Methods, apparatuses and computer programs

Abstract

An apparatus, method, and computer program are provided for sending a Hypertext Transfer Protocol (HTTP) connection request to a first roaming intermediary to establish a Transmission Control Protocol (TCP) connection between the first roaming intermediary and a peer device, wherein the TPP connection is used to establish a Public Land Mobile Network (PLN) signaling connection between the device and the peer device via the first roaming intermediary; and receiving an HTTP connection response from the first roaming intermediary, the HTTP connection response including response information indicating whether a TPP connection to the peer device has been established; wherein the HTTP connection request includes information indicating the peer device, and wherein the HTTP connection request includes a header including at least one of: information indicating the device; information describing the purpose of establishing the TPP connection; information describing that the PLAN signaling connection is established by using the TPP connection; or information controlling the first roaming intermediary to forward or initiate messages to the device or the peer device.

Description

Technical Field

[0001] This application relates to a method, apparatus, system, and computer program, particularly but not limited to an apparatus for establishing signaling connections between public land mobile networks. Background Technology

[0002] A communication system can be viewed as a facility that enables a communication session between two or more entities (such as user terminals, base stations, and / or other nodes) by providing carrier waves between various entities involved in the communication path. For example, a communication system can be provided by means of a communication network and one or more compatible communication devices. The communication session can include, for example, communication for carrying data, such as voice, video, email, text messages, multimedia, and / or content data. Non-limiting examples of the services provided include two-way or multi-way calling, data communication or multimedia services, and access to data network systems such as the Internet.

[0003] In wireless communication systems, at least a portion of a communication session between at least two stations occurs via a wireless link. Examples of wireless systems include Public Land Mobile Networks (PLMNs), satellite-based communication systems, and various wireless local area networks, such as Wireless Local Area Networks (WLANs). Some wireless systems can be divided into cells and are therefore often referred to as cellular systems.

[0004] Users can access the communication system using appropriate communication equipment or terminals. A user's communication equipment can be referred to as user equipment (UE) or user facilities. The communication equipment is equipped with appropriate signal receiving and transmitting means for enabling communication, such as allowing access to a communication network or direct communication with other users. The communication equipment can access a carrier provided by a station (e.g., a base station in a cell) and transmit and / or receive communication on that carrier.

[0005] Communication systems and related equipment typically operate according to a given standard or specification that defines what the various entities associated with the system are allowed to do and how they should do it. Communication protocols and / or parameters used for connectivity are also usually defined. One example of a communication system is UTRAN (3G Radio). Other examples are the Long Term Evolution (LTE) of the Universal Mobile Telecommunications System (UMTS) radio access technology and so-called 5G or New Radio (NR) networks. NR is being standardized by the 3rd Generation Partnership Project (3GPP). Summary of the Invention

[0006] According to a first aspect, an apparatus is provided, comprising components for performing: sending a Hypertext Transfer Protocol (HTTP) connection request to a first roaming intermediary to establish a Transmission Control Protocol (TCP) connection between the first roaming intermediary and a peer device, wherein the TCP connection is used to establish a Public Land Mobile Network (PLN) signaling connection between the device and the peer device via the first roaming intermediary; and receiving a HTTP connection response from the first roaming intermediary, the HTTP connection response including response information indicating whether a TCP connection to the peer device has been established; wherein the HTTP connection request includes information indicating the peer device, and wherein the HTTP connection request includes a header including at least one of: information indicating the device; information describing the purpose of establishing the TCP connection; information describing that the PLASN signaling connection is established by using the TCP connection; or information controlling the first roaming intermediary to forward or initiate messages to the device or the peer device.

[0007] Information describing the purpose of establishing a Transmission Control Protocol (TCP) connection may include information indicating that a Hypertext Transfer Protocol (HTTP) connection request will be used to establish a public land mobile network (PTN) signaling connection between the device and its peer device via a first roaming intermediary.

[0008] Information describing the establishment of a signaling connection between public land mobile networks may include information identifying at least one intended purpose for the establishment of the signaling connection between public land mobile networks.

[0009] The intended purpose for establishing a signaling connection between public land mobile networks can be at least one of the following: roaming intended purpose; disaster roaming intended purpose; mobility intended purpose between public land mobile networks; or SMS interconnection intended purpose.

[0010] Information describing the establishment of a signaling connection between public land mobile networks may include information that identifies the security protocol to be negotiated through the signaling connection between public land mobile networks.

[0011] Security protocols negotiated for signaling connections between public terrestrial mobile networks may include one of the following: the PRINS protocol for N32 interconnect security; the security profile for PRINS; and the Transport Layer Security (TLS) protocol.

[0012] Information controlling the forwarding or initiation of messages by the first roaming intermediary may include information instructing the first roaming intermediary whether it is permitted to perform at least one of the following strategies: accepting or rejecting service requests exchanged between network functions of two public land mobile networks; accepting or rejecting requests from a visited public land mobile network to register an incoming roaming user equipment to the home public land mobile network of the user equipment; deregistering the user equipment; or terminating a packet data unit session.

[0013] Information describing the establishment of an inter-CLTS signaling connection may include a correlation identifier configured to correlate communication messages on the inter-CLTS signaling connection with communication messages on an inter-CLTS message forwarding connection between the device and a peer device. The header may include: a single header; or two or more headers, each of which includes one of the following: information indicating the device; information describing the purpose of establishing the Transmission Control Protocol (TCP) connection; information describing that the inter-CLTS signaling connection is established using a TCP connection; or information controlling the forwarding or initiation of messages by a first roaming intermediary to the device or peer device.

[0014] The Hypertext Transfer Protocol (HTTP) connection response may indicate that a Transmission Control Protocol (TCP) connection to a peer device has been established, and may include information identifying at least one acceptable intended purpose for establishing inter-public terrestrial mobile network signaling communication via a first roaming intermediary.

[0015] The Hypertext Transfer Protocol (HTTP) connection response may indicate that a Transmission Control Protocol (TCP) connection to the peer device has been established, and may include information identifying at least one acceptable security protocol for establishing inter-public terrestrial mobile network communication via a first roaming intermediary.

[0016] Information indicating whether a Transmission Control Protocol (TCP) connection to a peer device has been established may also include information indicating that a TCP connection has not been established, and this information may also include the reason why a TCP connection has not been established.

[0017] The reasons why a Transmission Control Protocol (TCP) connection may not be established may include at least one of the following: no contractual roaming protocol; the peer device is unreachable due to connectivity issues; or an N32 destination is not permitted; and a security protocol is not permitted.

[0018] The Hypertext Transfer Protocol (HTTP) connection response can indicate whether the first roaming intermediary or another roaming intermediary refuses to establish a Transmission Control Protocol (TCP) connection to the peer device.

[0019] The Hypertext Transfer Protocol (HTTP) connection response may include a server header that indicates a refusal to use a roaming intermediary to establish a Transmission Control Protocol (TCP) connection to the peer device.

[0020] The device can be a consumer security edge protection agent in a public terrestrial mobile network, and the peer device can be a producer security edge protection agent in a peer-to-peer public terrestrial mobile network.

[0021] The information indicating the device may include at least one of the following: information identifying the device; or information indicating the public land mobile network of the device.

[0022] Information indicating the device may include the device’s fully qualified domain name.

[0023] Information indicating a peer device may include at least one of the following: information identifying the peer device; or information indicating the peer public land mobile network of the peer device.

[0024] The component can also be used to perform signing of the information before transmission, providing at least one of the following for the information signature: verification by the device at the first roaming intermediary; or verification of the information at the first roaming intermediary.

[0025] The signaling connection between public land mobile networks can be used by the device and its peer to determine the security to be applied for forwarding messages between the two public land mobile networks.

[0026] According to a second aspect, an apparatus is provided that is a roaming intermediary, the apparatus comprising components for performing: receiving from another apparatus a Hypertext Transfer Protocol (HTTP) connection request to establish a Transmission Control Protocol (TCP) connection to a target Secure Edge Protection Agent (SEP) of a target Public Land Mobile Network (PLN), wherein the TCP connection is used to establish a PLAN-to-PLN signaling connection between the target SEP and a consumer SEP via the apparatus, wherein the HTTP connection request includes information instructing the producer SEP, and wherein the HTTP connection request includes a header including at least one of: information instructing the other apparatus; information describing the purpose of establishing the TCP connection; information describing the PLAN-to-PLN signaling connection using the TCP. The information established by the protocol connection; or the information controlling the device to forward or initiate messages to the producer security edge protection agent or another device; and the information used to determine whether a transmission control protocol connection to the target security edge protection agent of the target public terrestrial mobile network has been established; and at least one of the following: sending a hypertext transfer protocol connection response to another device including response information indicating whether a transmission control protocol connection has been established; or sending another hypertext transfer protocol connection request to another roaming intermediary to establish another transmission control protocol connection to the target security edge protection agent of the target public terrestrial mobile network, so as to establish a public terrestrial mobile network signaling connection between the target security edge protection agent and the consumer security edge protection agent via the device and also through the other roaming intermediary.

[0027] An additional Hypertext Transfer Protocol (HTTP) connection request to establish an additional Transmission Control Protocol (TCP) connection to a target Secure Edge Protection Agent (SEP) of a target Public Land Mobile Network (PLM) may include information instructing the target SEP, and wherein the additional HTTP connection request includes a header that includes at least one of the following: information instructing another device; information instructing the device; information describing the purpose of establishing the TPP connection; information describing that the inter-PLM signaling connection is established by using a TPP connection; or information controlling another roaming intermediary to forward or initiate messages to the target SEP or consumer SEP.

[0028] Information describing the purpose of establishing a Transmission Control Protocol (TCP) connection may include information identifying that a Hypertext Transfer Protocol (HTTP) connection request will be used to establish a signaling connection between the target Secure Edge Protection Agent and the consumer Secure Edge Protection Agent via a roaming intermediary.

[0029] Information describing the establishment of a signaling connection between public land mobile networks may include information identifying at least one intended purpose for the establishment of the signaling connection between public land mobile networks.

[0030] The intended purpose for establishing a signaling connection between public land mobile networks can be at least one of the following: roaming intended purpose; disaster roaming intended purpose; mobility intended purpose between public land mobile networks; or SMS interconnection intended purpose.

[0031] Information describing the establishment of a signaling connection between public land mobile networks may include information that identifies the security protocol to be negotiated through the signaling connection between public land mobile networks.

[0032] Security protocols negotiated for signaling connections between public terrestrial mobile networks may include one of the following: the PRINS protocol for N32 interconnect security; the security profile for PRINS; and the Transport Layer Security (TLS) protocol.

[0033] Information controlling the forwarding or initiation of messages by a roaming intermediary may include information instructing the roaming intermediary whether it is permitted to perform at least one of the following strategies: accepting or rejecting service requests exchanged between network functions of two public land mobile networks; accepting or rejecting requests from a visited public land mobile network to register an incoming roaming user equipment to its home public land mobile network; deregistering the user equipment; and terminating a packet data unit session.

[0034] Information describing the establishment of a public land mobile network (PTN) signaling connection may include a correlation identifier configured to correlate communication messages on the PTN signaling connection with communication messages on the PTN message forwarding connection between the consumer security edge protection agent and the target security edge protection agent.

[0035] The header may include: a single header; or two or more headers, each of the two or more headers including one of the following: information indicating the device; information describing the purpose of establishing a Transmission Control Protocol (TCP) connection; information describing that a signaling connection between public land mobile networks is established by using a TCP connection; or information controlling the first roaming intermediary to forward or initiate messages to the device or a peer device.

[0036] The Hypertext Transfer Protocol (HTTP) connection response may indicate that a Transmission Control Protocol (TCP) connection to the target Security Edge Protection Agent has been established, and may include information identifying at least one acceptable intended purpose for establishing signaling communication between public terrestrial mobile networks via a roaming intermediary.

[0037] The Hypertext Transfer Protocol (HTTP) connection response may indicate that a Transmission Control Protocol (TCP) connection to the target Secure Edge Protection Agent has been established, and may include information identifying at least one acceptable security protocol for establishing inter-public terrestrial mobile network communication via a roaming intermediary.

[0038] Information indicating whether a Transmission Control Protocol (TCP) connection to a target security edge protection agent has been established may also include information indicating that a TCP connection has not been established, and this information may also include the reason why a TCP connection has not been established.

[0039] The reasons why a Transmission Control Protocol (TCP) connection may not be established may include at least one of the following: no contractual roaming protocol; the peer device is unreachable due to connectivity issues; an unauthorized N32 destination; or an unauthorized security protocol.

[0040] A Hypertext Transfer Protocol (HTTP) connection response can indicate that the device refuses to establish a Transmission Control Protocol (TCP) connection to another device.

[0041] Hypertext Transfer Protocol (HTTP) connection responses may include a server header that identifies the device.

[0042] The other device may be one of the following: an initiating security edge protection agent in a public terrestrial mobile network; a consumer security edge protection agent in a public terrestrial mobile network; and a preceding connection link roaming intermediary.

[0043] The information instructing the producer's secure edge protection agent may include at least one of the following: information identifying the roaming intermediary for subsequent connection links; information on the public terrestrial mobile network instructing the producer's secure edge protection agent; or information on the public terrestrial mobile network instructing the target secure edge protection agent.

[0044] Information indicating the device may include the fully qualified domain name of another device.

[0045] The component can also be used to perform at least one of the following: verification of the information at the device based on the signature of the information at another device; or verification of the information based on the signature of the information at another device.

[0046] The component used to perform the determination based on the information whether a Transmission Control Protocol (TCP) connection to a target Secure Edge Protection Agent of a target public terrestrial mobile network (PTC) has been established can also be used to determine whether a TCP connection to a target PTC can be established based on at least one of the following: a contractual roaming agreement between a roaming intermediary and the PTC of another device; or a contractual roaming agreement between a roaming intermediary and the target PTC; or at least one of the intended purposes permitted by the contractual agreement between a roaming intermediary and the PTC of another device; or at least one of the intended purposes permitted by the contractual agreement between a roaming intermediary and the target PTC.

[0047] According to a third aspect, an apparatus is provided, the apparatus comprising at least one processor and at least one memory storing instructions, the instructions, when executed by the at least one processor, causing the apparatus to at least: send to a first roaming intermediary a Hypertext Transfer Protocol (HTTP) connection request to establish a Transmission Control Protocol (TCP) connection between the first roaming intermediary and a peer device, wherein the TPP connection is used to establish a Public Land Mobile Network (PLN) signaling connection between the apparatus and the peer device via the first roaming intermediary; and receive from the first roaming intermediary a HTTP connection response, the HTTP connection response including response information indicating whether a TPP connection to the peer device has been established; wherein the HTTP connection request includes information indicating the peer device, and wherein the HTTP connection request includes a header including at least one of: information indicating the apparatus; information describing the purpose of establishing the TPP connection; information describing that the PLANS signaling connection is established by using the TPP connection; or information controlling the first roaming intermediary to forward or initiate messages to the apparatus or the peer device.

[0048] Information describing the purpose of establishing a Transmission Control Protocol (TCP) connection may include information identifying that a Hypertext Transfer Protocol (HTTP) connection request will be used to establish a public land mobile network (PTN) signaling connection between the device and its peer via a first roaming intermediary.

[0049] Information describing the establishment of a signaling connection between public land mobile networks may include information identifying at least one intended purpose for the establishment of the signaling connection between public land mobile networks.

[0050] The intended purpose for establishing a signaling connection between public land mobile networks can be at least one of the following: roaming intended purpose; disaster roaming intended purpose; mobility intended purpose between public land mobile networks; or SMS interconnection intended purpose.

[0051] Information describing the establishment of a signaling connection between public land mobile networks may include information that identifies the security protocol to be negotiated through the signaling connection between public land mobile networks.

[0052] Security protocols negotiated for signaling connections between public terrestrial mobile networks may include one of the following: the PRINS protocol for N32 interconnect security; the security profile for PRINS; and the Transport Layer Security (TLS) protocol.

[0053] Information controlling the forwarding or initiation of messages by the first roaming intermediary may include information instructing the first roaming intermediary whether it is permitted to perform at least one of the following strategies: accepting or rejecting service requests exchanged between network functions of two public land mobile networks; accepting or rejecting requests from a visited public land mobile network to register an incoming roaming user equipment to the home public land mobile network of the user equipment; deregistering the user equipment; and terminating a packet data unit session.

[0054] Information describing the establishment of a public land mobile network (PTN) signaling connection may include a correlation identifier configured to correlate communication messages on the PTN signaling connection with communication messages on the PTN message forwarding connection between the device and a peer device.

[0055] The header may include: a single header; or two or more headers, each of the two or more headers including one of the following: information indicating the device; information describing the purpose of establishing a Transmission Control Protocol (TCP) connection; information describing that a signaling connection between public land mobile networks is established by using a TCP connection; or information controlling the first roaming intermediary to forward or initiate messages to the device or a peer device.

[0056] The Hypertext Transfer Protocol (HTTP) connection response may indicate that a Transmission Control Protocol (TCP) connection to a peer device has been established, and may include information identifying at least one acceptable intended purpose for establishing inter-public terrestrial mobile network signaling communication via a first roaming intermediary.

[0057] The Hypertext Transfer Protocol (HTTP) connection response may indicate that a Transmission Control Protocol (TCP) connection to the peer device has been established, and may include information identifying at least one acceptable security protocol for establishing inter-public terrestrial mobile network communication via a first roaming intermediary.

[0058] Information indicating whether a Transmission Control Protocol (TCP) connection to a peer device has been established may also include information indicating that a TCP connection has not been established, and this information may also include the reason why a TCP connection has not been established.

[0059] The reasons why a Transmission Control Protocol (TCP) connection may not be established may include at least one of the following: no contractual roaming protocol; the peer device is unreachable due to connectivity issues; an unauthorized N32 destination; or an unauthorized security protocol.

[0060] The Hypertext Transfer Protocol (HTTP) connection response can indicate whether the first roaming intermediary or another roaming intermediary refuses to establish a Transmission Control Protocol (TCP) connection to the peer device.

[0061] The Hypertext Transfer Protocol (HTTP) connection response may include a server header that indicates a refusal to use a roaming intermediary to establish a Transmission Control Protocol (TCP) connection to the peer device.

[0062] The device can be a consumer security edge protection agent in a public terrestrial mobile network, and the peer device can be a producer security edge protection agent in a peer-to-peer public terrestrial mobile network.

[0063] The information indicating the device may include at least one of the following: information identifying the device; or information indicating the public land mobile network of the device.

[0064] Information indicating the device may include the device’s fully qualified domain name.

[0065] Information indicating a peer device may include at least one of the following: information identifying the peer device; or information indicating the peer public land mobile network of the peer device.

[0066] The device may also be made to: sign the information before transmission, the signature of which provides at least one of the following: verification by the device at a first roaming intermediary; or verification of the information at a first roaming intermediary.

[0067] The signaling connection between public land mobile networks can be used by the device and its peer to determine the security to be applied for forwarding messages between the two public land mobile networks.

[0068] According to a fourth aspect, an apparatus is provided that is a roaming intermediary, the apparatus comprising at least one processor and at least one memory storing instructions, the instructions, when executed by the at least one processor, causing the apparatus to at least: receive from another apparatus a Hypertext Transfer Protocol (HTTP) connection request to establish a Transmission Control Protocol (TCP) connection to a target Secure Edge Protection Agent (SAP) of a target Public Land Mobile Network (PLN), wherein the TCP connection is used to establish a PLAN-to-PLN signaling connection between the target SAP and a consumer SAP via the apparatus, wherein the HTTP connection request includes information instructing the producer SAP, and wherein the HTTP connection request includes a header including at least one of: information instructing the other apparatus; information describing the purpose of establishing the TCP connection; information describing the PLAN-to-PLN connection; and information describing the purpose of establishing the PLAN connection. The information includes: information established by using a Transmission Control Protocol (TCP) connection; or information controlling the device to forward or initiate messages to a Producer Secure Edge Protection Agent (PEAP) or another device; and determining, based on the information, whether a TCP connection to a Target Secure Edge Protection Agent of a Target Public Land Mobile Network (PLAN) has been established; and performing at least one of the following: sending a Hypertext Transfer Protocol (HTTP) connection response to another device including response information indicating whether a TCP connection has been established; or sending a separate HTTP connection request to another roaming intermediary to establish a separate TCP connection to a Target Secure Edge Protection Agent of a Target Public Land Mobile Network (PLAN), thereby establishing a PLAN signaling connection between the Target Secure Edge Protection Agent and the Consumer Secure Edge Protection Agent via the device and also via another roaming intermediary.

[0069] An additional Hypertext Transfer Protocol (HTTP) connection request to establish an additional Transmission Control Protocol (TCP) connection to a target Secure Edge Protection Agent (SEP) of a target Public Land Mobile Network (PLM) may include information instructing the target SEP, and wherein the additional HTTP connection request includes a header that includes at least one of the following: information instructing another device; information instructing the device; information describing the purpose of establishing the TPP connection; information describing that the inter-PLM signaling connection is established by using a TPP connection; or information controlling another roaming intermediary to forward or initiate messages to the target SEP or consumer SEP.

[0070] Information describing the purpose of establishing a Transmission Control Protocol (TCP) connection may include information identifying that a Hypertext Transfer Protocol (HTTP) connection request will be used to establish a signaling connection between the target Secure Edge Protection Agent and the consumer Secure Edge Protection Agent via a roaming intermediary.

[0071] Information describing the establishment of a signaling connection between public land mobile networks may include information identifying at least one intended purpose for the establishment of the signaling connection between public land mobile networks.

[0072] The intended purpose for establishing a signaling connection between public land mobile networks can be at least one of the following: roaming intended purpose; disaster roaming intended purpose; mobility intended purpose between public land mobile networks; or SMS interconnection intended purpose.

[0073] Information describing the establishment of a signaling connection between public land mobile networks may include information that identifies the security protocol intended to be negotiated through the signaling connection between public land mobile networks.

[0074] Security protocols designed to be negotiated over signaling connections between public terrestrial mobile networks may include one of the following: the PRINS protocol for N32 interconnect security; the security profile for PRINS; and the Transport Layer Security (TLS) protocol.

[0075] Information controlling the forwarding or initiation of messages by a roaming intermediary may include information instructing the roaming intermediary whether it is permitted to perform at least one of the following strategies: accepting or rejecting service requests exchanged between network functions of two public land mobile networks; accepting or rejecting requests from a visited public land mobile network to register an incoming roaming user equipment to its home public land mobile network; deregistering the user equipment; and terminating a packet data unit session.

[0076] Information describing the establishment of a public land mobile network (PTN) signaling connection may include a correlation identifier configured to correlate communication messages on the PTN signaling connection with communication messages on the PTN message forwarding connection between the consumer security edge protection agent and the target security edge protection agent.

[0077] The header may include: a single header; or two or more headers, each of the two or more headers including one of the following: information indicating the device; information describing the purpose of establishing a Transmission Control Protocol (TCP) connection; information describing that a signaling connection between public land mobile networks is established by using a TCP connection; or information controlling the first roaming intermediary to forward or initiate messages to the device or a peer device.

[0078] The Hypertext Transfer Protocol (HTTP) connection response may indicate that a Transmission Control Protocol (TCP) connection to the target Security Edge Protection Agent has been established, and may include information identifying at least one acceptable intended purpose for establishing signaling communication between public terrestrial mobile networks via a roaming intermediary.

[0079] The Hypertext Transfer Protocol (HTTP) connection response may indicate that a Transmission Control Protocol (TCP) connection to the target Secure Edge Protection Agent has been established, and may include information identifying at least one acceptable security protocol for establishing inter-public terrestrial mobile network communication via a roaming intermediary.

[0080] Information indicating whether a Transmission Control Protocol (TCP) connection to a target security edge protection agent has been established may also include information indicating that a TCP connection has not been established, and this information may also include the reason why a TCP connection has not been established.

[0081] The reasons why a Transmission Control Protocol (TCP) connection may not be established may include at least one of the following: no contractual roaming protocol; the peer device is unreachable due to connectivity issues; an unauthorized N32 destination; or an unauthorized security protocol.

[0082] A Hypertext Transfer Protocol (HTTP) connection response can indicate that the device refuses to establish a Transmission Control Protocol (TCP) connection to another device.

[0083] Hypertext Transfer Protocol (HTTP) connection responses may include a server header that identifies the device.

[0084] The other device may be one of the following: an initiating security edge protection agent in a public terrestrial mobile network; a consumer security edge protection agent in a public terrestrial mobile network; and a preceding connection link roaming intermediary.

[0085] The information instructing the producer's secure edge protection agent may include at least one of the following: information identifying the roaming intermediary for subsequent connection links; information on the public terrestrial mobile network instructing the producer's secure edge protection agent; or information on the public terrestrial mobile network instructing the target secure edge protection agent.

[0086] Information indicating the device may include the fully qualified domain name of another device.

[0087] The device may also be configured to perform at least one of the following: verification of the information at the device by another device based on a signature of the information at another device; or verification of the information based on a signature of the information at another device.

[0088] The apparatus, which is configured to perform the determination based on the information whether a Transmission Control Protocol (TCP) connection to a target Secure Edge Protection Agent of a target public terrestrial mobile network has been established, may also be configured to perform the determination based on at least one of the following: a contractual roaming agreement between a roaming intermediary and the public terrestrial mobile network of another device; or a contractual roaming agreement between a roaming intermediary and the target public terrestrial mobile network; or at least one of the intended purposes permitted by the contractual agreement between the roaming intermediary and the public terrestrial mobile network of another device; or at least one of the intended purposes permitted by the contractual agreement between the roaming intermediary and the target public terrestrial mobile network.

[0089] According to a fifth aspect, a method of using an apparatus is provided, the method comprising: sending a Hypertext Transfer Protocol (HTTP) connection request to a first roaming intermediary to establish a Transmission Control Protocol (TCP) connection between the first roaming intermediary and a peer device, wherein the TCP connection is used to establish a Public Land Mobile Network (PLN) signaling connection between the device and the peer device via the first roaming intermediary; and receiving a HTTP connection response from the first roaming intermediary, the HTTP connection response including response information indicating whether a TCP connection to the peer device has been established; wherein the HTTP connection request includes information indicating the peer device, and wherein the HTTP connection request includes a header including at least one of: information indicating the device; information describing the purpose of establishing the TCP connection; information describing that the PLASN signaling connection is established by using the TCP connection; or information controlling the first roaming intermediary to forward or initiate messages to the device or the peer device.

[0090] Information describing the purpose of establishing a Transmission Control Protocol (TCP) connection may include information indicating that a Hypertext Transfer Protocol (HTTP) connection request will be used to establish a public land mobile network (PTN) signaling connection between the device and its peer via a first roaming intermediary.

[0091] Information describing the establishment of a signaling connection between public land mobile networks may include information identifying at least one intended purpose for the establishment of the signaling connection between public land mobile networks.

[0092] The intended purpose for establishing a signaling connection between public land mobile networks can be at least one of the following: roaming intended purpose; disaster roaming intended purpose; mobility intended purpose between public land mobile networks; or SMS interconnection intended purpose.

[0093] Information describing the establishment of a signaling connection between public land mobile networks may include information that identifies the security protocol intended to be negotiated through the signaling connection between public land mobile networks.

[0094] Security protocols designed to be negotiated over signaling connections between public terrestrial mobile networks may include one of the following: the PRINS protocol for N32 interconnect security; the security profile for PRINS; and the Transport Layer Security (TLS) protocol.

[0095] Information controlling the forwarding or initiation of messages by the first roaming intermediary may include information instructing the first roaming intermediary whether it is permitted to perform at least one of the following strategies: accepting or rejecting service requests exchanged between network functions of two public land mobile networks; accepting or rejecting requests from a visited public land mobile network to register an incoming roaming user equipment to the home public land mobile network of the user equipment; deregistering the user equipment; and terminating a packet data unit session.

[0096] Information describing the establishment of a public land mobile network (PTN) signaling connection may include a correlation identifier configured to correlate communication messages on the PTN signaling connection with communication messages on the PTN message forwarding connection between the device and a peer device.

[0097] The header may include: a single header; or two or more headers, each of the two or more headers including one of the following: information indicating the device; information describing the purpose of establishing a Transmission Control Protocol (TCP) connection; information describing that a signaling connection between public land mobile networks is established by using a TCP connection; or information controlling the first roaming intermediary to forward or initiate messages to the device or a peer device.

[0098] The Hypertext Transfer Protocol (HTTP) connection response may indicate that a Transmission Control Protocol (TCP) connection to a peer device has been established, and may include information identifying at least one acceptable intended purpose for establishing signaling communication between public terrestrial mobile networks via a first roaming intermediary.

[0099] The Hypertext Transfer Protocol (HTTP) connection response may indicate that a Transmission Control Protocol (TCP) connection to the peer device has been established, and may include information identifying at least one acceptable security protocol for establishing inter-public terrestrial mobile network communication via a first roaming intermediary.

[0100] Information indicating whether a Transmission Control Protocol (TCP) connection to a peer device has been established may also include information indicating that a TCP connection has not been established, and this information may also include the reason why a TCP connection has not been established.

[0101] The reasons why a Transmission Control Protocol (TCP) connection may not be established may include at least one of the following: no contractual roaming protocol; the peer device is unreachable due to connectivity issues; an unauthorized N32 destination; or an unauthorized security protocol.

[0102] The Hypertext Transfer Protocol (HTTP) connection response can indicate whether the first roaming intermediary or another roaming intermediary refuses to establish a Transmission Control Protocol (TCP) connection to the peer device.

[0103] The Hypertext Transfer Protocol (HTTP) connection response may include a server header that indicates a refusal to use a roaming intermediary to establish a Transmission Control Protocol (TCP) connection to the peer device.

[0104] The device can be a consumer security edge protection agent in a public terrestrial mobile network, and the peer device can be a producer security edge protection agent in a peer-to-peer public terrestrial mobile network.

[0105] The information indicating the device may include at least one of the following: information identifying the device; or information indicating the public land mobile network of the device.

[0106] Information indicating the device may include the device’s fully qualified domain name.

[0107] Information indicating a peer device may include at least one of the following: information identifying the peer device; or information indicating the peer public land mobile network of the peer device.

[0108] The method may also include signing the information before transmission, the signature of which provides at least one of the following: verification by the device at a first roaming intermediary; or verification of the information at a first roaming intermediary.

[0109] The signaling connection between public land mobile networks can be used by the device and its peer to determine the security to be applied for forwarding messages between the two public land mobile networks.

[0110] According to a sixth aspect, a method is provided for an apparatus, the apparatus being a roaming intermediary, the method comprising: receiving from another apparatus a Hypertext Transfer Protocol (HTTP) connection request to establish a Transmission Control Protocol (TCP) connection to a target Secure Edge Protection Agent (SEPPA) of a target Public Land Mobile Network (PLN), wherein the TPP connection is used to establish a PLAN-to-PLN signaling connection between the target SEPPA and a consumer SEPPA via the apparatus, wherein the HTTP connection request includes information instructing a producer SEPPA, and wherein the HTTP connection request includes a header including at least one of: information instructing the other apparatus; information describing the purpose of establishing the TPP connection; and information describing the PLAN-to-PLN signaling connection using the TPP connection. The established information; or information controlling the device to forward or initiate messages to the producer security edge protection agent or other devices; and based on the information, determining whether a transmission control protocol connection to the target security edge protection agent of the target public terrestrial mobile network has been established; and at least one of the following: sending a hypertext transfer protocol connection response to another device including response information indicating whether a transmission control protocol connection has been established; or sending another hypertext transfer protocol connection request to another roaming intermediary to establish another transmission control protocol connection to the target security edge protection agent of the target public terrestrial mobile network, so as to establish a public terrestrial mobile network signaling connection between the target security edge protection agent and the consumer security edge protection agent via the device and also via another roaming intermediary.

[0111] An additional Hypertext Transfer Protocol (HTTP) connection request to establish an additional Transmission Control Protocol (TCP) connection to a target Secure Edge Protection Agent (SEP) of a target Public Land Mobile Network (PLM) may include information instructing the target SEP, and wherein the additional HTTP connection request includes a header that includes at least one of the following: information instructing another device; information instructing the device; information describing the purpose of establishing the TPP connection; information describing that the inter-PLM signaling connection is established by using a TPP connection; or information controlling another roaming intermediary to forward or initiate messages to the target SEP or consumer SEP.

[0112] Information describing the purpose of establishing a Transmission Control Protocol (TCP) connection may include information identifying that a Hypertext Transfer Protocol (HTTP) connection request will be used to establish a signaling connection between the target Secure Edge Protection Agent and the consumer Secure Edge Protection Agent via a roaming intermediary.

[0113] Information describing the establishment of a signaling connection between public land mobile networks may include information identifying at least one intended purpose for the establishment of the signaling connection between public land mobile networks.

[0114] The intended purpose for establishing a signaling connection between public land mobile networks can be at least one of the following: roaming intended purpose; disaster roaming intended purpose; mobility intended purpose between public land mobile networks; or SMS interconnection intended purpose.

[0115] Information describing the establishment of a signaling connection between public land mobile networks may include information that identifies the security protocol intended to be negotiated through the signaling connection between public land mobile networks.

[0116] Security protocols designed to be negotiated over signaling connections between public terrestrial mobile networks may include one of the following: the PRINS protocol for N32 interconnect security; the security profile for PRINS; and the Transport Layer Security (TLS) protocol.

[0117] Information controlling the forwarding or initiation of messages by a roaming intermediary may include information instructing the roaming intermediary whether it is permitted to perform at least one of the following strategies: accepting or rejecting service requests exchanged between network functions of two public land mobile networks; accepting or rejecting requests from a visited public land mobile network to register an incoming roaming user equipment to its home public land mobile network; deregistering the user equipment; and terminating a packet data unit session.

[0118] Information describing the establishment of a public land mobile network (PTN) signaling connection may include a correlation identifier configured to correlate communication messages on the PTN signaling connection with communication messages on the PTN message forwarding connection between the consumer security edge protection agent and the target security edge protection agent.

[0119] The header may include: a single header; or two or more headers, each of the two or more headers including one of the following: information indicating the device; information describing the purpose of establishing a Transmission Control Protocol (TCP) connection; information describing that a signaling connection between public land mobile networks is established by using a TCP connection; or information controlling the first roaming intermediary to forward or initiate messages to the device or a peer device.

[0120] The Hypertext Transfer Protocol (HTTP) connection response may indicate that a Transmission Control Protocol (TCP) connection to the target Security Edge Protection Agent has been established, and may include information identifying at least one acceptable intended purpose for establishing signaling communication between public terrestrial mobile networks via a roaming intermediary.

[0121] The Hypertext Transfer Protocol (HTTP) connection response may indicate that a Transmission Control Protocol (TCP) connection to the target Secure Edge Protection Agent has been established, and may include information identifying at least one acceptable security protocol for establishing inter-public terrestrial mobile network communication via a roaming intermediary.

[0122] Information indicating whether a Transmission Control Protocol (TCP) connection to a target security edge protection agent has been established may also include information indicating that a TCP connection has not been established, and this information may also include the reason why a TCP connection has not been established.

[0123] The reasons why a Transmission Control Protocol (TCP) connection may not be established may include at least one of the following: no contractual roaming protocol; the peer device is unreachable due to connectivity issues; an unauthorized N32 destination; or an unauthorized security protocol.

[0124] A Hypertext Transfer Protocol (HTTP) connection response can indicate that the device refuses to establish a Transmission Control Protocol (TCP) connection to another device.

[0125] Hypertext Transfer Protocol (HTTP) connection responses may include a server header that identifies the device.

[0126] The other device may be one of the following: an initiating security edge protection agent in a public terrestrial mobile network; a consumer security edge protection agent in a public terrestrial mobile network; and a preceding connection link roaming intermediary.

[0127] The information instructing the producer's secure edge protection agent may include at least one of the following: information identifying the roaming intermediary for subsequent connection links; information on the public terrestrial mobile network instructing the producer's secure edge protection agent; or information on the public terrestrial mobile network instructing the target secure edge protection agent.

[0128] Information indicating the device may include the fully qualified domain name of another device.

[0129] The method may further include at least one of the following: verification of the information at the device based on a signature of the information at another device; or verification of the information based on a signature of the information at another device.

[0130] The apparatus for determining whether a Transmission Control Protocol (TCP) connection to a target Secure Edge Protection Agent of a target public terrestrial mobile network has been established based on this information may further include determining whether a TCP connection to a target Secure Edge Protection Agent of a target public terrestrial mobile network can be established based on at least one of the following: a contractual roaming agreement between a roaming intermediary and a public terrestrial mobile network of another device; or a contractual roaming agreement between a roaming intermediary and a target public terrestrial mobile network; or at least one of the intended purposes permitted by a contractual agreement between a roaming intermediary and a public terrestrial mobile network of another device; or at least one of the intended purposes permitted by a contractual agreement between a roaming intermediary and a target public terrestrial mobile network.

[0131] According to a seventh aspect, a computer-readable medium including instructions, when executed by a device, causes the device to at least: send a Hypertext Transfer Protocol (HTTP) connection request to a first roaming intermediary to establish a Transmission Control Protocol (TCP) connection between the first roaming intermediary and a peer device, wherein the TCP connection is used to establish a Public Land Mobile Network (PLN) signaling connection between the device and the peer device via the first roaming intermediary; and receive a HTTP connection response from the first roaming intermediary, the HTTP connection response including response information indicating whether a TCP connection to the peer device has been established; wherein the HTTP connection request includes information indicating the peer device, and wherein the HTTP connection request includes a header including at least one of: information indicating the device; information describing the purpose of establishing the TCP connection; information describing that the PLASN signaling connection is established by using the TCP connection; or information controlling the first roaming intermediary to forward or initiate messages to the device or the peer device.

[0132] According to an eighth aspect, a computer-readable medium including instructions, when executed by a device (which is a roaming intermediary), causes the device to at least: receive from another device a Hypertext Transfer Protocol (HTTP) connection request to establish a Transmission Control Protocol (TCP) connection to a target Secure Edge Protection Agent (SEP) of a target Public Land Mobile Network (PLN), wherein the TCP connection is used to establish a PLAN-to-PLN signaling connection between the target SEP and a consumer SEP via the device, wherein the HTTP connection request includes information instructing a producer SEP, and wherein the HTTP connection request includes a header comprising at least one of: information instructing another device; information describing the purpose of establishing the TCP connection; and information describing the PLAN-to-PLN signaling connection. Information established by using a Transmission Control Protocol (TCP) connection; or information controlling the device to forward or initiate messages to a producer secure edge protection agent or another device; and determining, based on the information, whether a TCP connection to a target secure edge protection agent of a target public terrestrial mobile network has been established; and at least one of the following: sending a Hypertext Transfer Protocol (HTTP) connection response to another device including response information indicating whether a TCP connection has been established; or sending another HTTP connection request to another roaming intermediary to establish another TCP connection to a target secure edge protection agent of a target public terrestrial mobile network, so as to establish a public terrestrial mobile network signaling connection between the target secure edge protection agent and the consumer secure edge protection agent via the device and also via another roaming intermediary.

[0133] In all the foregoing aspects, the means of the user equipment can be configured to provide at least one of a first duration, a second duration, or a third duration to the means of the network access node. Alternatively or additionally, at least one of the first duration or the third duration can be configured by a communication standard.

[0134] According to one aspect, an apparatus includes a circuit system configured to perform: sending a Hypertext Transfer Protocol (HTTP) connection request to a first roaming intermediary to establish a Transmission Control Protocol (TCP) connection between the first roaming intermediary and a peer device, wherein the TCP connection is used to establish a Public Land Mobile Network (PLN) signaling connection between the device and the peer device via the first roaming intermediary; and receiving a HTTP connection response from the first roaming intermediary, the HTTP connection response including response information indicating whether a TCP connection to the peer device has been established; wherein the HTTP connection request includes information indicating the peer device, and wherein the HTTP connection request includes a header including at least one of: information indicating the device; information describing the purpose of establishing the TCP connection; information describing that the PLAN signaling connection is established by using the TCP connection; or information controlling the first roaming intermediary to forward or initiate messages to the device or the peer device.

[0135] According to one aspect, there is an apparatus comprising a circuit system configured to perform: receiving from another apparatus a Hypertext Transfer Protocol (HTTP) connection request to establish a Transmission Control Protocol (TCP) connection to a target Secure Edge Protection Agent (SEP) of a target Public Land Mobile Network (PLN), wherein the TPP connection is used to establish a PLAN-to-PLN signaling connection between the target SEP and a consumer SEP via the apparatus, wherein the HTTP connection request includes information instructing a producer SEP, and wherein the HTTP connection request includes a header comprising at least one of: information instructing the other apparatus; information describing the purpose of establishing the TPP connection; information describing the PLAN-to-PLN signaling connection using the TPP connection. The information subsequently established; or information controlling the device to forward or initiate messages to the producer security edge protection agent or another device; and based on the information determining whether a transmission control protocol connection to the target security edge protection agent of the target public terrestrial mobile network has been established; and at least one of the following: sending a hypertext transfer protocol connection response to another device including response information indicating whether a transmission control protocol connection has been established; or sending another hypertext transfer protocol connection request to another roaming intermediary to establish another transmission control protocol connection to the target security edge protection agent of the target public terrestrial mobile network, so as to establish a public terrestrial mobile network signaling connection between the target security edge protection agent and the consumer security edge protection agent via the device and also via another roaming intermediary.

[0136] According to one aspect, a non-transitory computer-readable medium is provided comprising program instructions that, when executed by a device, cause the device to perform at least the method according to any one of the preceding aspects.

[0137] Many different embodiments have been described above. It should be understood that other embodiments can be provided by any combination of two or more of the above embodiments. Attached Figure Description

[0138] Embodiments will now be described by way of example only with reference to the accompanying drawings, in which:

[0139] Figure 1 A representation of an inter-network communication system according to some example embodiments is shown;

[0140] Figure 2 This illustrates a signal flow graph representation of an example successful single roaming intermediary implementation for establishing an N32-c connection, according to some embodiments.

[0141] Figure 3 This illustrates a signal flow graph representation of an example successful multi-roaming intermediary implementation for establishing an N32-c connection, according to some embodiments.

[0142] Figure 4 This diagram illustrates a signal flow graph representation of an example failed single roaming intermediary implementation for establishing an N32-c connection, according to some embodiments.

[0143] Figure 5 This diagram illustrates a signal flow graph representation of an example failed multi-roaming intermediary implementation for establishing an N32-c connection, according to some embodiments.

[0144] Figure 6 A representation of an example control device suitable for implementing some embodiments is shown;

[0145] Figure 7a A flowchart illustrating the operation of an example consumer security edge protection agent in a public terrestrial mobile network according to some embodiments is shown; and

[0146] Figure 7b A flowchart illustrating the operation of initiating an example Secure Edge Protection Agent or a Consumer Secure Edge Protection Agent or a preceding roaming intermediary in a Public Land Mobile Network according to some embodiments is shown. Detailed Implementation

[0147] The following relates to apparatus, methods, and computer programs for establishing signaling connections between public terrestrial mobile networks, such as between 5G or NR networks. In the hereinafter, certain embodiments are explained with reference to wireless cellular systems and mobile communication systems serving such mobile communication devices. Before explaining the exemplary embodiments in detail, reference is made to… Figure 1 This section briefly explains some general principles for establishing signaling connections between public terrestrial mobile networks to aid in understanding the technology behind the described examples. It should be understood that the following description is not limited to 5G systems and can be extended to systems developed later (e.g., 6G and beyond).

[0148] Figure 1 A schematic diagram is shown of two public terrestrial mobile networks represented by 5G systems (5GS) 100 and 102, and the Internet interconnection achieved by one or more roaming intermediaries (RIs).

[0149] although Figure 1 It is not explicitly stated, but 5GS 100 and 102 can consist of a terminal or user equipment (UE), a 5G radio access network (5G-RAN) or a next-generation radio access network, a 5G core network (5GC), one or more application functions (Af), and one or more data networks (DN).

[0150] 5GC can include the following (network function) entities: Network Slice Selection Function (NSSF); Network Exposure Function; Network Repository Function (NRF); Policy Control Function (PCF); Unified Data Management (UDM); Application Function (AF); Authentication Server Function (AUSF); Access and Mobility Management Function (AMF); and Session Management Function (SMF).

[0151] 5G-RAN can provide at least one coverage area to the terminal. This coverage area is called a cell.

[0152] Internet interconnection allows secure communication between service consumption network function (cNF) 101 and service production network function (pNF) 161 located in different PLMNs (5GS 100 and 102, respectively).

[0153] Security edge protection brokers (SEPPs) in both networks can enable security. Therefore, for example, Figure 1 The diagram shows a service consumption PLMN SEPP c-SEPP 111 located at the edge of the first 5GS 100 and a service production PLMN SEPP p-SEPP 151 located at the edge of the second 5GS 102. SEPPs 111 and 151 are configured to implement protection strategies regarding application layer security, thereby ensuring the integrity and confidentiality of the elements to be protected.

[0154] Furthermore, c-SEPP 111 and p-SEPP 151 may include one or more interconnect providers or roaming intermediaries (RIs). The term roaming intermediary (RI) refers to "an entity that provides roaming-related services" (see 3GPP TS 33.501). For example, this could refer to a roaming center, RVAS (Roaming Value-Added Services Server), or IPX.

[0155] In some embodiments, the interconnect provider is associated with or has specific business or access relationships with operators of various PLMNs. For example, a c-SEPP operator may have a business relationship with a first roaming intermediary (RI-A 131), while a p-SEPP operator may have a business relationship with a second roaming intermediary (RI-B 141). The interconnect provider may also have suitable access or business relationships.

[0156] although Figure 1 Two roaming intermediaries (RI-A 131, RI-B 141) are shown, but it will be understood that interconnection can be achieved using a single roaming intermediary or more than two roaming intermediaries. In the following examples, it can be assumed that they are transparent and simply forward communications.

[0157] In some embodiments, SEPP 111 and 151 may employ JSON Web Encryption (JWE, as specified in RFC 7516) to protect messages on the N32 interface, and the IPX provider may use JSON Web Signature (JWS, as specified in RFC 7515) to sign modifications required for its mediation services.

[0158] For example, consider the scenario where cNF 101 sends a message to pNF 161. If this communication is conducted across PLMN operators via the N32 interface, such as... Figure 1 As shown, c-SEPP 111 receives the message and applies application-layer protection based on a symmetric key, for example, in a manner similar to that defined in Clause 13.2 of TS 33.501. The resulting JWE object is forwarded to roaming intermediaries 131 and 141. In other words, the object is transmitted via a series of N32-c connections: from c-SEPP 111 to RI-A 131 via the first N32-c connection 122, from RI-A 131 to RI-B 141 via the second N32-c connection 123, and from RI-B 141 to p-SEPP 151 via the third N32-c connection 124.

[0159] In addition, such as Figure 1 As shown, N32-c connections 122, 123, and 124 can be used to negotiate N32-f 125-specific security configuration parameters that are requested to implement application-layer security for HTTP messages exchanged between SEPP 141 and 151.

[0160] In other words, 3GPP has defined two security solutions (as shown in TS 33.501) for protecting PLMN-to-PLMN signaling. The first is application layer security (called PRINS, a protocol for N32 interconnect security). The second is so-called end-to-end (e2e) transport layer security (TLS) security.

[0161] In addition, such as Figure 1 As shown, the N32 interface consists of the following components:

[0162] N32-c 122, 123, 124 connections are used to manage N32 interfaces (e.g., negotiating security solutions to apply to PLMN-to-PLMN signaling on the N32-f), and

[0163] The N32-f 125 connection is used to send JWE and JWS protected messages (when using PRINS security) or e2e TLS protected messages (when using TLS security) between SEPPs (when using PRINS security).

[0164] Establishing one or more N32-c connections at a Roaming Intermediary (RI) is an area of ​​current research. Specifically, as discussed in further detail in this paper, the ability of the RI to accept or reject the establishment of N32-c connections between SEPPs is being enhanced.

[0165] The N32 connection establishment process can employ the Hypertext Transfer Protocol (HTTP) CONNECT method to establish a Transmission Control Protocol (TCP) connection between SEPPs via one or more roaming intermediaries. For example, the HTTPConnect method is described in IETF RFC 9110, where the CONNECT method requests the receiver to establish a tunnel to the destination origin server identified by the request target, and if successful, restricts its behavior to bidirectional blind forwarding of data until the tunnel is closed. The tunnel can be used to create end-to-end virtual connections via one or more proxies (RIs), which can then be protected using TLS, as described above.

[0166] Furthermore, similar to IETF RFC 9113, embodiments can be configured to specify that the CONNECT method can be used with an RI configured to support establishing TCP connections to the host and the port identified in the "Authorization" pseudo-header field. After a successful connection establishment, the RI can be configured to send a HEADERS frame containing 2xx series status codes to the requesting client or sender.

[0167] Furthermore, after the initial HEADERS frame sent by each peer establishing the connection, all subsequent DATA frames correspond to the data sent over the TCP connection. The frame payload of any DATA frame (such as c-SEPP) sent by the client is forwarded from RI to p-SEPP; similarly, data sent from p-SEPP to RI can also be forwarded to c-SEPP.

[0168] The embodiments described herein define how the RI determines whether to allow or disallow the establishment of an N32-c connection, and what information (in addition to the identities of the source and destination PLMNs) should be exchanged between the SEPP and the RI for the purpose of such determination.

[0169] Furthermore, in some embodiments, connection establishment can be extended for other purposes, such as troubleshooting and / or for controlling the forwarding / initiation of N32-f messages by the RI.

[0170] The HTTP connection method is a hop-by-hop approach. The client (c-SEPP 111) requests the HTTP proxy server (RI-A 131) to establish a TCP connection / tunnel to the desired destination (p-SEPP 151). RI-A 131 (operating as the HTTP proxy server) then continues to establish the connection on behalf of C-SEPP 111 (operating as the client). After the connection is established by RI-A 131, RI-A 131 continues to proxy TCP flows to or from the client.

[0171] Therefore, an RI (such as RI-A 131 or RI-B 141) can be configured to determine whether it agrees to establish communication between the two SEPPs, and thus can be provided with the ability to terminate the N32-c establishment process. (Note that after TLS establishment, the RI cannot see what was negotiated between the SEPPs in N32-c).

[0172] As described herein, the embodiments provide additional information within the HTTP CONNECT request / response message to prepare for the establishment of an N32-c connection from SEPP to RI (and vice versa) or between two RIs.

[0173] This additional information can be used by the RI to determine whether to allow or disallow the establishment of an N32-c connection. Also as mentioned above, this information can be used for troubleshooting and / or to control the forwarding / initiation of N32-f messages by the RI.

[0174] In addition, in some embodiments, to ensure that no unauthorized modification of the information occurs, the information can be signed and verified during the establishment of the HTTP connection.

[0175] In some embodiments, the RI can be configured to generate and send (or forward) an error message to the requesting source (c-SEPP) that includes information identifying the reason for refusing or disallowing the connection. Therefore, the error message information can be used by c-SEPP 111 to determine whether to retry connection establishment, attempt to establish a connection via a different RI, or for what reason the same RI is no longer being used.

[0176] Therefore, in summary, the embodiments propose including additional information for connection establishment (such as the N32-c connection establishment process) in the HTTP CONNECT request / response message.

[0177] For example, in an HTTP CONNECT request, the additional information could be from c-SEPP 111 to RI-A 131, for at least one of the following: enabling RI-A to (not) allow N32-c connection establishment, debugging and troubleshooting between SEPPs, or to control the forwarding / initiation of N32-f messages by RI.

[0178] In addition, additional information from RI-A 131 to c-SEPP 111 can be included in the HTTP CONNECT response.

[0179] Additional information can be exchanged from RI-A 131 to RI-B 141 and vice versa (in examples where there are two or more RIs between SEPPs).

[0180] Additional information in an HTTP CONNECT request may include at least one of the following: - The HTTP CONNECT request message is used as an indication of N32-c connection establishment; - The target PLMN ID or SNPN ID, or a suitable identifier configured to identify the target network; or - The source PLMN ID and / or SNPN ID, or a suitable identifier configured to identify the source network.

[0181] In some embodiments, the identifier may be signaled in other ways.

[0182] Additional information in the HTTP CONNECT request message may also include multiple intended N32 purposes for the N32 connection. The RI can use this information to determine whether to allow an N32-c connection to be established between two PLMNs / SNPNs solely for a specific or defined N32 purpose. For example, the RI can be configured to allow a connection to be established based on whether the intended purpose is at least one of the following: intended roaming purpose; disaster roaming purpose; intended mobility purpose between public land mobile networks; or intended SMS interconnection purpose. For example, the request may be accepted when the intended purpose is disaster roaming between two PLMNs without other roaming protocols.

[0183] Additional information in the HTTP CONNECT request message can be the requested N32-f security solution (in other words, whether it's PRINS or TLS, it's an N32-f security solution; and if PRINS is optional, it's the expected PRINS security profile). For example, if SEPP's intent is to use the contracted RI only for TLS proxying (IP-level routing), or if the RI has the option to modify or include its own information. The intent to continue using TLS or PRINS, or which security profile is used for N32-f, can influence the RI's decision on whether to establish an N32-c connection. In other words, the RI can determine whether to establish a public land mobile network signaling connection based on whether the requested security solution is implemented at the RI.

[0184] Additional information in the HTTP CONNECT request message can be the c-SEPP FQDN, which is used to identify the source SEPP. For example, this information is very useful for debugging or troubleshooting if the connection establishment fails or fails at some future time.

[0185] Additional information in the HTTP CONNECT request message can be about the c-SEPP policy initiated by the RI via an N32-f message. For example, the additional information can indicate whether the RI is allowed to reject registration requests, deregister the UE, or terminate the PDU session.

[0186] Additional information in the HTTP CONNECT request message may also include an N32 correlation ID (N32 handshake ID), which SEPP is configured to use later to associate N32-c and N32-f. For example, this information can help provide error information back to SEPP. In some embodiments, if different correlation IDs are used in the N32-f message for different directions, passing the N32 correlation ID in the HTTP CONNECT request can only be used to enable correlation on the N32-f interface for the initiating direction with the N32-c connection (e.g., c-SEPP initiates request → p-SEPP receives request).

[0187] In some embodiments, since the HTTP CONNECT request message cannot encode the content (i.e., the payload body), additional information is encoded in the HTTP header. This can be done within a custom header definition or using a 3GPP defined header, where one or more fields in the defined header are repurposed with the additional information.

[0188] In other words, this information can be incorporated into a new HTTP header or into an existing 3GPP custom HTTP header that was not previously used in the context of the N32-c connection establishment. For example, this information can be incorporated into the fields 3gpp-Sbi-Originating-Network-Id, 3gpp-Sbi-Interplmn-Purpose, and 3gpp-Sbi-NF-Peer-Info.

[0189] Here is an example: Example 1: CONNECT sepp.5gc.mnc203.mcc422.3gppnetwork.org:443 3gpp-Sbi-Connect-Info: connect-purpose=N32C; security=PRINS; n32-correlation-id=0600AD1855BD6007 3gpp-Sbi-Originating-Network-Id: 123-45 3gpp-Sbi-Interplmn-Purpose: ROAMING 3gpp-Sbi-NF-Peer-Info: srcsepp=sepp12.5gc.mnc155.mcc400.3gppnetwork;dstri=ri3.operator.com 3gpp-Sbi-RI-Policies: allow=REJECT_UE_REGISTRATION, DEREGISTER_UE;disallow=TERMINATE_PDU_SESSION

[0190] In this example, the information in the 3gpp-Sbi-Connect-Info line: connect-purpose=N32C; security=PRINS; n32-correlation-id=0600AD1855BD6007 defines that the connection is N32C and the security policy to be used is PRINS, and further defines the correlation identifier.

[0191] Furthermore, the connection purpose is defined in the ROAMING information by 3gpp-Sbi-Interplmn-Purpose:ROAMING.

[0192] The allow and disallow policies for RI are further defined in the information of line 3gpp-Sbi-RI-Policies: allow=REJECT_UE_REGISTRATION, DEREGISTER_UE; disallow=TERMINATE_PDU_SESSION.

[0193] The second example is as follows: Example 2: CONNECT sepp.5gc.mnc203.mcc422.3gppnetwork.org:443 3gpp-Sbi-Connect-Info: connect-purpose=N32C; security=PRINS; n32-correlation-id=0600AD1855BD6007; originating-Network-Id: 123-45; N32-purpose:ROAMING; srcsepp=sepp12.5gc.mnc155.mcc400.3gppnetwork; policies-allow=REJECT_UE_REGISTRATION, DEREGISTER_UE; policies-disallow=TERMINATE_PDU_SESSION

[0194] In the example above: sepp.5gc.mnc203.mcc422.3gppnetwork.org represents the FQDN of p-SEPP, and sepp12.5gc.mnc155.mcc400.3gppnetwork represents the FQDN of c-SEPP.

[0195] Upon receiving an HTTP CONNECT request from c-SEPP, RI is configured to determine, based on this information, whether a Transmission Control Protocol (N32-c) connection to the target Security Edge Protection Agent of the target public terrestrial mobile network has been established.

[0196] In other words, the determination of whether to establish a connection (to p-SEPP 151) can be based on the source PLMN ID or SNPN-ID or the target PLMN ID or SNPN ID. This determination can be similar to known mechanisms used to determine whether to establish a connection based on the source PLMN or the target PLMN.

[0197] Furthermore, the determination of whether to establish a connection can be based on the operator / network identifier of the preceding RI, which is based on known signaling (from RI-A 131 to RI-B 141) of the RHUB ID.

[0198] As mentioned earlier, the determination at the RI regarding whether to establish a connection can be based on the purpose of HTTP CONNECT. For example, the RI can be configured to only accept HTTP CONNECT requests for the purpose of establishing an N32-c connection.

[0199] Furthermore, in some embodiments, the determination at the RI is configured to determine whether the requested N32-f security solution matches the solution accepted by the RI. For example, the RI determination can be configured to accept the HTTP CONNECT request only if the request is used to establish PRINS security on N32-f.

[0200] Furthermore, in some embodiments, the determination at the RI regarding whether to establish a connection can be based on the intended purpose of the N32. Thus, for example, the RI is configured to accept only requests between the two PLMNs for one or more specific or defined intended purposes (such as disaster roaming).

[0201] In some embodiments, a system with multiple RIs between c-SEPP and p-SEPP can be configured to propagate, based on the determination to establish a connection, some or all of the additional information received in the HTTP CONNECT request in a separate HTTP CONNECT request sent to a second or additional RI (RI-B 141). Furthermore, in some embodiments, the first RI (RI-A 131) is configured to add its own RI operator / network ID to the HTTP CONNECT request forwarded to the second or additional RI.

[0202] In some embodiments, RI determination can be configured to use additional information received in HTTP CONNECT for troubleshooting or in response to appropriate requests.

[0203] For example, in some embodiments, the RI can generate an appropriate response to the SEPP (or an earlier RI in the chain) and provide information within the response that is suitable for assisting in the establishment or troubleshooting the establishment attempt.

[0204] For example, this information can be included in an HTTP CONNECT response as discussed below.

[0205] If the response indicates that the connection between SEPPs has been successfully established, the response can be a '200 OK' response.

[0206] The '200 OK' response may also include information identifying permitted N32 purposes for the N32 connection. These permitted N32 purposes may be a subset of the N32 purposes signaled to the RI in the request. This information may then be used by the SEPP (or an earlier or preceding RI in the chain) to indicate whether to send any future requests to the RI and thus prevent the SEPP (or an earlier RI) from sending requests to a specific RI for prohibited connection purposes.

[0207] The '200 OK' response may also include information identifying that N32-f security solutions are permitted. These permitted N32-f security solutions can be used by the SEPP to implement specific security solutions. For example, when a request indicates that both TLS and PRINS are acceptable, but the RI wants to implement a specific security solution, such as PRINS, the SEPP can be configured to adopt the N32-f security solution indicated by the information in the response.

[0208] In some embodiments, the information may specify other aspects associated with the security solution. For example, the RI may specify that it requires PRINS security and may also provide a security profile indicating which information elements (IEs) should be encrypted and which IEs need to be available in plaintext so that the RI can operate between SEPPs.

[0209] The '200 OK' response may also include information identifying the p-SEPP FQDN. Therefore, even if the RI has already overridden the p-SEPP FQDN with the specific p-SEPP FQDN of the target MNO (based on the local configuration at the RI and / or the contractual agreement between the RI and the target MNO), this information can still be used for future troubleshooting or debugging.

[0210] The '200 OK' response may also include information indicating whether the same HTTP connection between c-SEPP and RI can be used by c-SEPP to establish additional tunnels for other N32-c connections. In other words, this information can indicate whether c-SEPP can initiate a new HTTP CONNECT request (using a different HTTP / 2 stream identifier) ​​on the HTTP connection to establish a TCP tunnel to the same or a different SEPP.

[0211] In the event that a connection between SEPPs fails to be established, the response may be a '4xx / 5xx' response. A '4xx / 5xx' response may also include information identifying the reason for the failure. This information may be included in a "new application error," such as "Roaming is not allowed for the requested N32 purpose," or alternatively, a generic "HTTP CONNECT refused" response may include one or more additional parameters to indicate which parameters of the HTTP CONNECT caused the failure.

[0212] In some embodiments, to ensure that no information has been modified between c-SEPP and RI, this information may be signed by the initiating SEPP, and then the RI may be configured to verify the signature.

[0213] This is useful in cases where no secure channel is established between c-SEPP and RI before the HTTP CONNECT request message is sent. This enhancement can be used to ensure that RI can prove the sender's origin and that the message is protected for integrity.

[0214] Therefore, in some embodiments, c-SEPP is configured to use the response information received in the response when / after receiving the HTTP CONNECT response. For example, to define the N32 purpose or security solution and / or profile, c-SEPP may negotiate with the peer SEPP during the N32-c handshake service request.

[0215] If the 200 OK response includes the p-SEPP FQDN, then c-SEPP can be configured to establish an N32-c TLS connection and send an N32-c service request (instead of using the known p-SEPP FQDN).

[0216] In such an embodiment, the p-SEPP TLS certificate does not need to contain a SAN entry that includes a known p-SEPP FQDN.

[0217] If an error response is received, c-SEPP logs the error and can restart the entire process based on the received error information to prevent the error from recurring.

[0218] According to some implementations, other example HTTP custom headers may be as follows.

[0219] 3gpp-Connect-Req-Info

[0220] The header enables the information in the HTTP CONNECT request to be conveyed to the roaming intermediary, which can use this information to determine whether to allow the establishment of an N32-c connection and / or to troubleshoot.

[0221] The encoding of the header follows ABNF defined in IETF RFC 9110. Connect-Info-Req-Header = "3gpp-Connect-Req-Info:" OWS "connect-purpose:" OWS connect-purpose-value ";" OWS orig-network-id ";" OWS sender-fqdn [";" OWS intended-n32-purposes] ( ";" OWS req-param ) connect-purpose-value = "n32c" / token orig-network-id = "originating-network-id:" OWS 3DIGIT "-" 2 3DIGIT[ "-" 11HEXDIGIT ] sender-fqdn = "sender-fqdn:" OWS 4 ( ALPHA / DIGIT / "-" / "." ) intended-n32-purposes = 1# ( "intended-n32-purpose: " OWS n32-purpose-value) n32-purpose-value = "ROAMING" / "INTER_PLMN_MOBILITY" / "SMS_INTERCONNECT" / "ROAMING_TEST" / "INTER_PLMN_MOBILITY_TEST" / "SMS_INTERCONNECT_TEST" / "SNPN_INTERCONNECT" / "SNPN_INTERCONNECT_TEST" / "DISASTER_ROAMING" / "DISASTER_ROAMING_TEST" / token req-param = req-param-name ":" OWS req-param-value req-param-name = token req-param-value = token

[0222] Example 1: For an HTTP CONNECT request message from c-SEPP to RI-A requesting the establishment of a TCP connection to p-SEPP, 3gpp-Connect-Req-Info: connect-purpose: n32c; originating-network-id:123-45; sender-fqdn: sepp12.5gc.mnc155.mcc400.3gppnetwork; intended-n32-purpose: ROAMING; intended-32-purpose: SMS_INTERCONNECT

[0223] Example 2: For an HTTP CONNECT request message used to request the establishment of a TCP connection from RI-A to RI-B to p-SEPP, 3gpp-Connect-Req-Info: connect-purpose; n32c; originating-network-id:123-45; sender-fqdn: ri234.riooperator.com; intended-n32-purpose: ROAMING;;intended-n32-purpose: SMS_INTERCONNECT

[0224] 3gpp-Connect-Resp-Info

[0225] The header enables the information in the HTTP CONNECT response to be conveyed to c-SEPP.

[0226] The header encoding follows the ABNF defined in IETF RFC 9110. Connect-Info-Resp-Header = "3gpp-Connect-Resp-Info:" OWS [allowed-n32-purposes OWS] [";" p-sepp-fqdn] ( ";" OWS resp-param ) allowed-n32-purposes = 1# ( "allowed-n32-purpose=" n32-purpose) p-sepp-fqdn = "p-sepp-fqdn:" OWS 4 (ALPHA / DIGIT / "-" / ".") resp-param = resp-param-name ":" OWS resp-param-value resp-param-name = token resp-param-value = token

[0227] Example: 3gpp-Connect-Resp-Info: allowed-n32-purpose: ROAMING; p-sepp-fqdn: sepp2.5gc.mnc203.mcc422.3gppnetwork.org

[0228] about Figures 2 to 5 A series of signal flow graphs are shown, illustrating successful and unsuccessful connection establishment based on some embodiments. For example, Figure 2 and Figure 3 Successful connection establishment in single and multiple RI connection chain configurations according to some embodiments is illustrated. Figure 4 and Figure 5 Unsuccessful attempts to establish a connection are shown in single and multiple RI connection chain configurations according to some embodiments.

[0229] Figures 2 to 5 The initial operation of all signal flow graphs is the establishment of a TCP connection between c-SEPP 111 and RI-A 131, step 201. Then, c-SEPP 110 is configured to send an HTTP CONNECT request to RI-A 131, as shown in step 203. The HTTP CONNECT request includes information identifying the peer device (p-SEPP). In this example, this information is the p-SEPP host and port. Furthermore, the request includes additional information as described above.

[0230] RI-A 131 receives an HTTP CONNECT request and, based on information identifying the peer device (target SEPP or p-SEPP) and additional information as described above, is configured to determine whether a Transmission Control Protocol (TCP) connection to the target SEPP of the target public land mobile network should be established, as shown in 205.

[0231] about Figure 2 The RI-A is configured to determine, based on this information, whether the request should be accepted and whether a Transmission Control Protocol (TCP) connection to the target SEPP of the target public land mobile network should be established.

[0232] Then, as shown in 207, RI-A is configured to establish a TCP connection between RI-A 131 and p-SEPP 151.

[0233] After the TCP connection is established, RI-A is configured to generate an HTTP CONNECT response, which includes a '200 OK' response and the response information described above. As shown in 209, the '200 OK' response is sent back to c-SEPP 111.

[0234] Then, RI-A 131 can be configured to blindly forward messages, as shown in 211.

[0235] Subsequently, the end-to-end (e2e) N32-c TLS connection is established, as shown in 213.

[0236] In addition, the end-to-end (e2e) N32-c handshake service request / response is completed, as shown in 215.

[0237] about Figure 3 This demonstrates the successful establishment of a connection in a multi-RI connection chain configuration.

[0238] After successfully determining that the request will be accepted at RI-A 131, RI-A 131 is configured to establish a TCP connection between RI-A 131 and RI-B 141, as shown in 301.

[0239] Then, RI-A 131 is configured to send an HTTP CONNECT request to RI-B 141, as shown in 303. The HTTP CONNECT request includes information identifying the peer device (p-SEPP). In this example, this information is the p-SEPP host and port. Furthermore, the request includes additional information as described above. As mentioned above, the additional information could also be other information associated with RI-A 131.

[0240] RI-B 141 is configured to receive HTTP CONNECT requests and, based on information identifying the peer device (target SEPP or p-SEPP) and additional information as described above, to determine whether a Transmission Control Protocol (TCP) connection to the target SEPP of the target public land mobile network should be established, as shown in 305.

[0241] about Figure 3The RI-B is configured to determine, based on this information, whether the request should be accepted and whether a Transmission Control Protocol (TCP) connection to the target SEPP of the target Public Land Mobile Network should be established.

[0242] Then, as shown in 307, RI-B is configured to establish a TCP connection between RI-B 141 and p-SEPP 151.

[0243] After the TCP connection is established, RI-B is configured to generate an HTTP CONNECT response, which includes a '200 OK' response and the response information described above. As shown in 309, the '200 OK' response is sent back to RI-A 131.

[0244] As described above, the response, including a '200 OK' response and also including response information, is received by RI-A 131 and then forwarded to c-SEPP 111. As shown in 311, the '200 OK' response is sent back to c-SEPP 111.

[0245] Then, RI-B 131 can be configured to blindly forward messages, as shown in 315, and RI-A 121 can be configured to blindly forward messages, as shown in 313.

[0246] Subsequently, the end-to-end (e2e) N32-c TLS connection is established, as shown in 317.

[0247] In addition, the end-to-end (e2e) N32-c handshake service request / response is completed, as shown in 319.

[0248] about Figure 4 This shows a failed request regarding a single RI configuration. RI-A is configured to determine whether the request should be rejected based on this information.

[0249] Then, as shown in 207, RI-A is configured to generate and send an appropriate response back to c-SEPP 111, which includes response information. In this example, as shown in 401, a '403 Forbidden' response including error information is sent back to c-SEPP 111.

[0250] about Figure 3 The failure to establish a connection is shown in a multi-RI connection chain configuration.

[0251] After successfully determining that the request will be accepted at RI-A 131, RI-A 131 is configured to establish a TCP connection between RI-A 131 and RI-B 141, as shown in 301.

[0252] Then, RI-A 131 is configured to send an HTTP CONNECT request to RI-B 141, as shown in 303. The HTTP CONNECT request includes information identifying the peer device (p-SEPP). In this example, this information is the p-SEPP host and port. Furthermore, the request includes additional information as described above. As mentioned above, the additional information could also be other information associated with RI-A 131.

[0253] RI-B 141 is configured to receive HTTP CONNECT requests and, based on information identifying the peer device (target SEPP or p-SEPP) and additional information as described above, to determine whether a Transmission Control Protocol (TCP) connection to the target SEPP of the target public land mobile network should be established, as shown in 305.

[0254] about Figure 5 RI-B is configured to determine whether the request should be rejected based on this information.

[0255] Then, as shown in 501, RI-B is configured to generate and send an appropriate response back to RI-A 131, which includes response information. In this example, a '403 Forbidden' response including error information is sent back to RI-A 131.

[0256] The response is received by RI-A 131 and then forwarded to c-SEPP 111 as described above. As shown in 503, a '403 Forbidden' response is sent back to c-SEPP 111.

[0257] Figure 6 The diagram illustrates the control methods such as Figure 1 An example of a control device 600 for functions such as SEPP or RI is shown. The control device may include at least one random access memory (RAM) 611a, at least one read-only memory (ROM) 611b, at least one processor 612, 613, and an input / output interface 614. At least one processor 612, 613 may be coupled to RAM 611a and ROM 611b. At least one processor 612, 613 may be configured to execute appropriate software code 615. Software code 615 may, for example, allow the execution of one or more steps to perform one or more aspects of the invention. Software code 615 may be stored in ROM 611b. Control device 600 may be interconnected with another control device 600 controlling other functions of 5GRAN or 5GC. In some embodiments, each function of 5GRAN or 5GC includes control device 600. In alternative embodiments, two or more functions of 5GRAN or 5GC may share a control device.

[0258] like Figure 7a The diagram illustrates a flowchart of a method according to an embodiment of this disclosure. This method can be used with or performed by devices in a public terrestrial mobile network (e.g., a Consumer Security Edge Protection Agent (c-SEPP) or a device including c-SEPP). Note that a device including c-SEPP refers to a device that performs at least a portion of the functions of c-SEPP.

[0259] As shown in 701, the method includes sending an HTTP CONNECT request to a first roaming intermediary to establish a TCP connection between the first RI and the peer device.

[0260] Furthermore, as shown in 703, a Hypertext Transfer Protocol (HTTP) connection response is received from the first roaming intermediary. The HTTP connection response includes response information indicating whether a Transmission Control Protocol (TCP) connection to the peer device has been established.

[0261] Specifically, the device sends an HTTP CONNECT request to a first roaming intermediary (RI) to establish a TCP connection between the first RI and the peer device. In one embodiment, the TCP connection is used to establish a public land mobile network signaling connection (e.g., N32-c, or signaling connection on an N32 interface) between the device and the peer device (e.g., p-SEPP, including p-SEPP devices / equipment) via the first RI. The device receives a Hypertext Transfer Protocol (HTTP) connection response from the first RI. In one embodiment, the HTTP connection response indicates that a Transmission Control Protocol (TCP) connection to the peer device has been established.

[0262] In one embodiment, an HTTP CONNECT request can be used to establish a UDP (User Datagram Protocol) connection (e.g., a tunnel for UDP communication) between the first RI and a peer device, wherein the UDP connection is used to establish a public land mobile network (PLAN) signaling connection between the RI and the peer device. In this embodiment, the security protocol intended to be negotiated via the PLAN signaling connection may also include the Fast UDP Internet Connection (QUIC) protocol.

[0263] In one embodiment, an HTTP CONNECT request includes at least one of the following: - Information indicating the peer device; - Information indicating / identifying peer devices; - Information indicating / identifying the device; - Information describing / indicating the purpose of establishing a Transmission Control Protocol (TCP) connection; - Information describing / indicating signaling connections between public land mobile networks established using Transmission Control Protocol (TCP) connections; or - Information that controls the first roaming intermediary to forward or initiate messages to the device or peer device.

[0264] In one embodiment, at least one of the following is included in one or more headers of the HTTP CONNECT request: information indicating / identifying a peer device; information indicating / identifying the device; information describing / indicating the purpose of establishing a Transmission Control Protocol (TCP) connection; information describing / indicating a signaling connection between public land mobile networks established by using a TCP connection; or information controlling the first roaming intermediary to forward or initiate messages to the device or peer device.

[0265] In one embodiment, if this information is in an HTTP CONNECT request, then at least one of the following is included in one or more headers of the HTTP CONNECT request: information indicating / identifying a peer device; information indicating / identifying the device; information describing / indicating the purpose of establishing a Transmission Control Protocol (TCP) connection; information describing / indicating a signaling connection between public land mobile networks established by using a TCP connection; or information controlling the first roaming intermediary to forward or initiate messages to the device or peer device.

[0266] Figure 7b A flowchart of a method according to an embodiment of the present disclosure is shown. This method can be used with an apparatus / device and / or performed by an apparatus / device.

[0267] In one embodiment, the apparatus / device includes a prior connection link roaming intermediary (e.g., a first RI or RI). Note that an apparatus / device including a prior connection link roaming intermediary means an apparatus / device that performs at least a portion of the functions of the prior connection link roaming intermediary.

[0268] Therefore, as shown in 751, the device receives an HTTPCONNECT request to establish a TCP connection to the target SEPP of the target PLMN.

[0269] In addition, as shown in 753, at least one of the following is performed: sending an HTTP CONNECT response including response information indicating whether a TCP connection has been established to another device; or sending another HTTP CONNECT request to another roaming intermediary to establish another TCP connection to the target SEPP of the target PLMN, so as to establish an inter-PLMN signaling connection between the target SEPP and the consumer SEPP via the device and also via another roaming intermediary.

[0270] Specifically, the device (e.g., the first RI, or RI) receives from another device (e.g., c-SEPP, device / equipment including c-SEPP) an HTTP CONNECT request to establish a TCP connection between the first RI and a peer device (e.g., p-SEPP, device / equipment including p-SEPP). In one embodiment, the TCP connection is used to establish a public land mobile network signaling connection (e.g., N32-c, or signaling connection on an N32 interface) between the other device (c-SEPP) and the peer device (e.g., p-SEPP, device / equipment including p-SEPP) via the device (e.g., the first RI, or RI). In one embodiment, the peer device is also referred to as the target device / SEPP in the target PLMN.

[0271] In response to an HTTP CONNECT request, the device may perform at least one of the following: - Send an HTTP CONNECT response to another device, including response information indicating whether a TCP connection has been established; or - Send an additional HTTP CONNECT request to another roaming intermediary (e.g., a second RI) to establish another TCP connection to the target SEPP of the target PLMN, so as to establish an inter-PLMN signaling connection between the target SEPP and the consumer SEPP via the device and also through another roaming intermediary.

[0272] For example, the RI receiving the HTTP CONNECT request can determine whether to accept the request and / or establish a TCP connection based on the HTTP CONNECT request. If it is determined that the request should not be accepted and / or a TCP connection should not be established, the RI sends an HTTP CONNECT response to the device that sent the HTTP CONNECT request (i.e., c-SEPP or another RI), wherein the HTTP CONNECT response (or information included in the HTTP CONNECT response) indicates that the TCP connection was not established or the HTTP CONNECT request was rejected.

[0273] If it is determined that the request should be accepted and / or a TCP connection should be established, the RI sends an HTTP CONNECT response to the device that sent the HTTP CONNECT request (i.e., c-SEPP or another RI), wherein the HTTP CONNECT response (or the information included in the HTTP CONNECT response) indicates that a TCP connection has been established or the HTTP CONNECT request has been accepted.

[0274] As an alternative or supplement, if it is determined that the request should be accepted and / or a TCP connection established, the RI sends an HTTP CONNECT request to another RI (e.g., a second RI) to establish a TCP connection to p-SEPP. Based on the HTTP CONNECT response from the other RI, the RI sends an HTTP CONNECT response to the device that sent the HTTP CONNECT request (i.e., c-SEPP or the other RI), where the HTTP CONNECT response (information) indicates whether the TCP connection has been established or whether the HTTP CONNECT has been accepted / rejected.

[0275] In one embodiment, an HTTP CONNECT request includes at least one of the following: - Information indicating the peer device; - Information indicating / identifying peer devices; - Information indicating / identifying the device; - Information describing / indicating the purpose of establishing a Transmission Control Protocol (TCP) connection; - Information describing / indicating signaling connections between public land mobile networks established using Transmission Control Protocol (TCP) connections; or - Information that controls the first roaming intermediary to forward or initiate messages to the device or peer device.

[0276] In one embodiment, at least one of the following is included in one or more headers of the HTTP CONNECT request: information indicating / identifying a peer device; information indicating / identifying the device; information describing / indicating the purpose of establishing a Transmission Control Protocol (TCP) connection; information describing / indicating a signaling connection between public land mobile networks established by using a TCP connection; or information controlling the first roaming intermediary to forward or initiate messages to the device or peer device.

[0277] In one embodiment, if this information is in an HTTP CONNECT request, then at least one of the following is included in one or more headers of the HTTP CONNECT request: information indicating / identifying a peer device; information indicating / identifying the device; information describing / indicating the purpose of establishing a Transmission Control Protocol (TCP) connection; information describing / indicating a signaling connection between public land mobile networks established by using a TCP connection; or information controlling the first roaming intermediary to forward or initiate messages to the device or peer device.

[0278] In this disclosure, "means having / including network functionality (e.g., SEPP)" refers to means that performs or is configured to perform at least a portion of the functionality of the network functionality. For example, the means includes components for performing at least a portion of the functionality of the network functionality.

[0279] It should be understood that these devices may include or be coupled to other units or modules, such as radio components or radio heads for transmission and / or reception. Although these devices are described as a single entity, different modules and memories may be implemented in one or more physical or logical entities.

[0280] It should be noted that while some embodiments have been described for 5G networks, similar principles can be applied to other networks and communication systems. Therefore, although certain embodiments have been described by way of example with reference to certain example architectures of wireless networks, technologies, and standards, these embodiments can be applied to any other suitable form of communication system besides those shown and described herein.

[0281] It should also be noted that although exemplary embodiments have been described above, various changes and modifications can be made to the disclosed solutions without departing from the scope of the present invention.

[0282] As used herein, “at least one of the following: ” and “at least one of the following: ” and similar wording (where the list of two or more elements is connected by “and” or “or”) means at least any one of these elements, or at least any two or more of these elements, or at least all of these elements.

[0283] Generally, various embodiments can be implemented in hardware or special-purpose circuit systems, software, logic, or any combination thereof. Some aspects of this disclosure can be implemented in hardware, while others can be implemented in firmware or software that can be executed by a controller, microprocessor, or other computing device, but this disclosure is not limited thereto. While various aspects of this disclosure may be shown and described as block diagrams, flowcharts, or using some other graphical representation, it is well understood that, by way of non-limiting example, the blocks, apparatuses, systems, techniques, or methods described herein can be implemented in hardware, software, firmware, special-purpose circuits or logic, general-purpose hardware or controllers or other computing devices, or some combination thereof.

[0284] As used in this application, the term "circuit system" may refer to one or more or all of the following: (a) Hardware circuit implementation only (such as implementation in analog and / or digital circuit systems only), and (b) A combination of hardware circuitry and software, such as (if applicable): (c) A combination of (multiple) analog and / or digital hardware circuit systems with software / firmware, and (i) Any part of a hardware processor (including (multiple) digital signal processors), software, and (multiple) memories that work together to cause a device such as a mobile phone or server to perform various functions, and (ii) (multiple) hardware circuits and / or (multiple) processors, such as (multiple) microprocessors or a portion thereof, which require software (e.g., firmware) to operate, but may be absent when operation is not required.

[0285] This definition of circuit system applies to all uses of the term in this application, including in any claim. As another example, as used herein, the term circuit system also covers only the implementation of hardware circuitry or a processor (or processors) or a portion thereof, and its accompanying software and / or firmware. For example, if applicable to a particular claim element, the term circuit system also covers baseband integrated circuits or processor integrated circuits for mobile devices, or similar integrated circuits in servers, cellular network devices, or other computing or network devices.

[0286] The exemplary embodiments of this disclosure can be implemented by computer software executable by the data processor of a mobile device, such as in a processor entity, or by hardware, or by a combination of software and hardware. Computer software or programs (also referred to as program products, including software routines, applets, and / or macros) can be stored in any device-readable data storage medium, and they include program instructions for performing a specific task. A computer program product may include one or more computer-executable components that, when the program is run, are configured to perform the embodiments. The one or more computer-executable components may be at least one piece of software code or a portion thereof.

[0287] Furthermore, it should be noted in this regard that any block of the logic flow shown in the figure can represent a program step, or an interconnected logic circuit, block and function, or a combination of program steps and logic circuits, blocks and functions. Software can be stored on physical media implemented within a processor, such as memory chips or memory blocks; magnetic media, such as hard disks or floppy disks; and optical media, such as DVDs and their data variants, CDs. The physical medium is a non-transitory medium.

[0288] As used herein, the term “non-transient” refers to a limitation on the medium itself (i.e., tangible, not signaling), rather than a limitation on the persistence of data storage (e.g., RAM vs. ROM).

[0289] The memory can be of any type suitable for the local technical environment and can be implemented using any suitable data storage technology, such as semiconductor-based memory devices, magnetic memory devices and systems, optical memory devices and systems, fixed memory, and removable memory. The data processor can be of any type suitable for the local technical environment and can include one or more of the following as non-limiting examples: general-purpose computers, special-purpose computers, microprocessors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), FPGAs, gate-level circuits, and processors based on multi-core processor architectures.

[0290] The embodiments of this disclosure can be implemented in various components such as integrated circuit modules. The design of integrated circuits is largely a highly automated process. Complex and powerful software tools can be used to convert logic-level designs into semiconductor circuit designs for etching and formation on semiconductor substrates.

[0291] The independent claims define the scope of protection sought by the various embodiments of this disclosure. Embodiments and features described in this specification that are not within the scope of the independent claims, if any, are to be interpreted as examples that aid in understanding the various embodiments of this disclosure.

[0292] The foregoing description provides a complete and informative description of exemplary embodiments of the present disclosure by way of non-limiting examples. However, various modifications and adaptations will be apparent to those skilled in the art when read in conjunction with the accompanying drawings and appended claims, given the foregoing description. Nevertheless, all such and similar modifications to the teachings of this disclosure will still fall within the scope of the invention as defined in the appended claims. Indeed, further embodiments may include combinations of one or more embodiments with any other embodiments previously discussed.

Claims

1. An apparatus comprising components for performing the following: Send a Hypertext Transfer Protocol Connection Request to a first roaming intermediary to establish a Transmission Control Protocol (TCP) connection between the first roaming intermediary and the peer device, wherein the TCP connection is used to establish a Public Land Mobile Network (PLN) signaling connection between the device and the peer device via the first roaming intermediary. as well as Receive a Hypertext Transfer Protocol (HTTP) connection response from the first roaming intermediary, the HTTP connection response including response information indicating whether the Transmission Control Protocol (TCP) connection to the peer device has been established; The Hypertext Transfer Protocol (HTTP) connection request includes information indicating the peer device, and The Hypertext Transfer Protocol (HTTP) connection request includes a header, which includes at least one of the following: Information indicating the device; Information describing the purpose of establishing the Transmission Control Protocol connection; Information describing the signaling connection between the public land mobile networks established by using the Transmission Control Protocol connection; or The information controls the first roaming intermediary to forward or initiate messages to the device or the peer device.

2. The apparatus of claim 1, wherein the information describing the purpose of establishing the Transmission Control Protocol (TCP) connection includes information indicating that the Hypertext Transfer Protocol (HTTP) connection request will be used to establish a public land mobile network (PPPoM) signaling connection between the apparatus and the peer device via the first roaming intermediary.

3. The apparatus according to any of the preceding claims, wherein the information describing the establishment of the signaling connection between the public land mobile networks includes: Information identifying at least one intended purpose for the establishment of the signaling connection between the public land mobile networks.

4. The apparatus according to any of the preceding claims, wherein the information describing the establishment of the inter-public land mobile network signaling connection includes information identifying a security protocol intended to be negotiated via the inter-public land mobile network signaling connection.

5. The apparatus of claim 4, wherein the security protocol to be negotiated for inter-public terrestrial mobile network signaling connection comprises one of the following: PRINS protocol for N32 interconnect security; Security profile for PRINS; as well as Transport Layer Security (TLS) protocol.

6. The apparatus according to any of the preceding claims, wherein the information describing the establishment of the inter-public land mobile network signaling connection includes a correlation identifier configured to correlate communication messages on the inter-public land mobile network signaling connection and communication messages on the inter-public land mobile network message forwarding connection between the apparatus and the peer apparatus.

7. The apparatus according to any of the preceding claims, wherein the Hypertext Transfer Protocol connection response indicates that the Transmission Control Protocol connection to the peer device has been established, and includes information identifying at least one acceptable intended purpose for establishing inter-public terrestrial mobile network signaling communication via the first roaming intermediary.

8. The apparatus according to any of the preceding claims, wherein the Hypertext Transfer Protocol connection response indicates that the Transmission Control Protocol connection to the peer device has been established, and includes information identifying at least one acceptable security protocol for establishing inter-public terrestrial mobile network communication via the first roaming intermediary.

9. The apparatus according to any of the preceding claims, wherein the information indicating whether the Transmission Control Protocol (TCP) connection to the peer device has been established is information indicating that the TCP connection has not been established, and the information further includes a reason why the TCP connection has not been established.

10. The apparatus according to any of the preceding claims, wherein the apparatus is a consumer security edge protection agent in a public terrestrial mobile network, and the peer-to-peer apparatus is a producer security edge protection agent in a peer-to-peer public terrestrial mobile network.

11. The apparatus according to any of the preceding claims, wherein the information indicating the apparatus includes at least one of the following: Information identifying the device; or Information indicating the public land mobile network of the device.

12. The apparatus according to any of the preceding claims, wherein the inter-public land mobile network signaling connection is used by the apparatus and the peer apparatus to determine the security to be applied for forwarding messages between the two public land mobile networks.

13. An apparatus, the apparatus being a roaming intermediary, the apparatus comprising components for performing: The device receives a Hypertext Transfer Protocol (HTTP) connection request to establish a Transmission Control Protocol (TCP) connection to a target Secure Edge Protection Agent (SAP) of a target Public Land Mobile Network (PLAN), wherein the TPP connection is used to establish an inter-PLAN signaling connection between the SAP and the consumer SAP via the device, and wherein the HTTP connection request includes information instructing the producer SAP. The Hypertext Transfer Protocol (HTTP) connection request includes a header, which includes at least one of the following: Information indicating the other device; Information describing the purpose of establishing the Transmission Control Protocol connection; Information describing the signaling connection between the public land mobile networks established by using the Transmission Control Protocol connection; or Information that controls the device to forward or initiate messages to the producer security edge protection agent or the other device; as well as Based on the information, determine whether the Transmission Control Protocol (TCP) connection to the target Secure Edge Protection agent of the target public terrestrial mobile network has been established; and Send at least one of the following: Send a Hypertext Transfer Protocol (HTTP) connection response, including response information indicating whether the Transmission Control Protocol (TCP) connection has been established, to the other device; or Send an additional Hypertext Transfer Protocol Connection Request to another roaming intermediary to establish an additional Transmission Control Protocol connection to the target Secure Edge Protection Agent of the target public terrestrial mobile network, for establishing a public terrestrial mobile network signaling connection between the target Secure Edge Protection Agent and the consumer Secure Edge Protection Agent via the device and also via the additional roaming intermediary.

14. The apparatus of claim 13, wherein the additional Hypertext Transfer Protocol (HTTP) connection request for establishing an additional Transmission Control Protocol (TCP) connection to the target Secure Edge Protection agent of the target public terrestrial mobile network comprises: The information instructing the target security edge protection agent, and wherein the additional Hypertext Transfer Protocol connection request includes a header comprising at least one of the following: Information indicating the other device; Information indicating the device; Information describing the purpose of establishing the Transmission Control Protocol connection; or Information describing the signaling connection between the public land mobile networks established by using the Transmission Control Protocol connection; or The information controls the other roaming intermediary to forward or initiate messages to the target security edge protection agent or the consumer security edge protection agent.

15. The apparatus of any one of claims 13 or 14, wherein the information describing the purpose of establishing the Transmission Control Protocol (TCP) connection includes information identifying that the Hypertext Transfer Protocol (HTTP) connection request will be used to establish a signaling connection between the target Secure Edge Protection Agent and the consumer Secure Edge Protection Agent via the roaming intermediary.

16. The apparatus according to any one of claims 13 to 15, wherein the information describing the establishment of the inter-public land mobile network signaling connection includes information identifying at least one intended purpose for the establishment of the inter-public land mobile network signaling connection.

17. The apparatus of any one of claims 13 to 16, wherein the information describing the establishment of the inter-public land mobile network signaling connection includes information identifying a security protocol intended to be negotiated via the inter-public land mobile network signaling connection.

18. The apparatus of claim 17, wherein the security protocol intended to be negotiated for inter-public terrestrial mobile network signaling connections includes one of the following: PRINS protocol for N32 interconnect security; Security profile for PRINS; as well as Transport Layer Security (TLS) protocol.

19. The apparatus of any one of claims 13 to 18, wherein the information describing the establishment of the inter-public terrestrial mobile network (IPN) signaling connection includes a correlation identifier configured to correlate communication messages on the IPN signaling connection with communication messages on the IPN message forwarding connection between the consumer security edge protection agent and the target security edge protection agent.

20. The apparatus of any one of claims 13 to 19, wherein the Hypertext Transfer Protocol connection response indicates that the Transmission Control Protocol connection to the target Secure Edge Protection agent has been established, and includes information identifying at least one acceptable intended purpose for establishing inter-public terrestrial mobile network signaling communication via the roaming intermediary.

21. The apparatus of any one of claims 13 to 20, wherein the Hypertext Transfer Protocol connection response indicates that the Transmission Control Protocol connection to the target Secure Edge Protection agent is established, and includes information identifying at least one acceptable security protocol for establishing inter-public terrestrial mobile network communication via the roaming intermediary.

22. The apparatus of any one of claims 13 to 21, wherein the information indicating whether the Transmission Control Protocol (TCP) connection to the target Secure Edge Protection Agent has been established is information indicating that the TCP connection has not been established, and the information further includes a reason why the TCP connection has not been established.

23. The apparatus according to any one of claims 13 to 22, wherein the additional apparatus is one of the following: Initiating a secure edge protection agent in a public terrestrial mobile network; and Consumer safety edge protection agent in public terrestrial mobile networks; and The preceding connection link is a roaming intermediary.

24. The apparatus according to any one of claims 13 to 23, wherein the component for performing the function of determining, based on the information, whether a Transmission Control Protocol (TCP) connection to the target Secure Edge Protection Agent of the target Public Land Mobile Network has been established, further determines whether a TCP connection to the target Secure Edge Protection Agent of the target Public Land Mobile Network has been established based on at least one of the following: The contractual roaming agreement between the roaming intermediary and the public terrestrial mobile network of the other device; or The contractual roaming agreement between the roaming intermediary and the target public terrestrial mobile network; or At least one of the intended purposes permitted by the contractual agreement between the roaming intermediary and the public terrestrial mobile network of the other device; or At least one of the intended purposes permitted by the contractual agreement between the roaming intermediary and the target public terrestrial mobile network.

25. A method for implementing the component for execution according to any one of claims 1 to 24.

Images