Method and apparatus to deliver multiple nas containers via a single access stratum message

Abstract

A method includes: receiving a first message from a second device by a first device, the first message including routing information associated with a corresponding network function among a plurality of network functions and a plurality of containers associated with the corresponding network function among the plurality of network functions, wherein each of the plurality of containers includes a corresponding encrypted non-access stratum (NAS) payload, and sending each container to the associated network function by the first device based on the routing information for the network function.

Description

Technical Field

[0001] Various example embodiments generally relate to wireless networks, and more specifically to the delivery of multiple non-access stratum (NAS) containers via a single access stratum message. Background Technology

[0002] In a distributed non-access stratum (NAS) architecture, multiple higher-layer messages (e.g., NAS messages) are sent from a user equipment (UE) to multiple network functions (NFs) using a single lower-layer message, and vice versa.

[0003] In a modular NAS with a point-to-point (P2P) interface for the Radio Access Network (RAN) - Core Network (CN) interface, the sender can send multiple NAS containers. These containers need to be protected and secured. Summary of the Invention

[0004] In one aspect of this disclosure, a method includes: receiving a first message from a second device by a first device, the first message including routing information associated with a corresponding network function among a plurality of network functions and a plurality of containers associated with the corresponding network function among the plurality of network functions, wherein each of the plurality of containers includes a corresponding encrypted non-access stratum (NAS) payload, and sending each container to the associated network function by the first device based on the routing information for the network function.

[0005] In one aspect of the method, the second device is a radio access network (RAN).

[0006] In one aspect of the method, the routing information includes a Service Temporary Mobile Subscriber Identifier (S-TMSI) for the associated network function.

[0007] In one aspect of this disclosure, a user equipment (UE) includes at least one processor and at least one memory storing instructions that, when executed by the at least one processor, cause the UE to perform at least any of the methods described above.

[0008] In one aspect of this disclosure, an apparatus includes at least one processor and at least one memory storing instructions, which, when executed by the at least one processor, cause the apparatus to perform at least any of the methods described above.

[0009] In one aspect of this disclosure, there is a processor-readable medium storing instructions that, when executed by at least one processor of a device, cause the device to perform at least any of the methods described above.

[0010] The subject matter of the independent claims is provided in several respects. Several other aspects are defined in the dependent claims. Attached Figure Description

[0011] Some exemplary embodiments will now be described with reference to the accompanying drawings.

[0012] Figure 1 This is a diagram of an example embodiment of wireless networking between a network system and a user equipment (UE) according to an illustrative aspect of this disclosure;

[0013] Figure 2 This is a diagram illustrating an example component of a network system according to an aspect of this disclosure;

[0014] Figure 3A This is a diagram illustrating an example of a distributed non-access stratum (NAS) architecture based on one aspect of this disclosure;

[0015] Figure 3B This is a diagram of another example of a distributed NAS architecture based on one aspect of this disclosure;

[0016] Figure 3C This is a diagram of another example of a distributed NAS architecture based on one aspect of this disclosure;

[0017] Figure 4A This is a diagram illustrating an example uplink transmission embodiment of signaling and operation between the UE NAS sublayer, UE access layer, RAN, and core network function (CN NF) according to one aspect of this disclosure;

[0018] Figure 4B This is a diagram illustrating an example downlink transmission embodiment of signaling and operation between the UE NAS sublayer, UE access layer, RAN, and CN NF according to an illustrative aspect of this disclosure; and

[0019] Figure 5 This is a diagram illustrating an example embodiment of a component of a UE or network device according to one aspect of this disclosure. Detailed Implementation

[0020] In the following description, certain specific details are set forth in order to provide a complete understanding of the disclosed aspects. However, those skilled in the art will recognize that the aspects may be practiced without one or more of these specific details or using other methods, components, materials, etc. In other instances, well-known structures associated with transmitters, receivers, or transceivers are not shown or described in detail to avoid unnecessarily obscuring the description of the aspects.

[0021] The reference to "an aspect" or "aspect" in this specification means that a particular feature, structure, or characteristic described in connection with that aspect is included in at least one aspect. Therefore, the appearance of the phrase "in an aspect" or "in one respect" in various places in this specification does not necessarily refer to the same aspect. Furthermore, a particular feature, structure, or characteristic may be combined in any suitable manner with one or more aspects.

[0022] The embodiments described in this disclosure can be implemented in wireless network devices, such as, but not limited to, devices utilizing: Global Microwave Access Interoperability (WiMAX), Global System for Mobile Communications (GSM, 2G), GSM EDGE Radio Access Network (GERAN), General Packet Radio Service (GRPS), Universal Mobile Telecommunications System based on Basic Wideband Code Division Multiple Access (W-CDMA) (UMTS, 3G), High-Speed ​​Packet Access (HSPA), Long Term Evolution (LTE), Advanced LTE, Enhanced LTE (eLTE), 5G New Radio (5G NR), Advanced 5G, 6G (and higher), and other wireless network systems such as 802.11ax (Wi-Fi 6). The term "eLTE" here refers to LTE evolution connected to a 5G core. LTE is also referred to as Evolved UMTS Terrestrial Radio Access (EUTRA) or Evolved UMTS Terrestrial Radio Access Network (EUTRAN).

[0023] This disclosure may use the term "serving network device" to refer to a network node or network device (or part thereof) serving a UE. As used herein, the terms "send to," "receive from," and "cooperate with" (and variations thereof) include communication that may or may not involve communication via one or more intermediate devices or nodes. The term "acquire" (and variations thereof) includes initial acquisition or reacquisition after initial acquisition. The term "connection" may mean a physical connection or a logical connection.

[0024] This disclosure uses 5G NR as an example of a wireless network, and may use smartphones and / or extended reality headsets as examples of UEs. It should be understood that such examples are merely illustrative, and this disclosure applies to other wireless networks and user equipment.

[0025] Figure 1This is a diagram illustrating an example of wireless networking between network system 100 and user equipment (UE) 150. Network system 100 may include one or more network nodes 120, one or more servers 110, and / or one or more network devices 130 (e.g., test devices). Network node 120 will be described in more detail below. As used herein, the term "network apparatus" may refer to any component of network system 100, such as server 110, network node 120, network device 130, any(multiple) components of the foregoing, and / or any(multiple) other components of network system 100. Examples of network apparatus include, but are not limited to, apparatuses for implementing various aspects of 5G NR. This disclosure describes embodiments related to 5G NR and embodiments relating to aspects defined by the 3rd Generation Partnership Project (3GPP). However, embodiments related to other wireless network technologies are also contemplated and are covered within the scope of this disclosure.

[0026] The following description provides further details of examples of network nodes. In a 5G NR network, a gNodeB (also known as a gNB) may include, for example, a node that provides (new radio) NR user plane and control plane protocol termination toward the UE and is connected to the 5G core (5GC) via an NG interface, for example, according to Section 3.2 of 3GPP TS 38.300 V16.6.0 (2021-06), which is incorporated herein by reference.

[0027] gNB supports various protocol layers, such as Layer 1 (L1) (i.e., the physical layer), Layer 2 (L2), and Layer 3 (L3).

[0028] NR's Layer 2 (L2) is broken down into the following sublayers: Media Access Control (MAC), Radio Link Control (RLC), Packet Data Convergence Protocol (PDCP), and Service Data Adaptation Protocol (SDAP), among which, for example: ○ The physical layer provides a transmission channel to the MAC sublayer; ○ The MAC sublayer provides logical channels to the RLC sublayer; ○ The RLC sublayer provides RLC channels to the PDCP sublayer; ○ The PDCP sublayer provides radio bearers to the SDAP sublayer; ○ The SDAP sublayer provides Quality of Service (QoS) flows to 5GC; ○ The control channels include the Broadcast Control Channel (BCCH) and the Physical Control Channel (PCCH).

[0029] Layer 3 (L3) includes, for example, Radio Resource Control (RRC) according to Section 6 of 3GPP TS 38.300 V16.6.0 (2021-06), which is incorporated herein by reference.

[0030] The gNB Central Unit (gNB-CU) includes, for example, a logical node that hosts, for example, the gNB's Radio Resource Control (RRC), Service Data Adaptation Protocol (SDAP), and Packet Data Convergence Protocol (PDCP), or the en-gNB's RRC and PDCP protocols. This logical node controls the operation of one or more gNB Distributed Units (gNB-DUs). The gNB-CU terminates the F1 interface connected to the gNB-DU. The gNB-CU may also be referred to herein as a CU, Central Unit, Centralized Unit, or Control Unit.

[0031] A gNB Distributed Unit (gNB-DU) includes, for example, a logical node that hosts, for example, the Radio Link Control (RLC), Media Access Control (MAC), and Physical (PHY) layers of a gNB or en-gNB, and its operation is partially controlled by the gNB-CU. A gNB-DU supports one or more cells. A cell is supported by only one gNB-DU. The gNB-DU terminates the F1 interface connected to the gNB-CU. The gNB-DU may also be referred to herein as a DU or Distributed Unit.

[0032] As used herein, the term "network node" may refer to any of a gNB, gNB-CU, or gNB-DU, or any combination thereof. RAN (Radio Access Network) nodes or network nodes (such as, for example, gNB, gNB-CU, or gNB-DU, or portions thereof) may be implemented using means, for example, having at least one processor and / or at least one memory having processor-readable instructions ("program") configured to support and / or supply and / or process functions and / or features associated with the CU and / or DU, and / or at least one protocol (sub) layer of the RAN (Radio Access Network), such as layer 2 and / or layer 3. Different functional divisions between central and distributed units are possible. Examples of such means and components will be provided below. Figure 5 To describe.

[0033] The gNB-CU and gNB-DU portions can be co-located or physically separated. For example, the gNB-DU can even be further divided into two parts, such as one part including processing equipment and the other part including antennas. The Central Unit (CU) can also be referred to as a Baseband Unit / Radio Equipment Controller / Cloud RAN / Virtual RAN (BBU / REC / C-RAN / V-RAN), Open RAN (O-RAN), or a portion thereof. The Distributed Unit (DU) can also be referred to as a Remote Radio Head / Remote Radio Unit / Radio Equipment / Radio Unit (RRH / RRU / RE / RU), or a portion thereof. In the various example embodiments of this disclosure below, a network node supporting at least one of the Central Unit functions or Layer 3 protocols of a radio access network can be, for example, a gNB-CU. Similarly, a network node supporting at least one of the Distributed Unit functions or Layer 2 protocols of a radio access network can be, for example, a gNB-DU.

[0034] A gNB-CU can support one or more gNB-DUs. A gNB-DU can support one or more cells, and therefore can support serving cells for user equipment (UE), or candidate cells for other processes such as handover, dual connectivity, and / or carrier aggregation.

[0035] User equipment (UE) 150 may be or include wireless or mobile devices, devices having a radio interface for interacting with a RAN (Radio Access Network), smartphones, in-vehicle devices, IoT devices, or M2M devices, and other types of user equipment. Such a UE 150 may include: at least one processor; and at least one memory including program code; wherein the at least one memory and the computer program code are configured, together with the at least one processor, to cause the device to perform at least certain operations, such as, for example, an RRC connection to the RAN. Examples of UE components will be combined. Figure 5 The following description is provided. In an embodiment, UE 150 may be configured to generate messages (e.g., including a cell ID) that will be transmitted to the RAN via radio (e.g., to reach and communicate with the serving cell). In an embodiment, UE 150 may generate, send, and receive RRC messages containing one or more RRC PDUs (Packet Data Units). Those skilled in the art will understand the RRC protocol and other processes that the UE may perform.

[0036] Continue to refer to Figure 1In the example of a 5G NR network, network system 100 provides one or more cells that define the coverage area of ​​network system 100. As described above, network system 100 may include a gNB of the 5G NR network, or may include any other means configured to control radio communications and manage radio resources within the cell. As used herein, the term "resource" may refer to radio resources such as resource blocks (RBs), physical resource blocks (PRBs), radio frames, subframes, time slots, subbands, frequency regions, subcarriers, beams, etc. In embodiments, network node 120 may be referred to as a base station.

[0037] Figure 1 An example is provided, and is merely an illustration of network system 100 and UE 150. Those skilled in the art will understand that network system 100 includes... Figure 1 Components not shown in the diagram will be understood, and other user devices may communicate with network system 100.

[0038] Figure 2 yes Figure 1 A block diagram of example components of network system 100. A 5G NR network can be described as an example of network system 100, and the aspects described below should also apply to other types of network systems. The network system can be configured according to... Figure 1 The signals and connections shown operate to enable UE 150 to communicate with network system 100 via radio access network 225. Additionally, as shown and described herein, the network system can be divided into user plane components and functions and control plane components and functions. Unless otherwise stated, the terms “component,” “function,” and “service” are used interchangeably herein, and they can refer to instructions executed by one or more processors and implemented by those instructions.

[0039] Example functionality of the components is described below. This example functionality is illustrative only, and it should be understood that additional operations and functions can be performed by the components described herein. Additionally, connections between components can be virtual connections via service-based interfaces, allowing any component to communicate with any other component. In this way, any component can act as a service "producer," providing services to network functions for any other component that is a service "consumer."

[0040] For example, core network 210 is described in the control plane of the network system. Core network 210 may include Authentication Server Function (AUSF) 211, Access and Mobility Function (AMF) 212, and Session Management Function (SMF) 213. Core network 210 may also include Network Slice Selection Function (NSSF) 214, Network Exposure Function (NEF) 215, Network Repository Function (NRF) 216, and Unified Data Management Function (UDM) 217, which may include Unified Data Repository (UDR) 224.

[0041] Additional components and functions of the core network 210 may include application functions 218, policy control functions (PCF) 219, network data analysis functions (NWDAF) 220, analytical data repository functions (ADRF) 221, management data analysis functions (MDAF) 222, and operation and management functions (OAM) 223.

[0042] The user plane includes UE 150, Radio Access Network (RAN) 225, User Plane Function (UPF) 226, and Data Network (DN) 227. RAN 225 may include a combination of Figure 1 The RAN 225 describes one or more components, such as one or more network nodes. However, the RAN 225 may not be limited to such components. The UPF 226 provides connectivity for data transmitted via the RAN 225. For example, the DN 226 identifies services from service providers, internet access, and third-party services.

[0043] AMF 212 handles connectivity and mobility tasks. AUSF 211 receives authentication requests from AMF 212 and interacts with UDM 217 to authenticate and verify network responses to determine successful authentication. SMF 213 performs Packet Data Unit (PDU) session management and manages session context with UPF 226.

[0044] NSSF 214 can select a Network Slice Instance (NSI) and determine the allowed Network Slice Selection Auxiliary Information (NSSAI). This selection and determination are used to set up AMF 212 to provide services to UE 150. NEF 215 ensures third-party access to network services to create private network services. NRF 216 acts as a repository for storing network functions to allow these functions to register and discover each other.

[0045] UDM 217 generates authentication vectors used by AUSF 211 and ADM 212 and provides user identity processing. UDM 217 can connect to UDR 224, which stores data associated with authentication, applications, etc. AF 218 provides application services (e.g., streaming services) to users. PCF 219 provides policy control functions. For example, PCF 219 can assist with network slicing and mobility management, as well as provide Quality of Service (QoS) and accounting functions.

[0046] NWDAF 220 collects data (e.g., from UE 150 and network systems) to perform network analytics and provide insights into functions that leverage analytics when providing services. ADRF 221 allows for the storage, retrieval, and removal of data and analytics by the consumer. MDAF 222 provides additional data analytics services for network functions. OAM 223 provides provisioning and management processing functions to manage elements in or connected to the network (e.g., UE 150, network nodes, etc.).

[0047] Figure 2 These are merely examples of components of a network system, and variations are contemplated within the scope of this disclosure. In embodiments, the network system may include... Figure 2 Other components not shown in the diagram. In an embodiment, the network system may not include... Figure 2 Each component is shown. In embodiments, components and connections can utilize [the following]. Figure 2 The connections shown are implemented using different connections. Such and other embodiments are contemplated within the scope of this disclosure.

[0048] Although further details will be provided below, in a Distributed Non-Access Stratum (NAS) architecture, multiple higher-layer messages are sent from a User Equipment (UE) to multiple Network Functions (NFs) using a single lower-layer message, and vice versa. In various embodiments, NAS messages are sent via a single aggregated message instead of multiple Protocol Data Units (PDUs).

[0049] For example, in various embodiments, in a distributed NAS architecture, distributed secure termination of various NAS functions can exist between the UE and the NAS function (e.g., network function NF). Therefore, bidirectional communication can be enabled between the UE and any NF without the involvement of other network functions (e.g., mobility management (MM) functions).

[0050] For example, in some 5G systems, NAS messages can be used for signaling between the UE and the core network (e.g., the UE and the AMF). At the 5G core network, the NAS mobility management (5GMM) process can track UEs, registration and session establishment, as well as UE authentication and control integrity protection, and encryption specific to the UE. The 5GMM process also includes network-based assignment of temporary identifiers, such as 5G-GUTI, to the UE, and requests identification information, such as SUCI, from the UE. Therefore, as described herein, in various embodiments, UENAS communication can be directly implemented between the UE and the target NF.

[0051] In various embodiments, a temporary identifier for the NF can be provided to the UE, such as during Radio Resource Control (RRC) registration or during Protocol Data Unit (PDU) communication establishment.

[0052] In a modular NAS with a point-to-point (P2P) interface for the Radio Access Network (RAN) - Core Network (CN) interface, the sender can transmit multiple NAS containers. Therefore, independent secure termination enables orthogonality between devices in the network and the network itself. In various embodiments, the sender in the uplink (e.g., UE) or the sender in the downlink (e.g., RAN) can transmit multiple NAS containers, independently protecting (e.g., integrity protection and / or encryption) each container, and the receiver of the containers distinguishes between different NAS containers and processes them independently.

[0053] In various embodiments, an aggregated NAS container can be created that is adaptable to various architectural variations that can be adopted in a network (e.g., a 6G network), as will be described in further detail below. In various embodiments, multiple higher-level messages can be included in a single lower-level message within a modular NAS architecture.

[0054] As used herein, communication with the Radio Access Network (RAN) can refer to and mean communication with a portion of the RAN, such as communication with network nodes (e.g., DU and / or CU), or communication with another portion of the RAN. As used herein, communication with the Core Network can refer to and mean communication with one or more services / applications (such as AMF) in the Core Network or with another service of the Core Network.

[0055] As used herein, the terms “first” and “second” can refer to a first or second instance of a message sent / received by a component (e.g., a UE, a device, etc.), or a first or second component in a sequence of the aforementioned components. Therefore, these terms are used in a non-limiting manner and can refer to any message, operation, device, component, etc.

[0056] Based on the brief description, Figure 3AThis is a diagram illustrating an example distributed NAS architecture 300A according to one aspect of this disclosure. In various embodiments, the distributed NAS architecture 300A includes a UE 150, a RAN 225, a mobility management (MM) function 315, a session management (SM) function 316, and a network function x (NFx) 317. It should be noted that the described NFs are merely exemplary, and any NF (e.g., Figure 2 The NFs in the diagram can be used in the distributed architecture 300A. Although three NFs are described herein in various embodiments, any number of NFs can be utilized.

[0057] In various embodiments, MM function 315 can provide network connection tracking, registration, management, and authorization, as well as UE access to subscribed services, such as when roaming between base stations. In various embodiments, SM function 316 can manage data sessions and / or PDU sessions between the UE and the network, and provide policy control for the sessions. In various embodiments, the SM function can track PDU sessions and Quality of Service (QoS) flows in the 5GC for the UE, and ensure synchronization of its state and the state between the NF in the control plane and user plane. In various embodiments, SM NF1 can handle PDU session 1, while SM NF2 can handle PDU session 2.

[0058] Figure 3A The document also illustrates multiple aggregated NAS containers (ANCs) 310 (e.g., 310A, 310B, and 310C). Each ANC 310 includes information associated with a NAS sublayer and / or network function. In various embodiments, the container may be formed or generated using the information associated with that sublayer / network function. For example, in various embodiments, the container 310 may include a payload and payload-related information for reading by the associated network function or NAS sublayer.

[0059] like Figure 3A As shown, there are three containers (310A, 310B, and 310C). On the UE side, container 310A can be a container for a first network function and can include routing information related to the network function associated with containers 310B and / or 310C, as well as a payload for processing by that network function. Container 310B can be a container for a second network function and can include routing information related to the network function associated with containers 310A and / or 310C, as well as a payload for processing by that network function. Container 310C can be a container for a third network function and can include routing information related to the network function associated with containers 310A and / or 310B, as well as a payload for processing by that network function.

[0060] In various embodiments, for example, container 310A may be intended for SM function 316, container 310B may be intended for MM function 315, and container 310C may be intended for NFx function 317. It should be noted that NFx functions can include any NF and are examples of any network function x.

[0061] Therefore, for uplink communication, UE 150 creates a message for transmission, which in various embodiments is an ANC, comprising three example containers 310, and sends the ANC to RAN 225. In the various message embodiments described below, a semicolon “;” may indicate a separation between containers in the message. Therefore, in various embodiments, the ANC may be created or formed according to: ANC = plaintext [MM-S-TMSI]; (I&E using MM key [MM parameters], SM-S-TMSI, NFx-S-TMSI); (I&E using SM key [SM parameters]); (I&E using NFx key [NFx parameters]). The plaintext indication is first routing information for the first NF location (e.g., MM 315) and includes the MM Serving Mobile Subscriber Temporary Identifier (S-TMSI). In various embodiments, the plaintext indication does not include integrity protection or encryption. Therefore, in various embodiments, the first container is sent in plaintext and includes routing information for subsequent containers.

[0062] In the example above, RAN 225 routes the ANC to MM 315. MM is able to read information [MM parameters] from the second container 310B, utilizing MM 215-specific integrity and encryption (I&E) keys. The second container 310B then also includes SM-S-TMSI and NFx-S-TMSI routing information for MM 315 to forward / send subsequent containers to these network functions. That is, MM 315 forwards the first container 310A to SM 316 and the third container 310C to NFx 317, each NF capable of performing integrity checks and decryption of the container's contents based on the corresponding I&E keys for these network functions.

[0063] In the downlink communication direction, the ANC can be formed or generated by, for example, the RAN or MM 315. In this direction, the Key Set Identifier (KSI) for the NF can be utilized to provide the UE's sublayer with information contained in each individual container (310A, 310B, 310C) for integrity checks and decryption. For example, in one embodiment, the MM 315 can form the ANC according to: I using the MM key [KSI]; (I&E using the MM key [MM parameters], KSIsm, KSInfx); (I&E using the SM key [SM parameters]); (I&E using the NFx key [NFx parameters]). In another example embodiment, the MM 315 can form the ANC according to: I using the MM key [KSI]; (I&E using the MM key [MM parameters], NFx-S-TMSI); (I&E using the NFx key [NFx parameters]).

[0064] In various embodiments, the KSI identifies the NAS security context established between the UE and the NF. A single NF may have multiple or more KSIs. The UE uses the received KSI to identify the associated NAS security context and uses it to perform integrity checks and decryption on the received associated container.

[0065] Therefore, when UE 150 receives ANC, UE is able to forward each individual container to the associated sublayer based on KSI or S-TMSI used for network functions.

[0066] Based on the brief description, Figure 3B This is a diagram illustrating an example distributed NAS architecture 300B according to one aspect of this disclosure. In various embodiments, the distributed NAS architecture 300B includes a UE 150, a RAN 225, an MM function 315, an SM function 316, and an NFx 317. It should be noted that the described NFs are merely exemplary, and any NF (e.g., Figure 2 The NF (Network Function) in the NN (Network Function) can be used in the distributed architecture 300B. Additional network functions NN 318 are included. Figure 3B In this context, it can be a network function used as a target network function for routing container 310.

[0067] like Figure 3BAs shown, three containers (310A, 310B, and 310C) are illustrated for three network functions. On the UE side, container 310A can be a container for a first network function and can include a payload processed by that network function. Container 310B can be a container for a second network function and can include a payload processed by that network function. Container 310C can be a container for a third network function and can include a payload processed by that network function. Additionally, containers used for network functions (e.g., NN) that are transmitted in plaintext can be included, comprising parameters for that network function and routing information for containers 310A, 310B, and 310C.

[0068] In various embodiments, for example, container 310A may be intended for SM function 316, container 310B may be intended for MM function 315, and container 310C may be intended for NFx function 317. It should be noted that NFx functions can include any NF and are examples of any network function x.

[0069] Therefore, for uplink communication, UE 150 creates a message for transmission, which in various embodiments is an ANC, comprising three example containers 310 and a container for NN NF, and sends the ANC to RAN 225. In various embodiments, the ANC can be created or formed according to: ANC = plaintext [NN-S-TMSI]; (I&E using NN key [NN parameters], SM-S-TMSI, MM-S-TMSI, NFx-S-TMSI); (I&E using SM key [SM parameters]); (I&E using MM key [MM parameters]); (I&E using NFx key [NFx parameters]).

[0070] In the example above, RAN 225 routes the ANC to NN 318. The NN is able to read the information [NN parameters] and routing information for subsequent containers included in the container used by the NN NF using its own I&E key. The NN then routes the first container 310A to SM 316, the second container 310B to MM 315, and the third container 310C to NFx317. SM is able to read the information contained in the first container, which utilizes the SM 316-specific integrity and encryption (I&E) key. The second container 310B is read by MM 315 based on the MM 315-specific integrity and encryption (I&E) key, and the third container is read by NFx 317 based on the NFx 317-specific integrity and encryption (I&E) key.

[0071] In the downlink communication direction, the ANC can be formed or generated by, for example, the NN 318. In this direction, the Key Set Identifier (KSI) for the NF can be utilized to provide the UE's sublayer with information contained in each individual container (310A, 310B, 310C) and the NN container for integrity checks and decryption. In various embodiments, one or more PDU sessions for each SM NF can be utilized based on changes in security information. In embodiments, the NN 318 can form the ANC according to: I using the NN key [KSInn]; I&E using the NN keys (KSIsm, KSImm, KSI NFx); I&E using the SM key [SM parameters]; I&E using the MM key [MM parameters]; I&E using the NFx key [NFx parameters]. In various embodiments, KSIsm can be used where multiple PDU sessions exist for each SM NFx and an independent KSI value exists for each PDU session. KSIsm can also be used regardless of whether each SM NFx has a single or multiple PDU sessions.

[0072] In an embodiment, NN 318 can form an ANC according to the following: using NN key [KSInn] I (using NN key (SM-S-TMSI I&E) (using SM key [SM parameter] I&E). In various embodiments, SM-S-TMSI can be used when a single KSI is applied to a single SM NF supporting one or more PDU sessions for a given UE.

[0073] Therefore, when UE 150 receives ANC, UE is able to forward each individual container to the associated sublayer based on KSI used for network functions.

[0074] Based on the brief description, Figure 3C This is a schematic diagram of an example distributed NAS architecture 300C according to one aspect of this disclosure. In various embodiments, the distributed NAS architecture 300C includes a UE 150, a RAN 225, an MM function 315, an SM function 316, and an NFx 317. It should be noted that the described NFs are merely exemplary, and any NF (e.g., Figure 2 The NF in the distributed architecture 300C can be used.

[0075] Similarly, as Figure 3CAs shown, there are three containers (310A, 310B, and 310C). On the UE side, container 310A can be a container for a first network function and can include payloads processed by that network function. Container 310B can be a container for a second network function and can include routing information related to the network functions associated with containers 310A and 310C, as well as payloads processed by that network function. Container 310C can be a container for a third network function and can include payloads processed by that network function.

[0076] In various embodiments, for example, container 310A may be intended for SM function 316, container 310B may be intended for MM function 315, and container 310C may be intended for NFx function 317. It should be noted that NFx functions can include any NF and are examples of any network function x.

[0077] Therefore, for uplink communication, UE 150 creates a message for transmission, which in various embodiments is an ANC, comprising three example containers 310, and sends the ANC to RAN 225. In various embodiments, the ANC can be created or formed according to: plaintext [temporary identifier, n or flag] (I&E using MM key (MM parameters, SM-S-TMSI, NFx-S-TMSI); (I&E using SM key [SM parameters]); (I&E using NFx key [NFx parameters]).

[0078] In various embodiments, the 'n' or flag identifier can instruct RAN 225 how to handle the ANC container. In an example, the 'n' or flag identifier can instruct RAN 225 to immediately forward the container immediately following the routing information and store other containers. For example, RAN 225 can forward or send the second container 310B to MM 315. After receiving the second container 310B, MM 315 can read the routing information for the first container 310A and the third container 310C respectively, and return this information to RAN 225. At this point, RAN 225 can forward the first container 310A to SM 316 and the third container 310C to NFx 317.

[0079] In various embodiments, if RAN 225 receives a negative acknowledgment (e.g., from MM 315), RAN 225 may discard the stored container.

[0080] In another embodiment, the flag identifier may instruct RAN 225 to immediately forward all containers, or to immediately forward one container following the routing information based on the routing information available for its respective NF.

[0081] In various embodiments, an ANC can be created or formed according to the following: ANC = plaintext [temporary identifier 1]; (I&E using SM key [SM parameters]; [temporary identifier 2]; (I&E using MM key [MM parameters]); [temporary identifier 3]; (I&E using NFx key [NFx parameters]). In this case, RAN 225 forwards container 310A to SM 316, container 310B to MM 315, and container 310C to NFx 317. Therefore, each NF can perform integrity checks and decryption of the container's contents based on the corresponding routing identifier contained within the container to identify the security context / key used for these network functions.

[0082] In various embodiments, the ANC can be formed as follows: ANC = plaintext [temporary identifier, n or flag]; (I&E using MM key (MM parameter, NF xS-TMSI, NF yS-TMSI); (I&E using NF x key [NF x parameter]); (I&E using NF y key [NF y parameter]). In various embodiments, n can indicate that the n containers immediately following the routing information should be forwarded and the other containers stored. In various embodiments, the flag can indicate that all containers should be forwarded immediately, or that only one container immediately following the routing information should be forwarded based on the available routing information.

[0083] In various embodiments, the ANC can be formed as follows: ANC = plaintext [MM-S-TMSI, n or flag] (I&E using NN key [MM parameter], SM-S-TMSI, LM-S-TMSI); (I&E using SMx key [SMx parameter]); (I&E using LMx key [LMx parameter]). MM NF can decrypt the MM container and share SM-S-TMSI-1 and SM-S-TMSI-2 with RAN. RAN can then use SM-S-TMSI.1 to forward SM container-1 to SM NF-1, and similarly forward it to SM-NF-2.

[0084] In various embodiments, the ANC can be formed as follows: ANC = plaintext [temporary identifier 1]; (I&E using the MM key (MM parameters); [temporary identifier 2] (I&E using the NFx key (NFx parameters)). The RAN can forward the corresponding container to the NFx instance based on the routing information present in the temporary identifier of the container.

[0085] In the downlink, RAN 225 sends a single RRC message that includes multiple NAS containers (e.g., 310A, 310B, and 310C) to form the message according to the following: (I (KSImm) using MM key); (I&E using MM key [MM parameter]); (I (KSIsm) using SM key (I&E using SM key [SM parameter]); (I (KSIsm) using NFx key); (I&E using SM key [NFx parameter]).

[0086] In various embodiments, the MM NF message can be formed as follows: MM NF = (I using MM-S-TMSI) (I & E using MM key [MM parameter]); the SM NFx message can be formed as follows: SM NFx = (I (xS-TMSI) using SM key) (I & E using SMx key [SMx parameter]). As mentioned above, the number (n) can indicate that the n containers immediately following the routing information should be forwarded while other containers are stored, while the flag indicator can indicate, with one value, that all containers should be forwarded immediately, or with another value, that only one container immediately following the routing information should be forwarded based on the available routing information.

[0087] Therefore, when UE 150 receives ANC, UE is able to forward each individual container to the associated sublayer based on KSI or S-TMSI used for network functions.

[0088] Based on the brief description, Figure 4A This is a diagram of an example uplink transmission embodiment 400A of signaling and operation between the UE NAS sublayer, UE access layer, RAN, and core network function (CN NF) according to one aspect of this disclosure.

[0089] like Figure 4A As shown, each UE NAS sublayer (e.g., sublayer 1, sublayer 2, and sublayer n) generates payload / data and forwards the payload to the UE Access Layer (AS) layer. In various embodiments, payload 405A is provided by UE NAS sublayer 1, payload 405B is provided by UE NAS sublayer 2, and payload 405n is provided by UE NAS sublayer n. The UE AS layer then generates the aforementioned containers (e.g., 310A, 310B, and 310C) and generates an ANC at operation 410A for transmission to the RAN, which receives the ANC. The RAN then forwards each container to the corresponding CN NF (e.g., NF1, NF2, and NFn), which decrypts the information (e.g., payloads 405A, 405B, and 405C) in their respective containers.

[0090] In various embodiments, the NAS container may include higher-level content associated with the corresponding CN NF from the perspective of the UE AS, such as the NAS MM container, NAS SM container, NAS Short Message Service container, NAS Location Management container, NAS Policy Control container, and / or NAS Home Network container, for information exchange between the UE and the home network.

[0091] In various embodiments, if applicable, the NAS container type indicator may be created based on which UE NAS sublayer has sent (multiple) containers and / or network function distinguishers (e.g., SMx distinguishers).

[0092] Based on the brief description, Figure 4B This is a diagram of an example downlink transmission embodiment 400B of signaling and operation between the UE NAS sublayer, UE access layer, RAN, and CN NF according to one aspect of this disclosure.

[0093] like Figure 4B As shown, each CN NF (e.g., NF1, NF2, and NFn) generates a payload / data and forwards the payload to the UE Access Layer (AS) layer. In various embodiments, payload 405A is provided by CN NF1, payload 405B by CN NF2, and payload 405n by CN NFn. Then, at operation 410B, the NF generates the aforementioned containers (e.g., 310A, 310B, and 310C), and the RAN generates an RRC message (or other AS message) for transmission to the UE, which receives the RRC message. The RAN then forwards each container to the corresponding UE NAS sublayer (e.g., sublayer 1, sublayer 2, and sublayer n), which decrypts the information (e.g., payloads 405A, 405B, and 405C) in their respective containers.

[0094] In various embodiments, alternative example formats for forming the above messages and containers are described below. In various embodiments, symbols may be indicated as follows: XX{……} may indicate that the content of {……} is protected for NAS container integrity using the NAS XX key, and XX[……] may indicate that the content of [...] is protected for both NAS container integrity and confidentiality using the NAS XX key. Data not enclosed in {} or [] may indicate that it is sent in plaintext (e.g., without integrity protection and encryption). R = routing information, &C = container data that may include routing data.

[0095] Therefore, the general format described below may include {……} or [...], without any superscript, or with superscript. R = routing information, &C = container data.

[0096] For example: {R}, [C1+R2], and [C2] indicate that R is protected by integrity, C1+R2 is protected by integrity / encryption, and C2 is also protected by integrity / encryption. R, [C1], [C2] indicate that R is sent in plaintext, C1 is protected by integrity / encryption, and C2 is also protected by integrity / encryption. The R+ flag, [C1], and [C2] indicate that the R+ flag is sent in plaintext, C1 is protected by integrity / encryption, and C2 is also protected by integrity or encryption.

[0097] Therefore, regarding Figure 3A Alternative example embodiments may include:

[0098] For the uplink:

[0099] UE to RAN: RMM, MM[MM data + RSM + RXX], SM[SM data], XX[XX data]. General format: R1, [C1 + R2 + Rx], [C2], [Cx].

[0100] The RMM is sent from the UE to the RAN in plaintext.

[0101] RAN to MM NF: MM[MM data + RSM + RXX], SM[SM data], XX[XX data]. General format: [C1 + R2 + Rx], [C2], [Cx].

[0102] The RAN uses the RMM to route all containers to the MM NF. The RAN provides the RMM to the MM NF via the NAS transport layer (e.g., P2P or SBI / HTTP) so that the MM NF can identify the UE's MM context.

[0103] MM NF to XX NF: XX[XX data]. A general format for [C].

[0104] The MM NF extracts the routing information RSM+RXX from the received MM[MM data+RSM+RXX] to forward route the remaining received containers to the corresponding NF.

[0105] MM NF uses RSM to route SM [SM data] to SM NF, and uses Rxx to route XX [XX data] to XXNF.

[0106] The MM NF provides RSM to the SM NF and Rxx to the XX NF via the NAS transport layer (e.g., SBI / HTTP) so that the SM NF and XX NF identify the UE's SM and XX contexts, respectively.

[0107] For the downlink:

[0108] SM NF to MM NF: RSM, SM[SM data], or XX NF to MM NF: Rxx, XX[XX data]. General format: R, [C].

[0109] MM NF to RAN: MM{RMM}, MM[MM data + RSM + RXX], SM[SM data], XX[XX data]. General format: {R1}, [C1 + R2 + Rx], [C2], [Cx].

[0110] RAN to UE: MM{RMM}, MM[MM data + RSM + RXX], SM[SM data], XX[XX data]. General format: {R1}, [C1 + R2 + Rx], [C2], [Cx].

[0111] about Figure 3B Alternative example embodiments may include:

[0112] For the uplink:

[0113] UE to RAN: RNN, NN[NN data + RMM + RSM + RXX], MM[MM data], SM[SM data], XX[XX data]. General format: R1, [C1 + R2 + R3 + Rx], [C2], [C3], [Cx]

[0114] The RNN is sent from the UE to the RAN in plaintext.

[0115] RAN to NN NF: NN[NN data + RMM + RSM + RXX], MM[MM data], SM[SM data], XX[XX data]. General format: [C1 + R2 + R3 + Rx], [C2], [C3], [Cx].

[0116] The RAN uses the RNN received from the UE to route all containers to the NN NF. The RAN provides the RNN to the NN NF via the NAS transport layer (e.g., P2P or SBI / HTTP) so that the NN NF can identify the UE's NN context.

[0117] NN NF to XX NF: XX[XX data]. A general format for [C].

[0118] The NN NF extracts routing information RMM+RSM+RXX from the received NN[NN data+RMM+RSM+RXX] to forward route the received container to the corresponding NF.

[0119] NN NF uses RMM to route MM [MM data] to MM NF, uses RSM to route SM [SM data] to SM NF, and uses Rxx to route XX [XX data] to XX NF.

[0120] The NN NF provides RMM to the MM NF, RSM to the SM NF, and Rxx to the XX NF via the NAS transport layer (e.g., SBI / HTTP) so that the MM NF, SM NF, and XX NF can respectively identify the UE's MM, SM, and XX contexts.

[0121] For the downlink:

[0122] MM NF to NN NF: RMM, MM [MMM data], or SM NF to NN NF: RSM, SM [SM data], or XX NF to NN-NF: Rxx, XX [XX data]. General format: R, [C].

[0123] From NN to RAN: NN{RNN}, NN[NN data + RMM + RSM + RXX], MM[MM data], SM[SM data], XX[XX data]. General format: {R1}[C1 + R2 + R3 + Rx][C2], [C3], [Cx].

[0124] RAN to UE: NN{RNN}, NN[NN data + RMM + RSM + RXX], MM[MM data], SM[SM data], XX[XX data]. General format: {R1}[C1 + R2 + R3 + Rx][C2], [C3], [Cx].

[0125] about Figure 3B Alternative example embodiments may include:

[0126] For the uplink:

[0127] RRC is not protected:

[0128] UE to RAN: RMM + flag, MM [MM data + RSM + Rxx], SM [SM data], XX [XX data]. General format: R1 + flag, [C1 + R2 + Rx], [C2], [Cx].

[0129] RAN to MM NF: MM[MM data + RSM + Rxx]. General format: [C1 + R2 + Rx]

[0130] The RAN uses RMM+ flag information to route the number of containers indicated by the flags to the MM NF.

[0131] If the flag is present, only the first container MM[MM data+RSM+Rxx] is sent to MM NF.

[0132] If the flag is not present, all containers should be sent to the MM / NN NF, i.e., MM[MM data + RSM + Rxx], SM[SM data], XX[XX data] (this applies to architecture options A and B). If the flag is present, the RAN should first attempt to deliver the MM container and wait for confirmation from the MM NF to return routing information (RSM / Rxx) to the RAN. The remaining containers should be buffered by the RAN.

[0133] The RAN provides the RMM to the MM NF via the NAS transport layer (e.g., SBI / HTTP) so that the MM NF can identify the UE's MM context.

[0134] RAN to XX NF: A general format for [C].

[0135] If a negative acknowledgment is received from the MM NF, the RAN can discard all remaining buffered / stored containers.

[0136] If it is confirmed that the data was received from the MM NF, the RAN can use the received routing information (RSM / Rxx) to attempt to deliver the remaining buffered containers separately. For example, the RAN uses RSM to route SM[SM data] to the SM NF and uses Rxx to route XX[XX data] to the XX NF. The RAN can attempt to deliver these corresponding containers simultaneously.

[0137] The RAN provides RSM / Rxx to the SM NF / XX NF via the NAS transport layer (e.g., SBI / HTTP) so that the SMNF / XZ NF can identify the UE's SM / XX context respectively.

[0138] For RRC protection options:

[0139] For the uplink:

[0140] UE to RAN: RMM, RSM, RXX, MM [MM data], SM [SM data], XX [XX data]: General format: R1, R2, Rx, [C1], [C2], [Cx].

[0141] Or RMM, MM [MM data], RSM, SM [SM data], RXX, XX [XX data]. Common formats: R1, [C1], R2, [C2], Rx, [Cx].

[0142] RAN to MM NF or SM NF or XX NF: MM [MM data] or SM [SM data] or XX [XX data]: General format: [C1] or [C2] or [Cx].

[0143] The RAN should use the received routing information RMM, RSM, and RXX to determine the NF to which each container should be delivered.

[0144] The RAN provides RMM / RSM / Rxx to MM NF / SM NF / XX NF via the NAS transport layer (e.g., SBI / HTTP) so that MM NF / SM NF / XX NF can identify the UE's MM / SM / XX context respectively.

[0145] The order of routing information can correspond to the order of containers, or alternatively, routing information / containers can be ordered in pairs.

[0146] In this embodiment, if an MM container exists, the RAN may first attempt to deliver the MM container and wait for acknowledgments from the MM NF before attempting to deliver the remaining containers, which are buffered at the RAN. If a negative acknowledgment is received from the MM NF, the RAN may discard all remaining buffered containers.

[0147] If the MM container exists and if it is confirmed that it has been received, the RAN can attempt to deliver the remaining buffered containers. The RAN can also attempt to deliver these corresponding containers simultaneously.

[0148] For the downlink:

[0149] MM NF to RAN: MM{RMM}, MM[MM data]. General format: {R}, [C].

[0150] SM NF to RAN: SM{RSM}, SM[SM data]. General format: {R}, [C].

[0151] XX NF to RAN: XX{RXX}, XX[XX data]. General format: {R}, [C].

[0152] The R information can be XX-S-TMSI (temporary identifier) ​​or aKSIxx (security context identifier).

[0153] RAN to UE: MM{RMM}, MM[MM data], SM{RSM}, SM[SM data], XX{RXX}, XX[XX data]. General format: {R1}, [C1], {R2}, [C2], {Rx}, [Cx].

[0154] The operation is described below from the perspective of the device. From this perspective, a method may involve a first device receiving a first message from a second device, the first message including routing information associated with a corresponding network function among a plurality of network functions and a plurality of containers associated with the corresponding network function among the plurality of network functions, wherein each of the plurality of containers includes a corresponding encrypted Non-Access Stratum (NAS) payload, and the first device sending each container to the associated network function based on the routing information for that network function.

[0155] Now for reference Figure 5 This diagram illustrates a block diagram of example components of a UE or network device (e.g., RAN or core network). The device includes an electronic storage device 510, a processor 520, a network interface 540, and a memory 550. The various components can be communicatively coupled to each other. The processor 520 can be and may include any type of processor, such as a single-core central processing unit (CPU), a multi-core CPU, a microprocessor, a digital signal processor (DSP), a system-on-a-chip (SoC), or any other type of processor. The memory 550 can be a volatile type of memory, such as RAM, or a non-volatile type of memory, such as NAND flash memory. The memory 550 includes processor-readable instructions that can be executed by the processor 520 to cause the device to perform various operations, including those described herein, such as... Figures 3A-4B The operations described in the document.

[0156] Electronic storage device 510 can be and includes any type of electronic storage device used for storing data, such as hard disk drives, solid-state drives, optical disks, and / or other non-transitory computer-readable media, and other types of electronic storage devices. Electronic storage device 510 stores processor-readable instructions for causing or configuring the device to perform its operations, and also stores data associated with such operations, such as data related to the 5G NR standard, and other data. Network interface 540 can implement wireless networking technologies, such as 5G NR and / or other wireless networking technologies.

[0157] Figure 5 The components shown are merely examples, and those skilled in the art will understand that the apparatus includes other components not illustrated, and may include multiples of any of the illustrated components. Such and other embodiments are contemplated within the scope of this disclosure. For example, a transmitter and a receiver may be included as components for transmitting and receiving signals.

[0158] Further embodiments of this disclosure include the following examples.

[0159] Example 1.1. An apparatus comprising: Components for receiving a first message from a second device by a first device, the first message including routing information associated with a corresponding network function among a plurality of network functions and a plurality of containers associated with the corresponding network function among the plurality of network functions, wherein each of the plurality of containers includes a corresponding encrypted Non-Access Stratum (NAS) payload; and A component used by the first device to send each container to the associated network function based on routing information for that network function.

[0160] Example 1.2. The apparatus according to Example 1.1, wherein the second apparatus is a radio access network (RAN).

[0161] Example 1.3. The apparatus according to Example 1.1, wherein the routing information includes a Service Temporary Mobile Subscriber Identifier (S-TMSI) for the associated network function.

[0162] In various embodiments, independent NAS sublayers (e.g., MM, SM, security, etc.) can be supported by the UE using independent encoding / decoding and security keys. Therefore, orthogonality between NAS containers within the UE and between different functions in the network can be enabled. Thus, independent security termination for each NAS container and a single parent key can be determined, along with an authentication for each UE, and independent security associations can be enabled by independent key set IDs.

[0163] The embodiments and aspects disclosed herein are examples of this disclosure and may be embodied in various forms. For example, although some embodiments herein are described as separate embodiments, each embodiment herein may be combined with one or more other embodiments herein. The specific structural and functional details disclosed herein should not be construed as limiting, but rather serve as the basis for the claims and as an illustrative basis for teaching those skilled in the art to employ this disclosure in various ways within virtually any suitably detailed structure. Throughout the description of the drawings, the same reference numerals may refer to similar or identical elements.

[0164] According to this disclosure, the phrases “in one aspect,” “in multiple aspects,” “in various aspects,” “in some aspects,” or “in other aspects” may each refer to one or more of the same or different aspects. The phrase “multiple aspects” may refer to two or more.

[0165] In various embodiments, the terms "first message" and "second message," as well as any subsequent message, may refer to any message sent or received in sequence, and are not necessarily limited to any particular message. In various embodiments, the term "subsequent" does not necessarily indicate any sequence or temporal order.

[0166] According to this disclosure, the phrases “in one embodiment,” “in an embodiment,” “in various embodiments,” “in some embodiments,” or “in other embodiments” can each refer to one or more of the same or different embodiments. The phrase “A or B” means “(A), (B), or (A and B).” The phrase “at least one of A, B, or C” means “(A); (B); (C); (A and B); (A and C); (B and C); or (A, B, and C).”

[0167] Any of the methods, programs, algorithms, or code described herein can be translated into or expressed in a programming language or computer program. As used herein, the terms "programming language" and "computer program" each include any language used to specify instructions to a computer, and include (but are not limited to) the following languages ​​and their derivatives: assembly language, Basic, batch files, BCPL, C, C++, Delphi, Fortran, Java, JavaScript, machine code, operating system command languages, Pascal, Perl, PL1, Python, scripting languages, Visual Basic, meta-languages ​​that specify the program itself, and all first-, second-, third-, fourth-, fifth-, or future generation computer languages. Databases and other data schemes are also included, as well as any other meta-languages. No distinction is made between languages ​​that are interpreted, compiled, or use both compilation and interpretation methods. No distinction is made between compiled versions of a program and source code versions. Therefore, references to a program, where a programming language can exist in multiple states (such as source, compiled, object, or linked), are references to any and all such states. References to a program may include the actual instructions and / or the intent of those instructions.

[0168] While various aspects of this disclosure have been shown in the accompanying drawings, this is not intended to limit the disclosure thereto, as it is intended to have the broadest possible scope permitted by the art, and the specification should be read in the same manner. Therefore, the foregoing description should not be construed as limiting, but merely as examples of particular aspects. Other modifications within the scope and spirit of the appended claims will be contemplated by those skilled in the art.

Claims

1. A method comprising: The first device receives a first message from the second device, the first message including: routing information associated with a corresponding network function among a plurality of network functions, and a plurality of containers associated with the corresponding network function among the plurality of network functions, wherein each of the plurality of containers includes a corresponding encrypted Non-Access Stratum (NAS) payload; and The first device sends each of the plurality of containers to the network function associated with the corresponding container based on the routing information for the network function.

2. The method of claim 1, wherein the second device is a radio access network (RAN).

3. The method of claim 1, wherein the routing information includes a Service Temporary Mobile Subscriber Identifier (S-TMSI) for associated network functions.

4. An apparatus comprising: At least one processor; as well as At least one memory storing instructions that, when executed by the at least one processor, cause the device to perform at least the following: A first message is received from a second device, the first message including: routing information associated with a corresponding network function among a plurality of network functions, and a plurality of containers associated with the corresponding network function among the plurality of network functions, wherein each of the plurality of containers includes a corresponding encrypted non-access stratum (NAS) payload. as well as Based on the routing information used for the network function, each of the plurality of containers is sent to the network function associated with the corresponding container.

5. A processor-readable medium storing instructions, said instructions, when executed by at least one processor of a first means, causing the first means to perform at least: Receive a first message from the second device, the first message including: Routing information associated with a corresponding network function among a plurality of network functions and a plurality of containers associated with the corresponding network function among the plurality of network functions, wherein each of the plurality of containers includes a corresponding encrypted non-access stratum (NAS) payload. as well as Based on the routing information used for the network function, each of the plurality of containers is sent to the network function associated with the corresponding container.

Images