METHOD, MOBILE RADIO DEVICE, NETWORK ACCESS NODE AND COMPUTER PROGRAM PRODUCT FOR CONFIGURING A RADIO CONNECTION

Description

[0001] The invention relates to a method, a mobile radio terminal, a network access node and a computer program product for configuring a radio connection between a mobile radio terminal and a mobile radio network.

[0002] A subscriber to a mobile network must typically authenticate themselves to the mobile network when accessing the network. A subscriber can be a human user of the mobile terminal. However, a subscriber can also be a device, for example, a device in an Internet of Things. The subscriber is typically subscribed to a selection of services accessible from a mobile terminal via a radio connection to the mobile network. Authentication when accessing the mobile network can, for example, be carried out in a wireless local access network, also known as WLAN, using a pre-shared key (PSK) or a digital certificate, a password, or another extensible authentication protocol (EAP). Such access authentication can also be set up and operated by small or large companies that do not specialize in operating a mobile network.

[0003] In cellular mobile networks based on a Third Generation Partnership Project (3GPP) standard of the second generation (Global System for Mobile Communication, GSM), the third generation (Universal Mobile Telecommunication System, UMTS), the fourth generation (Long Term Evolution, LTE), and the current fifth generation (5G), access authentication is performed as subscriber authentication using a subscriber identification module (SIM), Universal Subscriber Identification Module (USIM), or an IP Multimedia Service Identification Module (ISIM). The actual authentication is performed using a symmetric key. The subscriber identification module is generally a chip card-based security module.It performs cryptographic operations for authentication and provides the mobile terminal with one or more session keys to cryptographically protect user communication, particularly on the radio connection.

[0004] Such a subscriber identification module, used in cellular mobile networks, is used for additional functions. For example, it contains configuration data for preferred networks. The subscriber identification module is issued, provisioned, and managed by a mobile operator during operation. However, the technology for this is extremely complex, so in practice it can only be used by network operators specializing in mobile communications.

[0005] US 2007 / 0054668 A1 discloses a private base station that is connectable to the internet and provides wireless internet access within a small area. Access by a mobile device to services within the cell is controlled by an exclusivity database.

[0006] The document EP 2 453 633 A1 discloses a method in which a subscriber identification device comprises a first subscription data record for subscriber authentication in a first mobile radio network and a second subscription data record for subscriber authentication in a second mobile radio network, and in each case one of the contained subscription data records is used for subscriber authentication depending on an available mobile radio network.

[0007] The publication US 2013 / 0007853 A1 describes a method in which a mobile device can determine, without user interaction, whether subscription information stored in the mobile device is applicable to an available network. If so, the mobile device performs authentication with the network using credentials contained in the stored subscription information.

[0008] Particularly in the context of 5G mobile networks, in addition to a spatially extensive, publicly accessible mobile network, application scenarios are being discussed in which 5G mobile technology is to be used similarly to a Wi-Fi network. This is also referred to as a private 5G application or a 5G campus network. This allows, for example, a local mobile network based on 5G technology to be operated in a regionally or geographically limited area, such as a factory hall, an industrial park, a city network, or similar. Such 5G campus networks or local 5G applications are referred to below as private mobile networks.

[0009] However, one obstacle to the practical, simple use of such private 5G applications is the high cost associated with creating, provisioning, and managing the subscriber identification module for secure network access. Furthermore, it must be ensured that mobile terminals or mobile modems, which provide the radio connection and access to a mobile network, particularly for data networks, can be adjusted to the radio parameters of the desired private 5G application network and, in particular, can be restricted. In doing so, it should be ensured that the public cellular mobile network is not disrupted, particularly with regard to radio connections.

[0010] It is therefore the object of the present invention to enable a mobile radio terminal to have easy-to-manage, secure network access to a subnetwork of the mobile radio network without disrupting the radio connections in another subnetwork of the mobile radio network, in particular a generally accessible part of the mobile radio network.

[0011] This object is achieved by the measures described in the independent claims. Advantageous further developments of the invention are presented in the subclaims.

[0012] According to a first aspect, the invention relates to a method for configuring a mobile radio connection between a mobile radio terminal and a mobile radio network, wherein the mobile radio network contains at least a first subnetwork that is accessible with an authorization credential of at least a first type, and at least a second subnetwork that is accessible with an authorization credential of at least a second type, and a first radio connection to the first subnetwork and a second radio connection to the second subnetwork have different radio transmission parameters, wherein upon an access request from a mobile radio terminal to the first or second subnetwork, the authorization credential predetermined for the access request to the first or second subnetwork is determined, the type of authorization credential used is determined,and at least one radio transmission parameter is selected and activated depending on the determined type of predetermined credential.

[0013] This makes it possible for a mobile terminal device with a first type of credential, for example a subscriber identification module embodied as a SIM card with USIM or ISIM functionality, to activate and use all radio access variants technically supported in a first subnetwork. If, however, a second type of credential is determined, only the radio transmission parameters determined by this second type of credential are selected. This means that while the mobile terminal device can be designed to be variable and adjustable with regard to the supported radio transmission parameters, inappropriate or incorrect setting of the radio transmission parameters can be avoided, particularly when using private subnetworks. It is not necessary for a subscriber to configure the radio technologies of the mobile terminal device that are to be supported themselves.

[0014] Furthermore, the first credential is designed only for use in a first authentication protocol and the second credential is designed only for use in a second authentication protocol.

[0015] For example, the first type of credential is used in an authentication protocol standardized by a 4G or 5G, while the second type of credential is used, for example, in an extended application protocol with a transport layer security protocol (EAP-TLS), which is particularly used for authentication in a wireless local area network (WLAN). The first type of credential is provided, for example, by a SIM card, which is either designed as a component that can be removed from the mobile device or integrated into the mobile device. This has the advantage that the credentials used and the associated different authentication protocols can be used to identify and distinguish between the radio transmission parameters and thus the physical access to different subnetworks.

[0016] In an advantageous embodiment, the first radio connection and the second radio connection are provided with the same transmission method.

[0017] In a 5G mobile network, for example, first radio connections and second radio connections are provided using the same radio transmission method, although the first and second radio connections differ in their radio parameters, such as the frequency bands used, the permissible transmission power, the bandwidth per transmission channel, or the modulation method or parameters of a modulation method. An example of such a radio transmission method is 5G New Radio (5G NR), which is described in the 3GPP TS38.300 standard. This allows, in particular, a mobile terminal or a subscriber to access different subnetworks with a single mobile terminal, while the radio transmission parameters for the same radio transmission method are automatically determined and set accordingly by the different authorization credentials.

[0018] In an advantageous embodiment, the mobile radio network is a cellular mobile radio network, in particular a 5G network according to a standard of a third generation partnership project 3GPP and the first subnetwork is a public mobile radio network and the second subnetwork is a non-public mobile radio network.

[0019] A public mobile network is generally accessible to a subscriber who has subscribed to an operator for access to the mobile network. Such a public mobile network is typically accessible over a geographically extensive area. In contrast, a non-public mobile network is typically accessible over a geographically very restricted area. The first and second subnetworks differ in that radio connections to the first and second subnetworks, respectively, have at least one different radio transmission parameter. Thus, in particular, a generally accessible, public first subnetwork can be differentiated from a only locally accessible, non-public second subnetwork, for example a 5G campus network or 5G industrial network, also with regard to access authorization verification, and the corresponding radio transmission parameters can be automatically determined from this.

[0020] In an advantageous embodiment, the access request is executed upon startup and / or during ongoing operation of a mobile terminal or a network access node or a machine connected to the mobile terminal and / or upon authentication of the mobile terminal to a subnetwork. The machine can be, for example, a machine tool, a milling machine, a 3D printer for additive manufacturing, a robot, or an automated guided vehicle system.

[0021] This has the advantage that a specific subnetwork for access is determined at startup, i.e., when a mobile device is switched on or activated, and the corresponding radio transmission parameters are automatically selected and activated on the mobile device or at the network access node using the determined credentials. In particular, when the mobile device is started, it can be checked whether the radio transmission parameters activated before shutdown are still permitted with the credentials present in the mobile device upon restart. As soon as a specific credential is determined when a service is requested, the radio transmission parameters are set depending on the determined type of credential.Furthermore, it is possible to additionally determine and evaluate the type of authorization credential used by the network in order to select and activate at least one radio transmission parameter depending on this.

[0022] An access request is executed during operation, for example, at periodically recurring times or triggered by specific events, and the radio transmission parameters are checked. However, the access request can also be triggered by a network access node at startup or during operation. In particular, the access request is executed during authentication of the mobile device to a subnetwork. Accordingly, network access authentication uses the credential for subscriber authentication and, for example, an additional key agreement.

[0023] In an advantageous embodiment, the second type of authorization credential is a digital certificate and is used to authenticate the mobile terminal when accessing the mobile network.

[0024] A digital certificate, for example, according to an X.509 standard of the International Telecommunication Union (ITU-T), is often used in a WLAN to authenticate communication partners. A particular advantage here is that the allocation and management of digital certificates is automated, simple, and carried out using familiar, reusable procedures. This allows a private operator of a second subnetwork of the second type to easily and minimally implement the provision of Type 2 credentials themselves. The access authorization procedure, which involves greater administrative effort and involves a subscriber identification module (SIM, USIM, ISIM, 5G SIM) or a 3GPP AKA protocol (AKA: Authentication and Key Agreement) using the subscriber identification module, is thus no longer necessary.

[0025] The digital certificate can be used, in particular, for subscriber or mobile device authentication and, preferably, also for negotiating a session key in an EAP-TLS protocol. However, a digital certificate can also be used for authentication protocols such as an IP security protocol such as IPsec / IKEv2 or a transport layer security protocol such as TLS or DTLS.

[0026] In an advantageous embodiment, the second type of authorization credential contains restrictive information on prohibited radio transmission parameters and corresponding radio transmission parameters are not activated.

[0027] This has the advantage of defining permitted ranges based on the boundary points of the prohibited radio transmission parameter ranges, within which the radio transmission parameters can be selected and used by the device. This allows for freedom of choice of radio transmission parameters outside of the restrictive information provided in the second-type credential.

[0028] In an advantageous embodiment, the authorization credential of the second type contains positive information on permitted radio transmission parameters and only permitted radio transmission parameters are activated.

[0029] This allows for precise specification of the permitted radio transmission parameters and reduces the need to adjust the radio transmission parameters in the event of changes within the non-permitted ranges of radio transmission parameters.

[0030] In an advantageous embodiment, the second type of authorization credential contains additional information on a geographical area of ​​application and / or a temporal area of ​​application of the radio transmission parameters.

[0031] Access to a second subnetwork can thus also be restricted to a geographical area and / or time periods to which the restrictive or positive information refers. Additionally, a network name or an identifier of network access nodes for which network access is permitted or prohibited can also be included.

[0032] In an advantageous embodiment, predetermined information comprising a predetermined set of radio transmission parameters is associated with the type 2 credential, and the predetermined set of radio transmission parameters is activated if the type 2 credential does not contain any information on the radio transmission parameters.

[0033] This has the advantage that, even if the Type 2 credential does not explicitly contain information about the radio transmission parameters, information about possible radio transmission parameters for access to the selected subnetwork is still available. This prevents radio transmission parameters from public subnetworks of the mobile network from being used when accessing a second subnetwork, thus preventing the mobile device from interfering with the public subnetwork.

[0034] In an advantageous embodiment, a network access server determines the radio transmission parameters from the type 2 credential during network access authentication of the mobile radio terminal, wherein network access is only granted if the radio transmission parameters of the radio connection from the mobile radio terminal to a network access node correspond to the determined radio transmission parameters of the type 2 credential.

[0035] This has the advantage that no additional message needs to be sent to the network access server to transmit the information on the radio transmission parameters, since the credential for network access authentication is sent to the network access server and evaluated there.

[0036] In an advantageous embodiment, the network access node determines the radio transmission parameters of the radio connection to the mobile radio terminal and provides the determined radio transmission parameters to the network access server or the network access node for comparison with the radio transmission parameters from the type 2 credential.

[0037] This has the advantage that the radio connection from the mobile terminal to the network access node is determined with regard to its radio transmission parameters and thus a check of the currently available radio transmission parameters matches the radio transmission parameters present in the type 2 credential or assigned to it.

[0038] Radio transmission parameters include, for example, information about the radio technology, such as LTE, 5G-NR (3GPP 5G New Radio), WLAN, or even according to a WiMAX standard. Radio transmission parameters can also include a frequency range or frequency band, a modulation method, a maximum transmission power, a specification of the ratio of transmission times to non-transmission times, also known as the duty cycle, or antenna parameters. Antenna parameters include, for example, information about the shape of a transmission beam, so-called beam forming, or the antenna configuration, for example of multi-antenna systems, particularly multiple-in and multiple-out antenna systems (MIMO), where beam forming to the base station must be used to avoid interference with other users.

[0039] A second aspect of the invention relates to a mobile radio terminal for configuring a radio connection to a mobile radio network, comprising at least one processor which is designed to determine a predetermined authorization credential for the access request to the first or second subnetwork when the mobile radio terminal requests access to a first or second subnetwork of the mobile radio network, characterized in that a type of the predetermined authorization credential is determined and at least one radio transmission parameter is selected and activated depending on the determined type of authorization credential used, wherein the first authorization credential is designed only for use in a first authentication protocol and the second authorization credential is designed only for use in a second authentication protocol, wherein the first and the second authentication protocol are different authentication protocols.

[0040] This has the advantage that a mobile terminal supports a wide range of radio transmission parameters and thus radio technologies. However, depending on the subnetwork to which access is requested using a credential, the radio connection is established using the radio transmission parameters associated with the credential, particularly Type 2 credentials. The mobile terminal can thus be used for subnetworks with different radio transmission parameters, and the radio transmission parameters used are automatically adapted to the subnetwork to which access is requested. For example, only frequency bands approved for second subnetworks are used to access a second subnetwork.

[0041] A third aspect relates to a network access node which terminates a radio connection from a mobile radio terminal, for configuring a radio connection between a mobile radio terminal and a mobile radio network, comprising at least one processor which is designed to, upon receipt of an access request from the mobile radio terminal to a first or second subnetwork of the mobile radio network to determine a predetermined authorization credential for the access request to the first or second subnetwork (20, 22), characterized in that a type of the predetermined authorization credential is determined, and at least one radio transmission parameter is selected and activated depending on the determined type of authorization credential used, wherein the first authorization credential (11) is designed only for use in a first authentication protocol and the second authorization credential (12) is designed only for use in a second authentication protocol, wherein the first and the second authentication protocol are different authentication protocols.

[0042] A network access node can physically terminate a radio connection and, accordingly, be, for example, a NodeB of a 3G, 4G, or 5G mobile network or an access point of a WLAN network. A network access node can also terminate the radio connection with regard to the signaling protocol used. Accordingly, a network access node is a radio network controller, also known as a radio network controller (RNC), of a 3G or 4G mobile network or an access management function of a 5G mobile network. The same applies to network nodes, for example, of a WLAN or WiMAX network. The network access node can thus determine and activate the permitted radio parameters for the radio connection in the same way as the mobile terminal.

[0043] A fourth aspect of the invention relates to a computer program product comprising a computer-readable medium that can be loaded directly into a memory of a digital computer, comprising program code parts that are suitable for carrying out the steps of the aforementioned method.

[0044] A mobile radio terminal can, for example, be embodied as a mobile radio modem that establishes and provides a radio connection to the mobile radio network. The mobile radio modem can, for example, be connected to other machines that do not have their own radio transmission component and provide communication between the other devices and the mobile radio network. Other machines can, for example, be a machine tool, a milling machine, a 3D printer, a robot, an autonomous vehicle, or a driverless transport system. However, a mobile radio terminal can also be connected to a subscriber in the form of a human being who uses the mobile radio terminal to communicate with the mobile radio network.

[0045] In the context of the invention, a processor can be understood as one or more individual processors. A processor can be, in particular, a main processor, a microprocessor or microcontroller, or a digital signal processor.

[0046] A computer program product, such as a computer program means, may be provided or delivered, for example, as a storage medium, such as a memory card, or in the form of a downloadable file from a server in a network.

[0047] The embodiments and features described for the proposed method apply accordingly to the proposed mobile radio terminal and the network access node.

[0048] Embodiments of the method according to the invention, a mobile radio terminal according to the invention, and a network access node are illustrated by way of example in the drawings and are explained in more detail in the following description. They show: Fig. 1 shows a mobile radio network with an embodiment of a mobile radio terminal according to the invention in a schematic representation; Fig. 2 shows a first embodiment of the method according to the invention as a flow diagram; Fig. 3 shows a second embodiment of the method according to the invention as a message flow diagram; Fig. 4 shows a third embodiment of the method according to the invention as a message flow diagram; Fig. 5 shows an embodiment of a mobile radio terminal according to the invention in a block diagram; and Fig. 6 shows an embodiment of a network access node according to the invention in a block diagram.

[0049] Fig. 1shows a mobile radio network 30, which is constructed and operated as a cellular mobile radio network, for example, according to a 5G mobile radio standard of the third generation partnership project 3GPP. Such a mobile radio network 30 comprises at least a first subnetwork 20, which is preferably accessible in an extensive geographical area for a mobile radio terminal 10 via a first radio connection 13 to an access node 21. The mobile radio network 30 further comprises at least a second subnetwork 22, which is preferably accessible in a geographically narrower area, for example a factory hall or an industrial park, for the mobile radio terminal 10 via a second radio connection 14 to an access node 22.

[0050] The first radio connection 13 and the second radio connection 14 have different radio transmission parameters, for example, different frequency ranges, different channel widths, different permissible transmission powers, different permissible duty cycles, and / or different modulation methods are used. In the first subnetwork 20, for example, radio technologies according to LTE or earlier 2G or 3G mobile communications standards are provided. In the second subnetwork, typical radio technologies according to the fourth-generation mobile communications standard LTE, radio technologies according to the WLAN or WiMAX standard, and new radio technologies according to a 5G standard, for example, 5G New Radio, are available.

[0051] The mobile radio terminal 10 can, in particular, be a mobile radio modem that configures the radio interface and provides the radio connection 13, 14, for example, for one or more devices connected to the mobile radio terminal. A user of the mobile radio terminal 10, who is preferably also a subscriber to the mobile radio network 30, can, for example, be a device or a human person. The mobile radio terminal 10 or its user each uses a first-type credential 11 to authenticate itself to the first subnetwork 20 upon an access request. The first-type credential is typically provided by a subscriber identification module, also referred to as a SIM card or UICC (Universal Integrated Circuit Card), and preferably comprises a secret and at least one cryptographic function for authenticating the mobile radio terminal upon access to the first subnetwork 20 of the mobile radio network 30.For access to the second subnetwork 22, however, a type 2 credential 12 is used. The type 2 credential 12 differs from the type 1 credential 11 and is, for example, a digital certificate used to authenticate the mobile terminal 30 when accessing the second subnetwork 22 of the mobile network 30. The access authorization is verified by an access server 31, which, for example, monitors network access for one or more first and / or second subnetworks.

[0052] Figure 2The method according to the invention is now shown, which is carried out in the mobile radio terminal 10 or in the network access node. This starts from a START state in which an access request from the mobile radio terminal 10 to a selected subnetwork is present. The access request can be generated and present repeatedly, for example, when the mobile radio device is switched on or activated, or even during ongoing operation. The access request can be generated or present, in particular, during network access authentication of the mobile radio device.

[0053] In the first process step S1, the predefined authorization credential for the selected subnetwork is determined. The subnetwork can be selected directly, for example. However, the subnetwork can also be selected, for example, by a requested service and an assignment of a subnetwork for providing the service.

[0054] In process step S2, the credential is analyzed and categorized as a type 1 or type 2 credential, thus determining the type of the predetermined credential. Several different type 1 or type 2 credentials can be known. Depending on the determined type (see S3), the radio transmission parameters associated with the credential are determined and activated in the mobile radio terminal (see process step S4 or S4').

[0055] If a type 1 credential is determined in method step S3, the radio transmission parameters for the first subnetwork of the mobile network are activated accordingly in step S4. If a type 2 credential is determined, the predetermined set of radio transmission parameters associated with the type 2 credential is selected and activated from the type 2 credential, for example, in method step S4. The method then transitions to a final state in which the radio connection is established according to the radio transmission parameters.

[0056] A Type 2 credential is designed, in particular, as a digital certificate, for example, according to the X.509 standard. The digital certificate as a Type 2 credential can explicitly contain a radio transmission parameter. The radio transmission parameter can, for example, comprise a specific radio transmission parameter set that is activated for a radio connection to the second network. In the Type 2 credential, the radio transmission parameter can be present as restrictive information that specifies the radio technologies and radio parameters with which this certificate may be used for mobile network access. Restrictive information is provided, for example, by the boundary values ​​of a permitted frequency band. However, the radio transmission parameter can also be positive information that defines permissible radio transmission parameters.

[0057] It is also possible that, if radio transmission parameters are not explicitly defined, a predetermined set of transmission parameters is assigned to the credential. This predetermined set of radio transmission parameters is then applied. Furthermore, a geographical area and / or time periods to which these radio transmission parameters refer can be specified. Additionally, a network name, for example, corresponding to a Service Set Identifier (SSID) in a WLAN, or an identifier of base stations, for example, an access point, can also be included.

[0058] In the application area of ​​second subnetworks of a 5G mobile network, for example, it cannot be assumed that a user has the necessary technical knowledge to correctly configure and set the radio transmission parameters. The described procedure eliminates the need for a user to configure the radio technologies or radio transmission parameters to be supported on the mobile terminal device. This allows the mobile terminal device to adapt the information about its technical capabilities depending on the activated radio transmission parameters. This means that the mobile terminal device does not provide fixed, static information about its own technical radio transmission options that are fundamentally supported from an implementation perspective, but only about the actual radio transmission parameters that depend on the authentication.

[0059] When the mobile terminal requests access to a selected subnetwork with a Type 2 credential, network access authentication is performed using an authentication protocol. Figure 3 a first variant is shown in the form of a message flow diagram between a mobile radio terminal 100, a network access node 101 of a second subnetwork and a network access server 103 of a mobile radio network.

[0060] The mobile terminal 100 or a user of the mobile terminal 100 generates an access request to the second subnetwork. The mobile terminal 100 then determines an associated Type 2 credential, for example, a digital certificate (see 110). The mobile terminal 100 configures its radio transmission module depending on the radio transmission parameters RP contained in the selected Type 2 credential (see 111). Furthermore, the mobile terminal 100 provides the network access node 101 with corresponding information about the radio transmission parameters RP of the mobile terminal 100.

[0061] The mobile radio terminal 100 performs a network access authentication AUTH, for example using the EAP-TLS authentication and key agreement protocol, and sends the determined type 2 authorization credential, in particular a digital certificate, via the network access node 101 to the network access server 102.

[0062] In the network access server 102, authentication of the mobile terminal or its user is performed based on the Type 2 credential, for example, according to an EAP-TLS protocol. In doing so, the network access server 102 additionally determines the radio transmission parameters RC of the Type 2 credential or digital certificate used (see 112). Upon successful authentication ACK, the network access server 102 sends an authentication confirmation ACK and the radio transmission parameters RC to the network access node 101.

[0063] The network access node 101 checks whether the radio transmission parameters RF sent by the mobile terminal 100 match the radio transmission parameters RC received from the network access server 102, see 113. If the check result is positive, the network access node 101 sends an authentication confirmation ACK to the mobile terminal 100. If the check result is negative, ie the radio transmission parameters RF do not match the radio transmission parameters RC, the access request is rejected and the radio connection DATA is not established.

[0064] In a second variant, the radio transmission parameters RC are provided to the access network, in particular the network access node 101, by the network access server 102 during the EAP-based authentication.

[0065] In a third variant, the access network itself, in particular the network access node 101, extracts the radio transmission parameters RC from the Type 2 credential by evaluating an authentication message transmitted during the network access authentication AUTH between the mobile terminal 100 and the network access server 102, for example, through a so-called deep packet inspection. This variant has the advantage that the radio access network can check the radio transmission parameters independently of a network access server.

[0066] In Figure 4A variant is shown in which the radio access node 101 determines the radio transmission parameters SRC used by the mobile terminal 100 for a second radio connection and provides them to the network access server 102. The network access server 102 determines the radio transmission parameters from the type 2 credential at 112 and checks at 114 whether the radio transmission configuration SRP used by the mobile terminal 100 is permissible according to the radio transmission parameters RC contained in the type 2 credential used. If the check result is positive, a successful authentication ACK is transmitted to the mobile terminal.

[0067] Figure 5shows a mobile radio terminal 100 comprising a storage unit 51, in which, for example, type 1 authorization information and type 2 authorization credentials are stored. The mobile radio terminal 100 further comprises a radio control unit 52, which, upon an access request to the selected subnetwork, determines the predetermined authorization credential and the associated radio transmission parameters. The mobile radio terminal 100 further comprises a radio connection unit 53, which configures a first or second radio connection according to the determined radio transmission parameters and provides it via an antenna 54.

[0068] Figure 6shows a network access node 101 with an evaluation unit 61, in which the radio transmission parameters configured by the mobile terminal 100 are determined and / or evaluated according to the variants described above, or the radio transmission parameters provided by the network access server 102 and determined from the authorization credential are checked against the radio transmission parameters configured by the mobile terminal 100. Based on the check result or feedback from a network access server 102, the radio transmission parameters are configured and activated in a radio connection unit 63, and a connection is established via the antenna 64 according to the radio transmission parameters. The network access node 101 further comprises a radio control unit 62, which, upon an access request to the selected subnetwork, determines and activates the predetermined authorization credential and the associated radio transmission parameters.

[0069] All described and / or illustrated features can be advantageously combined within the scope of the invention. The invention is not limited to the described embodiments.

Claims

1. Method for configuring a radio connection (13) between a mobile radio terminal (10) and a mobile radio network (30), wherein the mobile radio network (30) contains at least one first subnetwork (20), which is accessible with a credential of at least one first type (11), and at least one second subnetwork (11), which is accessible with a credential of at least one second type (12), wherein a first radio connection (13) to the first subnetwork (20) and a second radio connection (14) to the second subnetwork (22) have different radio transmission parameters, wherein an access request from the mobile radio terminal (10) to the first or second subnetwork results in - the credential predetermined for the access request for the first or second subnetwork being ascertained (S1), wherein - the type of the predetermined credential is ascertained (S2), and - at least one radio transmission parameter is selected and activated (S4, S4') on the basis of the ascertained type of the predetermined credential, wherein the first credential (11) is designed only for use in a first authentication protocol and the second credential (12) is designed only for use in a second authentication protocol, the first and the second authentication protocol being different authentication protocols.

2. Method according to the preceding claim, wherein the first radio connection (13) and the second radio connection (14) are provided using an identical radio transmission method.

3. Method according to either of the preceding claims, wherein the mobile radio network (30) is a cellular mobile radio network, in particular a 5G network based on a standard of a third-generation partnership project 3GPP, and the first subnetwork (20) is a public mobile radio network and the second subnetwork (22) is a non-public mobile radio network.

4. Method according to one of the preceding claims, wherein the access request is made when a mobile radio terminal (10) or a network access node (21, 23) or a machine connected to the mobile radio terminal is started and / or is in operation and / or when the mobile radio terminal (10) is authenticated in the subnetwork (20, 22).

5. Method according to one of the preceding claims, wherein the credential of the second type (12) is a digital certificate and is used to authenticate the mobile radio terminal (10) for access to the mobile radio network (30).

6. Method according to one of the preceding claims, wherein the credential of the second type (12) contains restrictive information about prohibited radio transmission parameters, and applicable radio transmission parameters are not activated.

7. Method according to one of Claims 1 to 5, wherein the credential of the second type (12) contains positive information about permitted radio transmission parameters, and only permitted radio transmission parameters are activated.

8. Method according to one of Claims 5 to 7, wherein the credential of the second type (12) contains additional information about a geographical scope of application and / or a temporal scope of application of the radio transmission parameters.

9. Method according to one of Claims 1 to 5, wherein predetermined information comprising a predetermined set of radio transmission parameters is associated with the type-2 credential (12) and the predetermined set of radio transmission parameters is activated if the type-2 credential (12) contains no information about the radio transmission parameters.

10. Method according to one of the preceding claims, wherein a network access server (31) ascertains the radio transmission parameters from the type-2 credential (11, 12) during a network access authentication of the mobile radio terminal (10), and wherein network access is granted only if the radio transmission parameters of the radio connection (13) from the mobile radio terminal (10) to a network access node (21) tally with the ascertained radio transmission parameters of the type-2 credential (11, 12).

11. Method according to Claim 10, wherein the network access node (21) ascertains the radio transmission parameters of the radio connection (13) to the mobile radio terminal (10) and provides the ascertained radio transmission parameters to the network access server (31) or to the network access node (21) for comparison with the radio transmission parameters from the type-2 credential.

12. Mobile radio terminal (10) for configuring a radio connection (13, 14) to a mobile radio network (30), comprising at least one processor that is designed so as, in the event of an access request from the mobile radio terminal (10) to a first or second subnetwork (20, 22) of the mobile radio network (30), - to ascertain a credential predetermined for the access request for the first or second subnetwork (20, 22), wherein - a type (11, 12) of the predetermined credential is ascertained, and - at least one radio transmission parameter is selected and activated on the basis of the ascertained type of the credential used, wherein the first credential (11) is designed only for use in a first authentication protocol and the second credential (12) is designed only for use in a second authentication protocol, the first and the second authentication protocol being different authentication protocols.

13. Network access node (21, 23), which terminates a radio connection (13, 14) from a mobile radio terminal (10) at the network end, for configuring a radio connection (13, 14) between a mobile radio terminal (10) and a mobile radio network (30), comprising at least one processor that is designed so as, on receiving an access request from the mobile radio terminal (10) to a first or second subnetwork (20, 22) of the mobile radio network (30), - to ascertain a credential predetermined for the access request for the first or second subnetwork (20, 22), wherein - a type (11, 12) of the predetermined credential is ascertained, and - at least one radio transmission parameter is selected and activated on the basis of the ascertained type of the credential used, wherein the first credential (11) is designed only for use in a first authentication protocol and the second credential (12) is designed only for use in a second authentication protocol, the first and the second authentication protocol being different authentication protocols.

14. Computer program product comprising a computer-readable medium that is able to be loaded directly into a memory of a digital computer, comprising program code parts that are suitable for performing the steps of the method according to one of Claims 1 to 11.