non-IP data transmission.

[0596] (Supplementary note 4)

[0597] A communication method executed by a terminal, comprising:

[0598] receiving a session establishment permission message from a network; and

[0599] deciding a communication object of user small data subjected to concealment and integrity protection, based on an identifier identifying a user small data transmission method included in the session establishment permission message.

[0600] According to any one of the supplementary notes 1 to 4, a technique is provided in which a terminal can securely perform transmission of user small data. According to the supplementary notes 2 and 3, the present technique can be applied to a specific user small data transmission method.

[0601] (Hardware structure)

[0602] The block diagram used in the description of the above-described embodiments Figure 31~Figure 32 represents a functional unit. These functional blocks (structural units) are realized by any combination of at least one of hardware and software. Furthermore, the method of realizing each functional block is not particularly limited. That is, each functional block can be realized using one device that is physically or logically integrated, or two or more devices that are physically or logically separated can be directly or indirectly (for example, using wired, wireless, or the like) connected and realized using the plurality of devices. The functional blocks can also be realized in combination with software in the above-described one device or the above-described plurality of devices.

[0603] The functions include judgment, decision, determination, calculation, computation, processing, derivation, investigation, search, confirmation, reception, transmission, output, access, resolution, selection, election, establishment, comparison, assumption, expectation, consideration, broadcasting, notifying, communicating, forwarding, configuring, reconfiguring, allocating, mapping, assigning, and the like, but are not limited to these. For example, a functional block (structural unit) that functions to transmit is called a transmitting unit or a transmitter. In any case, as described above, the method of realization is not particularly limited.

[0604] For example, the network node apparatus 5 and the terminal 20 and the like in one embodiment of the present disclosure can also function as a computer that performs the processing of the communication method of the present disclosure. Figure 33 is a diagram illustrating an example of a hardware structure of the network node apparatus 5 and the terminal 20 of one embodiment of the present disclosure. The network node apparatus 5 and the terminal 20 described above can also be physically configured as a computer apparatus including a processor 1001, a storage 1002, an auxiliary storage 1003, a communication apparatus 1004, an input apparatus 1005, an output apparatus 1006, a bus 1007, and the like. The network node apparatus other than the authorization apparatus 40 and the user information disclosure apparatus 50 also has the structure illustrated. Figure 33

[0605] In addition, in the following description, the expression "apparatus" can be replaced with "circuit," "device," "unit," and the like. The hardware structure of the network node apparatus 5 and the terminal 20 can be configured to include one or a plurality of each of the illustrated apparatuses, or can be configured not to include a part of the apparatuses.

[0606] Each function in the network node apparatus 5 and the terminal 20 is realized by the processor 1001 performing an operation, controlling communication of the communication apparatus 1004, or controlling at least one of reading and writing of data in the storage 1002 and the auxiliary storage 1003, by reading in predetermined software (program) on the hardware of the processor 1001, the storage 1002, and the like.

[0607] The processor 1001 controls the entire computer, for example, by causing an operating system to operate. The processor 1001 can also be configured by a central processing device (CPU: Central Processing Unit) including an interface with a peripheral device, a control device, an arithmetic device, a register, and the like. For example, the control section 140, the control section 240, and the like described above can also be realized by the processor 1001.

[0608] ​Further, the processor 1001 reads out programs (program codes), software modules, or data, etc., from at least one of the auxiliary storage device 1003 and the communication device 1004 to the storage device 1002, and executes various processes according to the programs. As the program, a program that causes a computer to execute at least a part of the operations described in the above-described embodiments is used. For example, the control section 140 can also be realized by a control program saved in the storage device 1002 and worked in the processor 1001. Further, for example, the control section 240 can also be realized by a control program saved in the storage device 1002 and worked in the processor 1001. Although the above-described various processes are described as being executed by one processor 1001, the above-described various processes can also be executed simultaneously or sequentially by two or more processors 1001. The processor 1001 can also be realized by one or more chips. Further, the program can also be transmitted from a network via a telecommunication line.

[0609] The storage device 1002 is a computer-readable recording medium, and can be constituted by at least one of, for example, a ROM (Read Only Memory), an EPROM (Erasable Programmable ROM), an EEPROM (Electrically Erasable Programmable ROM), a RAM (Random Access Memory), or the like. The storage device 1002 can also be referred to as a register, a cache, a main memory (main storage device), or the like. The storage device 1002 can hold programs (program codes), software modules, or the like that can be executed in order to implement the communication method related to one embodiment of the present disclosure.

[0610] The auxiliary storage device 1003 is a computer-readable recording medium, and can be constituted by at least one of, for example, an optical disk such as a CD-ROM (Compact Disc ROM), a hard disk drive, a flexible disk, a magneto-optical disk (for example, a compact disk, a digital versatile disk, a Blu-ray (registered trademark) disk, a smart card, a flash memory (for example, a card, a stick, a key drive), a Floppy (registered trademark) disk, a magnetic stripe, or the like. The above-described storage medium can be, for example, a database, a server, and other appropriate medium that includes at least one of the storage device 1002 and the auxiliary storage device 1003.

[0611] The communication device 1004 is hardware (transmitting / receiving device) for communication between computers via at least one of a wired network and a wireless network, and can also be referred to as a network device, a network controller, a network card, a communication module, and the like. The communication device 1004 can also be configured to include a high-frequency switch, a duplexer, a filter, a frequency synthesizer, and the like to implement at least one of frequency division duplex (FDD) and time division duplex (TDD). For example, a transceiving antenna, an amplifying section, a transmitting / receiving section, a transmission path interface, and the like can also be implemented by the communication device 1004. The transmitting / receiving section can also be implemented physically or logically by a transmitting section and a receiving section.

[0612] The input device 1005 is an input device (for example, a keyboard, a mouse, a microphone, a switch, a button, a sensor, and the like) that receives an input from the outside. The output device 1006 is an output device (for example, a display, a speaker, an LED lamp, and the like) that performs an output to the outside. In addition, the input device 1005 and the output device 1006 can also be integrally configured (for example, a touch panel).

[0613] Further, the processor 1001 and each of the devices such as the storage device 1002 are connected through a bus 1007 for communication of information. The bus 1007 can be configured by a single bus, or can be configured by different buses between the devices.

[0614] In addition, the network node device 5 and the terminal 20 can also be configured to include a microprocessor, a digital signal processor (DSP), an ASIC (Application Specific Integrated Circuit), a PLD (Programmable Logic Device), an FPGA (Field Programmable Gate Array), and the like, and a part or all of each functional block can also be implemented by the hardware. For example, the processor 1001 can also be implemented using at least one of these hardware.

[0615] In addition, the network node device 5 or the terminal 20 can also be provided in the vehicle 2001. Figure 34 A configuration example of the vehicle 2001 is shown. As shown in FIG. 20, the vehicle 2001 includes a network node device 5 and a terminal 20. Figure 34 As shown, the vehicle 2001 has a drive section 2002, a steering section 2003, an accelerator pedal 2004, a brake pedal 2005, a gear lever 2006, front wheels 2007, rear wheels 2008, axles 2009, an electronic control section 2010, various sensors 2021 to 2029, an information service section 2012, and a communication module 2013. The network node apparatus 5 or the terminal 20 described in each form / embodiment in this disclosure can be applied to a communication apparatus mounted on the vehicle 2001, for example, to the communication module 2013.

[0616] The drive section 2002 is constituted by, for example, an engine, a motor, or a hybrid of an engine and a motor. The steering section 2003 includes at least a steering wheel (also referred to as a steering handle), and is configured to steer at least one of the front wheels and the rear wheels based on an operation of the steering wheel operated by a user.

[0617] The electronic control section 2010 is constituted by a microprocessor 2031, a memory (ROM, RAM) 2032, and a communication port (I / O port) 2033. Signals from the various sensors 2021 to 2029 possessed by the vehicle 2001 are input to the electronic control section 2010. The electronic control section 2010 can also be referred to as an ECU (Electronic Control Unit).

[0618] As the signals from the various sensors 2021 to 2029, there are a current signal from a current sensor 2021 that monitors a current of a motor, a rotational speed signal of the front wheels and the rear wheels acquired by a rotational speed sensor 2022, an air pressure signal of the front wheels and the rear wheels acquired by an air pressure sensor 2023, a vehicle speed signal acquired by a vehicle speed sensor 2024, an acceleration signal acquired by an acceleration sensor 2025, a depression amount signal of the accelerator pedal acquired by an accelerator pedal sensor 2029, a depression amount signal of the brake pedal acquired by a brake pedal sensor 2026, an operation signal of the gear lever acquired by a gear lever sensor 2027, a detection signal for detecting an obstacle, a vehicle, a pedestrian, or the like acquired by an object detection sensor 2028, and the like.

[0619] The information service section 2012 is constituted by various devices for providing (outputting) various information such as driving information, traffic information, entertainment information, and the like, and one or more ECUs that control these devices, such as a car navigation system, an audio system, a speaker, a television, a radio. The information service section 2012 provides various multimedia information and multimedia services to the occupants of the vehicle 2001 using information acquired from an external device via the communication module 2013 or the like. The information service section 2012 can include an input device that accepts input from the outside (for example, a keyboard, a mouse, a microphone, a switch, a button, a sensor, a touch panel, or the like), and can include an output device that implements output to the outside (for example, a display, a speaker, an LED lamp, a touch panel, or the like).

[0620] The drive assist system section 2030 is constituted by various devices such as a millimeter wave radar, a LiDAR (Light Detection and Ranging), a camera, a positioner for positioning (for example, a GNSS or the like), map information (for example, a high-definition (HD) map, an autonomous vehicle (AV) map, or the like), a gyro system (for example, an IMU (Inertial Measurement Unit), an INS (Inertial Navigation System), or the like), an AI (Artificial Intelligence) chip, an AI processor, and one or more ECUs that control these devices, for providing a function of preventing an accident or reducing the driving load on the driver. In addition, the drive assist system section 2030 transmits and receives various information via the communication module 2013, and implements a drive assist function or an autonomous driving function.

[0621] The communication module 2013 is capable of communicating with the microprocessor 2031 and the constituent elements of the vehicle 2001 via a communication port. For example, the communication module 2013 transmits and receives data between the microprocessor 2031 and the memory (ROM, RAM) 2032, the sensors 2021 to 2029, and the drive section 2002, the steering section 2003, the accelerator pedal 2004, the brake pedal 2005, the shift lever 2006, the front wheels 2007, the rear wheels 2008, the axles 2009, and the electronic control section 2010 possessed by the vehicle 2001 via the communication port 2033.

[0622] The communication module 2013 is capable of being controlled by the microprocessor 2031 of the electronic control section 2010, and is a communication device capable of communicating with an external device. For example, various information is transmitted and received between the external device via wireless communication. The communication module 2013 can be located inside or outside the electronic control section 2010. The external device can also be a base station, a mobile station, or the like, for example.

[0623] The communication module 2013 can also transmit at least one of the signals input to the electronic control portion 2010 from the various sensors 2021-2028 described above, information obtained based on the signals, and information based on input from the outside (user) obtained via the information service portion 2012 to an external device via wireless communication. The electronic control portion 2010, the various sensors 2021-2028, the information service portion 2012, and the like can also be referred to as input portions that accept input. For example, the PUSCH transmitted by the communication module 2013 can include information based on the input described above.

[0624] The communication module 2013 receives various information (traffic information, signal information, inter-vehicle information, and the like) transmitted from an external device and displays it on the information service portion 2012 possessed by the vehicle 2001. The information service portion 2012 can also be referred to as an output portion that outputs information (for example, outputs information to a display, a speaker, and the like based on PDSCH (or data / information decoded from the PDSCH) received by the communication module 2013). Furthermore, the communication module 2013 stores various information received from an external device in the memory 2032 that is available to the microprocessor 2031. The microprocessor 2031 can also perform control of the drive portion 2002, the steering portion 2003, the accelerator pedal 2004, the brake pedal 2005, the shift lever 2006, the front wheels 2007, the rear wheels 2008, the axles 2009, the sensors 2021-2029, and the like possessed by the vehicle 2001 based on the information stored in the memory 2032.

[0625] (Supplement to Embodiments)

[0626] The above describes embodiments of the present application, but the disclosed application is not limited to such embodiments, and those skilled in the art will understand various modifications, changes, alternatives, substitutions, and the like. Specific numerical examples are used to facilitate understanding of the application, but these numerical examples are only examples, and appropriate arbitrary values can be used unless otherwise specified. The items in the above description are not essential to the present application, and two or more of the items described in the items can be combined as needed, or the item can be applied to the item described in another item (as long as there is no contradiction). The boundaries of the functional blocks or processing blocks in the functional block diagram do not necessarily correspond to the boundaries of physical components. The actions of multiple functional blocks can be performed by one physical component, or the actions of one functional block can be performed by multiple physical components. The order of the processes described in the embodiments can be changed as long as there is no contradiction. The network node device 5 and the terminal 20 are described using functional block diagrams for convenience of processing description, but such devices can also be implemented by hardware, software, or a combination thereof. Software that acts according to the embodiments of the present application by the processor of the base station 10 and software that acts according to the embodiments of the present application by the processor of the terminal 20 can each be stored in a random access memory (RAM), a flash memory, a read only memory (ROM), an EPROM, an EEPROM, a register, a hard disk (HDD), a removable disk, a CD-ROM, a database, a server, and other appropriate arbitrary storage media.

[0627] Further, the notification of the information is not limited to the forms / embodiments described in the present disclosure, and other methods can be used. For example, the notification of the information can be implemented by physical layer signaling (e.g., DCI (Downlink Control Information), UCI (Uplink Control Information)), higher layer signaling (e.g., RRC (Radio Resource Control) signaling, MAC (Medium Access Control) signaling, broadcast information (MIB (Master Information Block), SIB (System Information Block)), other signals, or a combination thereof. Further, the RRC signaling can also be referred to as an RRC message, and for example, can be an RRC Connection Setup message, an RRC Connection Reconfiguration message, or the like.

[0628] The forms / embodiments described in this disclosure can also be applied to at least one of systems using LTE (Long Term Evolution), LTE-A (LTE-Advanced), SUPER 3G, IMT-Advanced, 4G (4th generation mobile communication system), 5G (5th generation mobile communication system), 6th generation mobile communication system (6G), xth generation mobile communication system (xG) (xG (x is an integer, a fraction, etc.), FRA (Future Radio Access), NR (new Radio), new radio access (NX), future generation radio access (FX), W-CDMA (registered trademark), GSM (registered trademark), CDMA2000, UMB (Ultra Mobile Broadband), IEEE 802.11 (Wi-Fi (registered trademark)), IEEE 802.16 (WiMAX (registered trademark)), IEEE 802.20, UWB (Ultra-WideBand), Bluetooth (registered trademark), other appropriate systems, and next-generation systems extended, modified, created, and specified based on these systems. In addition, a plurality of systems (for example, at least one of LTE and LTE-A and 5G, etc.) can be combined and applied.

[0629] For the processes, timing, flow, and the like of the forms / embodiments described in this specification, the order can be changed without contradiction. For example, for the methods described in this disclosure, the elements of various steps are prompted using the order of the examples, but are not limited to the specific order prompted.

[0630] In the present specification, specific actions performed by the base station 10 are sometimes also performed by an upper node thereof according to the situation. In a network constituted by one or a plurality of network nodes having the base station 10, it is obvious that various actions performed for communication with the terminal 20 can be performed by at least one of the base station 10 and other network nodes (for example, consider an MME or an S-GW or the like, but not limited to these) other than the base station 10. In the above, a case where the other network node other than the base station 10 is one is exemplified, but the other network node can also be a combination of a plurality of other network nodes (for example, an MME and an S-GW).

[0631] Information or a signal and the like explained in the present disclosure can be output from a higher layer (or a lower layer) to a lower layer (or a higher layer). It can also be input or output via a plurality of network nodes.

[0632] Information and the like input or output can be saved in a specific location (for example, a memory), and can be managed using a management table. Information and the like input or output can be rewritten, updated, or appended. Information and the like output can also be deleted. Information and the like input can also be transmitted to other apparatuses.

[0633] Determination in the present disclosure can be performed by a value (0 or 1) represented by 1 bit, by a Boolean value (true or false), or by comparison of numerical values (for example, comparison with a predetermined value).

[0634] As for software, regardless of being called software, firmware, middleware, microcode, hardware description language, or by another name, it should be broadly interpreted as meaning a command, a command set, code, a code segment, program code, a program, a subprogram, a software module, an application, a software application, a software package, a routine, a sub routine, an object, an executable file, an execution thread, a procedure, a function, and the like.

[0635] In addition, software, commands, information, and the like can also be transmitted and received via a transmission medium. For example, in a case where software is transmitted from a web page, a server, or another remote source using at least one of wired technology (coaxial cable, optical fiber cable, twisted pair cable, digital subscriber line (DSL), and the like) and wireless technology (infrared rays, microwaves, and the like), at least one of these wired technology and wireless technology is included in the definition of the transmission medium.

[0636] The information, signals, and / or the like described in the present disclosure can be represented using various different technologies and / or techniques. For example, data, commands, instructions, information, signals, bits, symbols, chips, and / or the like that can be referenced throughout the above description can be represented by voltages, currents, electromagnetic waves, magnetic fields or particles, optical fields or particles, or any combination thereof.

[0637] In addition, the terms described in the present disclosure and the terms required for understanding the present disclosure can be replaced with terms having the same or similar meanings. For example, at least one of a channel and a symbol can also be a signal (signaling). Also, a signal can be a message. Also, a component carrier (CC) can be referred to as a carrier frequency, a cell, a frequency carrier, or the like.

[0638] The terms "system" and "network" used in the present disclosure can be used interchangeably.

[0639] In addition, the information, parameters, and / or the like described in the present disclosure can be represented using absolute values, relative values with respect to predetermined values, or corresponding other information. For example, a radio resource can be indicated using an index.

[0640] The names used for the above-described parameters are non-limiting names in any respect. Furthermore, the mathematical expressions and / or the like using these parameters are sometimes different from those explicitly disclosed in the present disclosure. Various channels (e.g., PUCCH, PDCCH, and / or the like) and information elements can be identified by all appropriate names, and thus various names assigned to the various channels and information elements are non-limiting names in any respect.

[0641] In the present disclosure, the terms "base station (BS)", "wireless base station", "base station", "fixed station", "NodeB", "eNodeB (eNB)", "gNodeB (gNB)", "access point", "transmission point", "reception point", "transmission / reception point", "cell", "sector", "cell group", "carrier", "component carrier", and / or the like can be used interchangeably. The base station is sometimes referred to as a macro cell, a small cell, a femto cell, a pico cell, and / or the like.

[0642] A base station can accommodate one or plural (for example, 3) cells. In a case where a base station accommodates plural cells, the coverage area of the base station as a whole can be divided into plural smaller areas, and each of the smaller areas can also be provided with a communication service by a base station subsystem (for example, a small-sized base station RRH: Remote Radio Head for indoor use). The term "cell" or "sector" refers to a part or the whole of the coverage area of at least one of the base station and the base station subsystem that provides a communication service in the coverage area.

[0643] In the present disclosure, the base station transmitting information to the terminal can also be replaced with the base station instructing the terminal of a control / action based on the information.

[0644] In the present disclosure, the terms "mobile station (MS)", "terminal (user terminal)", "terminal (UE: User Equipment)", "terminal", and the like can be used interchangeably.

[0645] For a mobile station, the following terms are also used by those skilled in the art: subscriber station, mobile unit, subscriber unit, wireless unit, remote unit, mobile device, wireless device, wireless communication device, remote device, mobile subscriber station, access terminal, mobile terminal, wireless terminal, remote terminal, handset, user agent, mobile client, client, or some other suitable terminology.

[0646] At least one of the network node device 5 and the terminal 20 can be referred to as a transmission device, a reception device, a communication device, or the like. Furthermore, at least one of the network node device 5 and the terminal 20 can also be a device mounted on a mobile body, the mobile body itself, or the like. The mobile body refers to an object that can move, and the moving speed is arbitrary. In addition, of course, a case where the mobile body is stopped is also included. The mobile body includes, for example, a vehicle, a transport vehicle, an automobile, a motorcycle, a bicycle, a connected car, a shovel car, a bulldozer, a wheel loader, a dump truck, a forklift, a train, a bus, a rear car, a rickshaw, a ship and other watercraft, an airplane, a rocket, an artificial satellite, a drone (registered trademark), a multicopter, a quadcopter, a balloon, and an object mounted thereon, and is not limited thereto. In addition, the mobile body can also be a mobile body that autonomously travels based on a travel instruction. It can be a vehicle (for example, a car, an airplane, or the like), a mobile body that moves in a unmanned manner (for example, a drone, a self-driving car, or the like), or a robot (manned or unmanned). In addition, at least one of the base station and the mobile station also includes a device that does not necessarily move at the time of communication. For example, at least one of the base station and the mobile station can be an IoT (Internet of Things) device such as a sensor.

[0647] Furthermore, the base station in the present disclosure can also be replaced with a terminal. For example, a structure in which communication between the base station and the terminal is replaced with communication between a plurality of terminals 20 (for example, also referred to as D2D (Device-to-Device), V2X (Vehicle-to-Everything), or the like) can also apply the forms / embodiments of the present disclosure. In this case, the terminal 20 can also be configured to have the functions of the base station 10 described above. Furthermore, the expressions "uplink" and "downlink" and the like can be replaced with expressions corresponding to communication between terminals (for example, "side"). For example, the uplink channel, the downlink channel, and the like can be replaced with a side channel.

[0648] Likewise, the terminal in the present disclosure can also be replaced with a base station. In this case, the base station can also be configured to have the functions of the terminal described above.

[0649] The terms "determining" and "deciding" as used in the present disclosure also include a variety of actions. For example, "determining" and "deciding" can include acts of "judging", "calculating", "computing", "processing", "deriving", "investigating", "looking up", "searching", "inquiring" (for example, searching in a table, a database, or another data structure), "ascertaining", and the like. In addition, "determining" and "deciding" can include acts of "receiving" (for example, receiving information), "transmitting" (for example, transmitting information), "inputting", "outputting", "accessing" (for example, accessing data in a memory), and the like. Furthermore, "determining" and "deciding" can include acts of "resolving", "selecting", "choosing", "establishing", "comparing", and the like. That is, "determining" and "deciding" can include acts of considering certain actions as "determining" and "deciding". In addition, "determining" and "deciding" can be replaced by "assuming", "expecting", "considering", and the like.

[0650] The terms "connected" and "coupled" or all modifications thereof mean all possible direct or indirect connections or couplings between the elements, which can include the existence of one or more intermediate elements between two elements "connected" or "coupled" to each other. The coupling or connection between the elements can be a physical or logical coupling or connection, or a combination thereof. For example, "connected" can be replaced by "accessed". In the present disclosure, it can be considered that two elements are "connected" or "coupled" to each other using at least one of a wire, a cable, and a printed electric connection, and as some non-limiting and non-inclusive examples, electromagnetic energy having a wavelength in a radio frequency region, a microwave region, and an optical region (including both visible and invisible regions) is used to "connect" or "couple" to each other.

[0651] The reference signal can be simply referred to as RS (Reference Signal), and can be referred to as a pilot (Pilot) depending on the applied standard.

[0652] The expression "based on" as used in the present disclosure is not intended to mean "only based on" unless specifically stated otherwise. In other words, the expression "based on" means both "only based on" and "at least based on".

[0653] Any reference to elements using the expressions "1st", "2nd", and the like used in the present disclosure does not necessarily limit the number or order of the elements. These expressions can be used in the present disclosure as a convenient method of distinguishing between two or more elements. Thus, a reference to a 1st element and a 2nd element does not mean that only two elements can be taken or that in any form the 1st element must precede the 2nd element.

[0654] The expression "unit" in the structure of each of the above-described apparatuses can be replaced with "part", "circuit", "device", or the like.

[0655] When the expressions "include", "including", and variations thereof are used in the present disclosure, these expressions mean the same as the expression "comprising". Also, the expression "or" used in the present disclosure does not mean the exclusive or.

[0656] A radio frame can be composed of one or more frames in the time domain. In the time domain, one or more frames can be referred to as a subframe. A subframe can be composed of one or more slots in the time domain. A subframe can also be a fixed length of time (e.g., 1 ms) independent of numerology.

[0657] A numerology can be a communication parameter applied to at least one of transmission and reception of a certain signal or channel. The numerology can indicate at least one of, for example, a subcarrier spacing (SCS), a bandwidth, a symbol length, a cyclic prefix length, a transmission time interval (TTI), a number of symbols per TTI, a radio frame structure, a specific filtering processing performed by a transceiver in the frequency domain, a specific windowing processing performed by a transceiver in the time domain, and the like.

[0658] A slot can be constituted by one or a plurality of symbols (OFDM (Orthogonal Frequency Division Multiplexing) symbols, SC-FDMA (Single Carrier Frequency Division Multiple Access) symbols, and the like) in the time domain. A slot can be a time unit based on a numerology.

[0659] A slot can include a plurality of mini-slots. Each mini-slot can be constituted by one or a plurality of symbols in the time domain. Further, a mini-slot can also be referred to as a sub-slot. A mini-slot can be constituted by a smaller number of symbols than a slot. A PDSCH (or PUSCH) transmitted in a time unit larger than a mini-slot can be referred to as PDSCH (or PUSCH) mapping type A. A PDSCH (or PUSCH) transmitted using a mini-slot can be referred to as PDSCH (or PUSCH) mapping type B.

[0660] A radio frame, a subframe, a slot, a mini-slot, and a symbol each represent a time unit in transmission of a signal. A radio frame, a subframe, a slot, a mini-slot, and a symbol can each be referred to by another corresponding term.

[0661] For example, 1 subframe can be referred to as a transmission time interval (TTI), a plurality of consecutive subframes can also be referred to as a TTI, 1 slot or 1 mini-slot can also be referred to as a TTI. That is, at least one of a subframe and a TTI can be a subframe (1 ms) in the existing LTE, can be a period shorter than 1 ms (for example, 1 to 13 symbols), or can be a period longer than 1 ms. In addition, a unit representing a TTI can not be referred to as a subframe, but can be referred to as a slot, a mini-slot, or the like. Further, 1 slot can be referred to as a unit time. A unit time can differ according to a numerology for each cell.

[0662] Here, a TTI, for example, refers to a minimum time unit of scheduling in wireless communication. For example, in an LTE system, a base station performs scheduling in which a radio resource (a frequency bandwidth, a transmission power, and the like, which can be used in each terminal 20) is allocated to each terminal 20 in units of a TTI. In addition, the definition of a TTI is not limited thereto.

[0663] A TTI can be a transmission time unit of a data packet (a transport block) after channel coding, a code block, a codeword, or the like, or can be a processing unit of scheduling, link adaptation, or the like. In addition, when a TTI is given, a time interval (for example, a number of symbols) in which a transport block, a code block, a codeword, or the like is actually mapped can be shorter than the TTI.

[0664] In addition, in a case where 1 slot or 1 mini-slot is referred to as a TTI, one or more TTIs (i.e., one or more slots or one or more mini-slots) can also be a minimum time unit of scheduling. Furthermore, the number of slots (mini-slots) constituting the minimum time unit of scheduling can also be controlled.

[0665] A TTI having a time length of 1 ms can also be referred to as a normal TTI (TTI in LTE Rel. 8-12), a normal TTI (normal TTI), a long TTI (long TTI), a normal subframe, a normal subframe (normal subframe), a long (long) subframe, a slot, etc. A TTI shorter than the normal TTI can also be referred to as a shortened TTI, a short TTI (short TTI), a partial TTI (partial or fractional TTI), a shortened subframe, a short (short) subframe, a mini-slot, a sub-slot, a slot, etc.

[0666] In addition, for a long TTI (long TTI) (e.g., a normal TTI, a subframe, etc.), it can be understood as a TTI having a time length of more than 1 ms, and for a short TTI (short TTI) (e.g., a shortened TTI, etc.), it can be understood as a TTI having a TTI length less than that of the long TTI (long TTI) and a TTI length of 1 ms or more.

[0667] A resource block (RB) is a resource allocation unit in the time domain and the frequency domain, and in the frequency domain, can include one or more contiguous subcarriers. The number of subcarriers included in the RB can be the same regardless of the numerology, for example, can be 12. The number of subcarriers included in the RB can also be determined according to the numerology.

[0668] In addition, the time domain of the RB can include one or more symbols, and can be the length of 1 slot, 1 mini-slot, 1 subframe, or 1 TTI. One TTI, one subframe, etc. can each be constituted by one or more resource blocks.

[0669] In addition, one or more RBs can also be referred to as a physical resource block (PRB), a subcarrier group (SCG), a resource element group (REG), a PRB pair, an RB pair, etc.

[0670] In addition, a resource block can be constituted by one or more resource elements (REs). For example, 1 RE can be a wireless resource area of 1 subcarrier and 1 symbol.

[0671] A bandwidth part (BWP: Bandwidth Part) (may also be referred to as a partial bandwidth, etc.) can also indicate a subset of contiguous common RBs (resource blocks) for a certain numerology in a certain carrier. Here, the common RBs can be determined by the index of the RBs with reference to a common reference point of the carrier. The PRB can be defined in a certain BWP and numbered within the BWP.

[0672] A BWP can include a BWP for UL (UL BWP) and a BWP for DL (DL BWP). One or more BWPs can be configured for a UE within one carrier.

[0673] At least one of the configured BWPs can be active, and a case where the UE transmits / receives a predetermined signal / channel outside the active BWP can not be assumed. In addition, "cell", "carrier", etc. in the present disclosure can be replaced with "BWP".

[0674] The structures of the radio frame, the subframe, the slot, the mini-slot, the symbol, etc. described above are merely examples. For example, the number of subframes included in the radio frame, the number of slots per subframe or radio frame, the number of mini-slots included in the slot, the number of symbols and RBs included in the slot or mini-slot, the number of subcarriers included in the RB, the number of symbols in the TTI, the symbol length, the cyclic prefix (CP) length, and the like can be variously changed.

[0675] In the present disclosure, for example, in a case where an article is added by a translation of a, an, and the in English, the present disclosure also includes a case where the article following these articles is plural.

[0676] In the present disclosure, the expression "A and B are different" can mean "A and B are mutually different". In addition, the expression can also mean "A and B are each different from C". The expressions "separate", "combine", and the like can also be interpreted as "different" as well.

[0677] Each form / implementation described in the present disclosure can be used alone, in combination, and can also be used with switching in conjunction with execution. Furthermore, notification of predetermined information (for example, notification of "X") is not limited to being performed explicitly, and can also be performed implicitly (for example, without notification of the predetermined information).

[0678] The present disclosure has been described in detail above, but it should be clear to those skilled in the art that the present disclosure is not limited to the embodiments described in the present disclosure. The present disclosure can be implemented as modifications and changes without departing from the spirit and scope of the present disclosure defined by the claims. Therefore, the purpose of the present disclosure is to illustrate, not to limit the present disclosure.

[0679] Label Explanation

[0680] 10 RAN

[0681] 20 terminal

[0682] 30 vAMF

[0683] 40 vSMF

[0684] 50 vUPF

[0685] 60 vUDM

[0686] 70 hAMF

[0687] 80 hSMF

[0688] 90 hUPF

[0689] 100 AUSF

[0690] 110 hUDM

[0691] 120 NEF

[0692] 115 transmission unit

[0693] 125 reception unit

[0694] 130 setting unit

[0695] 140 control unit

[0696] 210 transmission unit

[0697] 220 reception unit

[0698] 230 setting unit

[0699] 240 control unit

[0700] 1001 processor

[0701] 1002 storage device

[0702] 1003 auxiliary storage device

[0703] 1004 communication device

[0704] 1005 input device

[0705] 1006 output device

[0706] 2001 vehicle

[0707] 2002 drive section

[0708] 2003 steering section

[0709] 2004 accelerator pedal

[0710] 2005 brake pedal

[0711] 2006 gearshift lever

[0712] 2007 front wheel

[0713] 2008 rear wheel

[0714] 2009 axle

[0715] 2010 electronic control section

[0716] 2012 information service section

[0717] 2013 communication module

[0718] 2021 current sensor

[0719] 2022 rotation speed sensor

[0720] 2023 air pressure sensor

[0721] 2024 vehicle speed sensor

[0722] 2025 acceleration sensor

[0723] 2026 brake pedal sensor

[0724] 2027 gearshift lever sensor

[0725] 2028 object detection sensor

[0726] 2029 accelerator pedal sensor

[0727] 2030 drive assist system section

[0728] 2031 microprocessor

[0729] 2032 memory (ROM, RAM)

[0730] 2033 communication port (I / O port) ​

Claims

1. A terminal comprising: a control unit that conceals and performs integrity protection on a first message related to authentication control or service provision control for a network node device that processes mobility control or connection control; and The sending unit includes the first message that has been subjected to concealment and integrity protection in a second message related to mobility control or connection control and sends the message to the network.

2. The terminal according to claim 1, wherein: The network node device is an AMF set in the VPLMN.

3. A network node device comprising: a control unit that conceals and performs integrity protection on messages related to authentication control or service provision control from other network node devices that handle mobility control or connection control; and A sending unit sends the message to the terminal via the other network node device.

4. The network node device according to claim 3, wherein: The network node device is set in the HPLMN, and the other network node devices are set in the VPLMN.

5. A network node device comprising: a control unit that receives a message related to mobility control or connection control from a terminal and determines the necessity of re-authentication based on a key set identifier included in the message; and A sending unit forwards the message to other network node devices that handle authentication control or service provision control when re-authentication is required.

6. A communication method, executed by a terminal, comprising the following steps: For a network node device processing mobility control or connection control, concealing a first message related to authentication control or service provision control and performing integrity protection; and The first message that has been subjected to concealment and integrity protection is included in a second message related to mobility control or connection control and sent to the network.

Images