Wireless Communications System for First Responder Networks

Abstract

A first responder network is a network used by first responders to communicate among devices typically used by first response officers. MCI refers to an incident in which emergency medical services are overwhelmed by the number and severity of injuries. To ensure faster response times within MCI areas, a wireless communication system for the first responder network is proposed that can securely register various wireless devices. Existing wireless devices belonging to both triage officers and victims within the MCI area can automatically register with the first responder network to enhance coverage within the MCI area. Expansion of the wireless infrastructure of the first responder network can be enabled by securely registering heterogeneous central nodes (e.g., base stations) on demand.

Description

[Technical field]

[0001] The present invention relates to establishing a first responder network in a wireless network environment, such as, but not limited to, a cellular network with an indirect network connection for a remote communication device. [Background technology]

[0002] Natural disasters such as earthquakes, hurricanes, tsunamis, landslides, forest fires, and tropical storms can cause a lot of damage and loss to human lives. Other non-natural disasters such as building fires, some forest fires, building collapses, and terrorist attacks can cause damage and loss to livelihoods as well. In some cases, the amount of damage and / or loss to livelihoods resulting from disasters can be reduced through improved response systems.

[0003] A mass casualty incident (MCI) describes an incident in which emergency medical services may be overwhelmed by the number and severity of injuries. Triage is the process applied when there are more injured people in need of assistance than there are medical personnel available. Examples of these situations are mass transportation accidents and terrorist attacks.

[0004] Currently, the tools used by care providers during MCI events are relatively low-tech, i.e., paper-based systems. Digital technologies have been proposed to improve triage speed, provide a better overview of the MCI event situation, and transform the current static paper-based information into dynamic digital information. By doing so, planning of clinical and non-clinical actions during MCI events can be improved, and real-time patient monitoring can be deployed by incorporating vital signs sensors.

[0005] Nevertheless, the use of digital technologies requires communication coverage to exchange data between wireless communication devices present locally at the site, either in a peer-to-peer manner (e.g. mesh networks) or in a server-client manner (e.g. via serving Wi-Fi access points). Summary of the Invention [Problem to be solved by the invention]

[0006] One problem that often occurs during MCI events is the overloading of regular telecommunications networks. To avoid emergency medical services being unable to communicate anymore, countries have set up dedicated communication networks for this purpose, such as the US First Responder Network Authority's FirstNet and the Netherlands' C2000. Unfortunately, even these networks are often reported to not work reliably.

[0007] Another problem is that during a criminally caused MCI event (e.g., a terrorist attack), the criminals can intentionally overload and disrupt publicly available telecommunications networks, or a natural MCI event (e.g., a tsunami) can disrupt the public infrastructure of regular telecommunications networks, for example by damaging base stations and backhaul links of cellular communication networks.

[0008] It is an object of the present invention to enable improved service delivery in MCI areas. [Means for solving the problem]

[0009] This object is achieved by an apparatus according to claim 1, by an access device according to claim 8, by a wireless communication system according to claim 9, by a method according to claim 17 and by a computer program according to claim 18.

[0010] According to a first aspect relating to an access device end of a communications link, there is provided an apparatus for supporting establishment of a wireless communications network (e.g., for use by a first responder), the apparatus comprising: - connecting with a network controller device of a wireless network and making wireless connections to wireless communication devices in a target geographic area; - receiving information about a target geographic area; - receiving from the network controller device information about a network configuration for setting up a communication channel with the wireless communication device; - inviting wireless communication devices located within the target geographic area to register via a communication channel to a core network operated by the network controller device or other communication channel; The present invention is configured to:

[0011] The first aspect concerns an access device (such as a drone), where information about the target geographic area / space (e.g., a two-dimensional (2D) area or three-dimensional (3D) volume (indicated by a set of 2D / 3D coordinates) with a group of casualties, or the best landmark location to park the access device within the MCI area) may be received directly from the network controller device or via another access device and / or a separate positioning server. The network controller device may also provide or calculate this information for the access device using a third party positioning application programming interface (API), e.g., through the network exposure function (NEF) of the network controller device. In one example, an access device that has not yet received information about the target geographic area may receive this information directly from the third party API / NEF via other (e.g., non-3GPP) communication methods (e.g., Wi-Fi) upon request of the network controller device. This is advantageous in that an access device that is far away and has lost connection to a network controller device can still be rediscovered within the target geographic area.

[0012] Thus, information about the target geographic region of the MCI area is received directly from the network controller device or via other wireless communication devices, access devices, or a separate positioning server. Details necessary to calculate information about the target geographic region for the access devices (SLAM sensor data, signal quality information, etc.) are transmitted from the access devices and wireless communication devices in the MCI area to the network controller device.

[0013] The information about the network configuration for setting up a communication channel with the wireless communication device includes, and / or can be used to configure and / or authorize the access device to invite the wireless communication device to a specific slice / frequency of the network in the MCI area. The network configuration information includes, for example, the access device's invitation authority to connect the wireless communication device or additional access devices in the area to the core network, network / slice specific settings (e.g., frequencies, allowed devices, services provided, Restricted Local Operator Services (RLOS), roaming steering, emergency / non-emergency slice indication, etc.), and the credentials (e.g., private keys) required to authorize the wireless communication device of the first responder.

[0014] The pre-authorized wireless communication device responds to the invitation by establishing a secure channel using a certificate (e.g., public key) pre-stored in the wireless communication device to connect to the wireless communication network and / or a unique network slice via the access device. In one example, wireless communication devices that can prove their authenticity are allowed to connect with a "first responder" slice. Devices that do not prove their authenticity are steered to connect with a "non-first responder" slice.

[0015] According to a second aspect relating to an access device end of a communications link, there is provided a method of supporting establishment of a wireless communications network (for a first responder), the method comprising: - connecting with a network controller device of a wireless communications network and making wireless connections to wireless communications devices in a target geographic area; - receiving information about a target geographic area; - receiving from the network controller device information about a network configuration for setting up a communication channel with the wireless communication device; - inviting wireless communication devices located within the target geographic area to register via a communication channel to a core network operated by the network controller device or other communication channel; has.

[0016] According to a third aspect, there is provided an access device for making a wireless connection to a wireless communication device in a wireless communication network (for a first responder), the access device comprising an apparatus of the first aspect.

[0017] According to a fourth aspect, there is provided a wireless communication system comprising a network controller device, one or more wireless communication devices, and an access device of the third aspect connected with the network controller device.

[0018] Finally, according to a fifth aspect there is provided a computer program product comprising code means for producing the steps of the above method of the third or fourth aspect when the computer program product is executed on a computing device.

[0019] Thus, for example, a wireless communication system can be provided for a first responder network or other public and non-public wireless (emergency) network that can securely register various wireless devices to ensure faster response times within an MCI or other emergency area. In case of an MCI event, existing wireless devices belonging to both triage officers and casualties within the MCI area can be automatically registered with the first responder network to enhance coverage within the MCI area. Moreover, the wireless communication network is enabled to grant the access device the authority to send an invitation to the wireless communication device to connect with the wireless communication network.

[0020] According to a first option combined with any of the first to fifth aspects above, a detected wireless communication device that is a predetermined wireless communication device of the first responder is prevented from connecting with another wireless network (e.g., a public network of a different operator) during the MCI or other emergency event (e.g., by receiving a corresponding preferred access list or roaming steering information or temporarily disabling roaming steering based on an instruction), and / or a detected wireless communication device that is not a predetermined wireless communication device of the first responder is prevented from registering with the wireless first responder network (e.g., by receiving a corresponding access control or allow / deny slice information). Thereby, the number of wireless communication devices that are allowed to communicate (e.g., within the MCI or other emergency area) and their communication range can be controlled to ensure sufficient service capacity. As a further option, only a limited set of services (e.g., only voice services and / or limited data services) can be allowed as part of the default slice, so that bystanders cannot flood the network with video streaming of the event.

[0021] Furthermore, a wireless communication device that is normally permitted to connect to another wireless network (e.g., a public network of a different operator) can be controlled to connect to a first responder network by temporarily updating the roaming steering information, e.g., by removing the preferred non-public network or giving a higher priority to the wireless first responder network, or similarly, by updating the priority list of preferred non-public networks. For this purpose, the roaming steering or priority list of non-public network information is attached or signed with a security certificate indicating the emergency or MCI event. As a further option, the policy for connecting to the network (e.g., minimum signal strength for connecting) is updated. Upon leaving the MCI area, the old roaming steering / non-public network priority list is restored. This can be done by temporarily backing up the old roaming steering / non-public network priority list, or by only giving a temporary higher priority to the wireless first responder network, e.g., based on an expiration timer, such that the higher priority network is removed when the expiration timer expires.

[0022] It should be noted that the information about the target geographic area is received at the apparatus of the first aspect, in one specific example, the target geographic area is an area smaller than the coverage area of ​​the access device.

[0023] According to the first option or a second option combined with any of the above first to fifth aspects, the total number of access devices required in the target geographic area and the locations of the access devices in the target area are predicted based on measurement parameters received from the access devices, and the access devices are deployed or removed based on the prediction result, thus ensuring the coverage required for sufficient service capacity in the target geographic area.

[0024] According to a third option, which can be combined with the first or second option or any of the first to fifth aspects above, it is checked whether the detected wireless communication device is a predetermined wireless communication device of the first responder by verifying an identity linked to the user of the detected wireless communication device or an identity linked to a pre-registered first responder device. This allows communications within the MCI or emergency area to be limited to selected wireless communication devices to ensure sufficient service capacity. As a further option, the first responder device can be registered on a separate slice and / or separate frequency of the first responder network, separate from the victims and / or spectators.

[0025] According to a fourth option, which may be combined with any of the first to third options or any of the first to fifth aspects above, one or more additional access devices may be authorized and registered (i.e., attached) to the wireless communication network (for the first responder) directly or via an access device that was previously already attached, for example by exchanging emergency-related or first responder-indicating security credentials during registration. If the access devices are mobile (e.g., a drone with built-in base station functionality), each of these access devices receives coordinates from the network controller device and moves towards the respective coordinates. Furthermore, base station devices belonging to Public Land Mobile Networks (PLMNs) operating in the same or partially overlapping areas are requested / invited (via a signal (indicating an emergency) transmitted by the access device of the wireless first responder network or via a back-end connection between the network controller device of the wireless first responder network and the PLMN) and are then authorized and registered to operate as additional access devices of the first responder network. This measure ensures that communications by emergency services can be provided by the wireless first responder network, for example, by providing sufficient coverage within the MCI or emergency area.

[0026] According to a fifth option, which may be combined with any of the first to fourth options or any of the first to fifth aspects above, identity information of a wireless communication device, e.g., belonging to a victim within the MCI or emergency area, is retrieved and the victim is identified by matching the identity information of the wireless communication device with user information stored in the cellular device platform, or the victim's wireless communication device is registered with a wireless communication network (for first responders) to triangulate the victim's location, thereby enabling the victim to be identified and / or located within the MCI or emergency area.

[0027] According to a sixth option, which may be combined with any of the first to fifth options or any of the above first to fifth aspects, the registration invitation is limited to at least one of a predefined group and / or type of wireless communication devices, network service, and network slice of the wireless communication network, thereby allowing wireless devices used in the MCI or emergency area to be limited to a specific group or type, service, or network slice to ensure reliable and effective service provision in the MCI or emergency area.

[0028] According to a seventh option, which may be combined with any of the first to sixth options or any of the first to fifth aspects above, an access device deployed in a target geographic area (e.g., MCI or emergency area) comprises a relay node functionality activatable by a network controller device. This measure provides an advantage that the network controller device can activate the relay node functionality to enhance the coverage area of ​​the first responder network in the MCI or emergency area, for example through a multi-hop chain of access devices. Additionally, a wireless communication device connected with the access device is activated to operate as a relay node for extending the coverage of the wireless communication network.

[0029] According to an eighth option, which may be combined with any of the first to seventh options or any of the first to fifth aspects above, measurements are performed by the deployed access devices in a target geographical area of ​​the access devices (e.g., MCI or emergency area) and corresponding measurement parameters are forwarded to a network controller device for prediction of the total number of access devices required in the MCI or emergency area. This makes it possible to ensure that a sufficient number of access devices are deployed in the MCI or emergency area to ensure reliable and effective service provision in the MCI or emergency area. Such measurements are also performed by other wireless devices, for example in areas where the access devices do not provide coverage and only relay connections are possible.

[0030] According to a ninth option, which may be combined with any of the first to eighth options or any of the first to fifth aspects above, a first responder database is provided for pre-registering wireless communication devices associated with respective first responders, and a central identity server is provided configured to access the first responder database to derive user information of the first responders associated with the pre-registered wireless communication devices, such that device identification information of a detected wireless communication device can be used to check whether the detected wireless communication device belongs to a pre-registered first responder authorized to use the first responder network for communication.

[0031] According to a tenth option, which may be combined with any of the first to ninth options or any of the first to fifth aspects above, the apparatus of the first aspect is further configured to include information about the emergency situation (e.g., a special information element) in the invitation signal or message sent to the wireless communication device and further including a certificate (e.g., a digital certificate signed by a first responder organization or government) indicating the urgency of the request.

[0032] According to an eleventh option, which may be combined with any of the first to tenth options or any of the first to fifth aspects above, the system of the fourth aspect is configured to perform device authentication via a link between the network controller device and an external device that is not registered in the wireless communication network (for the first responder), thereby enabling the unregistered wireless communication device to be registered in the wireless communication network without extensive pre-registration efforts.

[0033] In one example of an eleventh option, a network controller device of the system of the fourth aspect is configured to connect with external devices via a limited range local connection and to couple to a core network of the wireless communications network (for the first responder) to enable the external devices to act as an authenticator and / or subscription rights holder registry for inbound roaming devices.

[0034] In another example of the eleventh option, the network controller device of the system of the fourth aspect is configured to allow an external device to verify that an incoming roaming device belongs to the same network, facility, or group.

[0035] In a further example of the eleventh option, the network controller device of the system of the fourth aspect is configured to provide authentication and / or identification information to an external device (e.g. a drone or other wireless robotic device, or a mobile server device, for example located on a fire truck of another fire brigade) such that the core network functionality of the external device is able to perform local network registration functionality.

[0036] According to a twelfth option, which may be combined with any of the first to eleventh options or any of the first to eighth aspects above, the system of the seventh aspect is configured to exchange information between the wireless communications network (for the first responder) and another wireless communications network (e.g., a PLMN operated by a public network operator) to obtain location information for user identification or to request an access device of the other wireless communications network to temporarily join the first responder network.

[0037] According to a thirteenth option, which may be combined with any of the first to twelfth options or any of the first to fifth aspects above, the system of the fourth aspect is configured to identify and track legitimate network authorities and transactions in the wireless communications network and / or subscriber database, for example to perform appropriate de-registration of all access devices and wireless communications devices, return the devices to their previous state, and keep a record of what happened (e.g. for training purposes or in case of addressing liability, i.e. as a black box).

[0038] It is pointed out that the above apparatus may be implemented based on a discrete hardware circuit arrangement involving an arrangement of discrete hardware components, integrated chips, or chip modules, or based on a signal processing device or chip controlled by a software routine or program stored in a memory, written onto a computer readable medium, or downloaded from a network such as the Internet.

[0039] It is to be understood that the apparatus according to claim 1, the access device according to claim 8, the wireless communication system according to claim 9, the method according to claim 17 and the computer program according to claim 18 have similar and / or identical preferred embodiments, in particular as defined in the dependent claims.

[0040] It is to be understood that preferred embodiments of the invention are also possible in any combination with the respective independent claims and the dependent claims or embodiments described above.

[0041] These and other aspects of the invention will be apparent from and elucidated with reference to the embodiments described hereinafter. [Brief description of the drawings]

[0042] [Figure 1] FIG. 1 illustrates a schematic diagram of an MCI scenario in which the present invention can be implemented. [Diagram 2] FIG. 1 illustrates a schematic diagram of a first responder network architecture, according to various embodiments. [Diagram 3] FIG. 1 illustrates a schematic block diagram of a network controller device, according to various embodiments. [Figure 4] FIG. 1 is a schematic block diagram of an access device according to various embodiments. [Diagram 5] 1 illustrates a schematic diagram of a flow chart of a first responder network deployment procedure, according to various embodiments. [Figure 6] 1 illustrates a schematic diagram of a flow diagram of a first responder network location and mapping procedure, according to various embodiments. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0043] Embodiments of the invention are described herein in the context of a network infrastructure, e.g., targeted to first responders, comprising an end-to-end wireless system deployed during an MCI event or other event that requires (e.g., emergency) personnel to communicate over the network infrastructure (e.g., forest fires or emergencies in remote areas without reliable network coverage, temporary events involving large crowds and requiring alternate networks for personnel). Although embodiments of the invention are described in the context of a first responder network, the invention and techniques of the invention are not limited to first responder networks and are applicable to any cellular Public Land Mobile Network (PLMN) or any cellular or non-cellular Non-Public Network (NPN).

[0044] The system can be deployed on demand based on location dynamics and the specifics of the MCI event (e.g., whether the MCI event is a terrorist attack, secondary or highway accident, natural disaster, or infectious disease outbreak, etc.), each of which can have unique requirements by first responders depending on the number of victims and the area surrounding the incident. Medical service vehicles such as ambulances and fire engines can be fitted with antennas for wireless communication technologies such as, but not limited to, cellular base stations with direct satellite links, WIFI, Bluetooth, Long Range (LoRa), and the like.

[0045] Throughout this disclosure, a "first responder" is intended to be a person who will be the first to arrive at the scene of an emergency to assist in an MCI event, such as an accident, natural disaster, or terrorism. First responders include law enforcement officers, paramedics, emergency medical technicians (EMTs), and firefighters. In some areas, emergency department personnel are also required to designate themselves as first responders to respond to disaster and crisis situations. Additionally, a "first responder network" is intended to be a dedicated network for use by first responders to support first responder services in MCI areas. First responder networks are typically dedicated / standalone non-public networks, but may also be networks that share infrastructure with public networks or incorporate public network capabilities.

[0046] Reasons for not using existing communication networks could be overload (typically, when something happens people start using communication systems to get and spread information), network unavailability (especially when considering large scale and catastrophic MCIs such as earthquakes, plane crashes in residential areas or metro stations, where communication systems may simply be destroyed or signals are unable to reach such locations), as well as illegal intent by criminals to disrupt known and public network services during MCI events (e.g. shutting down certain radio frequency ranges during a terrorist attack).

[0047] As already mentioned above, there are several first responder networks, such as FirstNet, which has been deployed in all 50 states in the United States. These types of first responder networks typically operate on dedicated, non-public radio frequency (RF) spectrum to reduce interference from the general public during MCI events, but they cannot be deployed autonomously and operate independently without the existing cellular infrastructure.

[0048] As an alternative, non-commercial networks such as amateur radio are frequently used during disasters. Nevertheless, such networks are not very reliable for implementing high-bandwidth, low-latency communications. Moreover, additional hardware is required for users to enjoy amateur radio communications.

[0049] Additionally, cell on wings (COW) has been proposed, where drones are used to automatically deploy a preconfigured network infrastructure with direct satellite links. Nevertheless, such COW systems are heavily preconfigured with specific network information that is only appropriate for areas without cellular coverage and cannot be dynamically configured based on the specific characteristics of MCI events.

[0050] FIG. 1 illustrates a schematic of an MCI scenario in which the present invention can be implemented.

[0051] More specifically, the MCI scenario of FIG. 1 involves a crashed airplane 15 with first responders (e.g., triage officers) 110 and triaged casualties (i.e., victims or patients) 120, 130.

[0052] In various embodiments, emergency vehicles such as fire engines 10 and ambulances or medical service vehicles 13 are fitted with their own first responder network infrastructure with dedicated backhaul communications equipment (e.g., satellite antennas) that is self-deployable with minimal configuration sufficient to operate as a stand-alone wireless first responder network specifically capable of serving MCI areas. The wireless first responder network has its own limited range to prevent interference with other public networks outside the MCI area.

[0053] In certain circumstances where an MCI event occurs over a wide area, the emergency vehicles 10, 13 may still be unable to provide sufficient coverage. In FIG. 1, triaged victims 120, 130 within the dashed circles around the emergency vehicles 10, 13 are within the range of the two first responder networks established by the emergency vehicles 10, 13. The emergency vehicles 10, 13 may still be unable to cover the entire MCI area due to their inability to reach certain locations.

[0054] Other examples of inadequate coverage are subway (metro) accidents, accidents near or on mountains, swamps, or the coast.

[0055] To support and / or extend the coverage area of ​​the established first responder network, various devices present in the MCI area (e.g., user equipment (UE) of the injured person or first responder (e.g., triage officer), wireless communication devices such as smart watches, cellular medical devices, etc.) act as repeaters in the first responder network.

[0056] Additionally, the infrastructure of the wireless first responder network can be expanded by adding base station devices (e.g., equipped on drones by different first responder services) that are unknown to the deployed wireless first responder network and can be included as part of the deployed first responder network.

[0057] Additionally, unmanned remote-controlled or autonomous robots such as drones and / or motorized rovers already have a wide range of applications, including military applications, races, light shows, video and photography for package delivery, inspecting undersea communication lines, and possibly combating insect plagues such as locusts in Africa. Such unmanned robots are cost-effective and can potentially be programmed to be remotely controlled or fully automated to navigate in unprecedented locations such as MCI areas.

[0058] As shown in Figure 1, drones 12 or other autonomous robots can be used to monitor and expand the MCI area of ​​emergency vehicles 10, 13. Network expansion can be achieved by deploying drones 12 as relay nodes with their own coverage area (dotted circle around drone 12). As shown in Figure 1, a lower one of the drones 12 is in the coverage area to the left of the emergency vehicles 10, 13 in Figure 1 and operates as a relay node for the first responder network, while an upper one of the drones 12 is in the coverage area of ​​the lower one of the drones 12 (the relay node).

[0059] Additionally or alternatively, existing and available cellular devices (e.g., mobile phones) or other wireless devices (not shown in FIG. 1) may be improvised and / or automatically reused to enhance the coverage area of ​​the first responder network.

[0060] FIG. 2 illustrates a schematic of the architecture of a first responder network 200 according to various embodiments based on a wireless communication system (eg, a public land mobile network (PLMN) or a non-public network (NPN)).

[0061] In Fig. 2, a network controller device (Device A) 20 is configured to operate a core network for a first responder network 200 deployed standalone and optionally connected with other core networks of one or more mobile operators to provide a temporary network for first responders and casualties in an MCI event. The network controller device (Device A) 20 comprises a network controller module or function 202, an identity service module or function 204, a simultaneous localization and mapping (SLAM) module or function 206, a location service (LCS) or location database, and other core network modules / functions such as an Access and Mobility Function (AMF), a Mobility Management Entity (MME), a Unified Data Management function (UDM) or Home Subscriber server (HSS), an Authentication Server Function (AUSF), etc. The functionality of these modules / functions may be combined, e.g., the SLAM module / function 206 may be combined with a location service (LCS), or, for example, the identity service module or function 204 may be a separate identity manager / database combined with, for example, the AUSF or UDM, but may also be an AUSF combined with a UDM, or may simply function as an AUSF, authentication / authorization / accounting AAA server, or the like.

[0062] Nevertheless, it is noted that in all embodiments the core network is distributed across multiple devices and need not be a single device.

[0063] Additionally, one or more base stations or access devices (device B) 22 are connected to device A 20 and capable of providing wireless connectivity to wireless communication devices 24 (devices UE) within their coverage area. The device identity (e.g., subscription concealed identity (SUCI) in a 5G network) of one or more devices UE 24 may be concealed with a secure credential (e.g., private key) of the home PLMN of device UE 24.

[0064] The device A 20 can automatically connect to a central identity server (CIS) 26 to communicate subscriber details such as the device identity (DID) (e.g. IMSI) of the first responder and to retrieve information of the user linked to the target device UE 24. Such a central identity server (CIS) 26 is outside the core network of the first responder network 200 and is deployed, for example, as an external AAA or RADIUS server or an AUSF in another network (e.g. the home network of the target device UE 24).

[0065] Additionally, a first responder database (FRDB) 28 is provided that can be used to pre-register at least some of the devices UE 24 with their respective first responders and / or with unique network slices for validation purposes. Such a first responder database (FRDB) 28 is, for example, an active directory server or a UDM in another network (e.g., the home network of the target device UE 24).

[0066] To enable authentication of the device UE 24 by the first responder network 200, for example via the identity service module / function 204 and / or the central identity server 26, and / or by a first responder database and / or the device's home network, the device UE 24 has a secure device identity (devID) or user identity (userID) (e.g. an international mobile equipment identity (IMEI)) stored in a secure memory that is unique to the device UE 24 or to the user (e.g. a digital passport) and is linkable to the user of the device via network-related information (e.g. an international mobile subscription identity (IMSI) stored in the subscriber identity module 242 (e.g. as described in the GSMA SGP.21-RSP architecture)). In the NPN case, for example, TLS / certification / PKI-based certificates can be used, as described in TS33.501, and / or the concept of default certificates can be used, as described in 3GPP specification TR23.700-07.

[0067] The CIS 26 is configured to access a first responder database 28 to derive user information (eg, a first responder ID (FRID)) of registered first responders associated with the device UE 24 .

[0068] In one embodiment, the device A20 invites or triggers / requests the device to connect with the first responder network 200 after unhiding the hidden device identity (e.g. to derive a subscription permanent identifier (SUPI) from the SUCI) by requesting the home PLMN of the device UE24 (e.g. in a Subscription Identifier Unhiding Function (SIDF) in a 5G network via a NEF). For this purpose, the first responder network 200 has to provide a certificate (e.g. a digital certificate signed by a first responder authority or government), e.g. through the AUSF, by which the first responder network 200 can prove to the home PLMN of the device UE24 that it is involved in the emergency and therefore it is important to provide device / user identity information of the device UE24 (e.g. based on the SUCI provided by the responder network to the home PLMN) and / or that the device UE24 connects to the first responder network and sets up the necessary communication. Alternatively, when device UE24 registers with the first responder network, if device UE24 is permitted or can be permitted / enabled to register with the first responder network without requesting SUPI unhiding, the first responder network requests the home PLMN of device UE24. As an alternative to this, the first responder network needs to provide an emergency certificate to the home PLMN of device UE24 as described above (e.g., if no roaming agreement is in place).As another alternative, when the device UE 24 registers with the first responder network, the first responder network requests the home PLMN of the device UE 24 to provide user identity related information (e.g., subscription information, name of the subscription holder of the subscription linked to the respective SUPI, telephone number, emergency contact, electronic health record information) and / or location information of the device UE 24, with or without requesting further permission for the device UE 24 to register with the first responder network. As an alternative, the first responder network needs to provide an emergency certificate to the home PLMN of the device UE 24, as described above. The communication from the first responder network 200 to the home PLMN for making the above-mentioned request and for the home PLMN to provide the response thereto is performed on a secure channel, with or without a roaming agreement in the emergency scenario.

[0069] For this purpose, the device A20 or another device in the first responder network has to connect with the NEF of the home PLMN of the device UE24 and present an emergency certificate, which can then be used during a security handshake to set up a secure connection (e.g. an IPSec tunnel) between the first responder network and the home PLMN after being verified as authentic by the home PLMN (e.g. by contacting the respective certificate authority that signed the certificate). Alternatively, the device A or another device in the first responder network can register as a UE in the home network, for example request a PDU session, provide the emergency certificate through the PDU session, set up a secure connection using the emergency certificate, and enable the first responder network (e.g. its AUSF) to request the home PLMN to unhide the device identity and / or enable the device UE24 to register in the first responder network. The registration can be of the type "emergency request" or "disaster roaming" as per TS23.501. As another alternative, the device A20 or another device in the first responder network needs to connect to a Public Safety Answering Point (PSAP) and provides the PSAP with the SUCI of the device UE24, information about the home PLMN of the device UE24, and / or emergency credentials. Such a PSAP can have emergency access to the respective home PLMN of the device UE24 (e.g., through the NEF) and can therefore request the home PLMN of the device UE24 to unmask the device identity and / or allow the device UE24 to register in the first responder network and return this response to the first responder network. The PSAP also requests the home PLMN to set up a secure connection between the home PLMN and the first responder network, either directly (e.g., a TCP / IP connection over the Internet) or via the PSAP.Through the secure channel, the home PLMN provides information about signals, messages, or certificates that the first correspondent can use in its invitation and triggers or requests the device UE 24 to allow connection to the first correspondent network. The home PLMN (e.g., upon requesting the first correspondent network to allow the device UE 24 to connect with the first correspondent network) updates steering roaming information or the preferred list of non-public networks of the device UE 24 by adding the identity of the first correspondent network (provided by the first correspondent network through the secure connection) and / or updates other policy information of the device UE 24 to allow the first correspondent network to connect with the device UE 24. The home PLMN similarly deregisters the device UE 24.

[0070] To facilitate easy and automatic registration of wireless communication devices within the MCI area of ​​an MCI event, for example to enable automated billing, tracking, or identification of casualties, the device B22 is configured to receive information or volume about a target geographic area (e.g., from the network controller device (device A) 20) and allow wireless communication devices within this target geographic area to be automatically registered via the respective device B22 to the core network operated by the device A20. This can be achieved by an invitation or connection trigger / request, which is a signal or message indicating an emergency transmitted by an access device of the first responder network 200. In one example, this can be a Public Alert System (PWS) signal, an SMS / IMS message, a System Information Block (SIB) or Radio Resource Control (RRC) message, a Non-Access Stratum (NAS) message, or a preamble including flags or information elements. In one example, the first responder network broadcasts that it supports disaster roaming (as per TS 23.501) and includes a flag / attribute with a value to indicate a request / invite to devices to connect (e.g., a Boolean "Emergency Use Request") and / or includes a flag / attribute with an identity (e.g., SUCI) of the particular device UE 24 that will register with the first responder network. The signal / message or one of its information elements is signed or includes some security certificate (e.g., a digital certificate signed by a first responder organization or government) indicating an emergency or MCI event.Sending an invitation or connection trigger / request may be achieved by sending an emergency indication (and / or emergency certificate) during the call setup to the device UE24, by calling a special number related to the telephone number of the device UE24, or by sending a USIM application / service command or a (secret) dialing code to the device UE24, or by sending a broadcast message with a predefined payload (e.g. via a multicast / broadcast services framework) or an SMS with a special code.

[0071] Alternatively or in addition to an invitation or connection trigger / request to connect to a wireless communications network provided by device B22 and / or device A20, the invitation or connection trigger / request may include instructions to initiate communication over a sidelink, to set up a sidelink connection to another wireless communications device (e.g., a shared patient monitor collecting data from a population of victims), or to trigger a handover from one access device to another access device or from one wireless communications network to another wireless communications network.

[0072] Additionally, the invitation or connection trigger / request may include a minimum / maximum distance (e.g., to the access device B22 or to a particular coordinate or reference point / device (e.g., a position reference unit, as described in R2-2106920)), or a set of coordinates (absolute (e.g., geographic coordinates) or relative to a reference point / device (e.g., a position reference unit, as described in R2-2106920)) indicating the target area / volume to which the device is invited / triggered to connect, or a tracking area identifier and / or tracking area dimensions (e.g., a set of coordinates), or a forbidden area identifier and / or forbidden area dimensions (e.g., a set of coordinates). Alternatively or in addition to an invitation or connection trigger / request, device UE24 may be securely provided in advance (e.g., by the PCF) with information about one or more target areas to which the device is / is not allowed to connect, e.g., a set of coordinates indicating the dimensions of the tracking area and associated tracking identifiers, and then device UE24, upon detecting access device B22 (e.g., upon receiving a connection trigger / request), may estimate the location of access device B22 and force a connection to access device B22, whether allowed or not. Devices outside the designated target area / volume need not respond if their location is not within the target area / volume, or alternatively device B22 (possibly together with device A20) may select between devices that are and are not within the target area / volume (e.g., decide which devices to register with device B22 or not).Additionally or alternatively, device B22 may allow a device (e.g., device UE24) to register with device B22 and may allow the device to initiate registration with the first responder network (e.g., by forwarding messages received from the device to device A20), whereupon the first responder network (e.g., by the AMF / AUSF of the core network of the first responder network operated by device A20) may filter devices that are or are not located within the target area / volume (e.g., decide which devices are or are not to be registered with the first responder network 200). For this purpose, device B22 or device A20 may contact a location service / database to retrieve location information of the respective device UE24 or may use location / location measurement (e.g., timing of sounding reference signals or position reference signals) information provided by the respective device UE24 or device B22. Device A or device B obtains the location of the respective device UE 24 by connecting with a public safety answering point, which must or can contact a location service that also provides up-to-date information about the location of the respective device.

[0073] In an embodiment that may be combined with any other embodiment or implemented independently, there is a target geographic area of ​​a base station or access device (device B) 22 for triggering / requesting an invite and / or for device B 22 and / or device A 20 to filter out devices that are or are not within the target area / volume (and thus are / are not allowed to register with the first responder network). The target geographic area is smaller than the coverage area of ​​a single base station or access device. That is, device B22 is configured to receive information about dimensions (e.g., a set of coordinates (absolute (e.g., geographic coordinates) or relative to a reference point / device (e.g., location reference units, as described in R2-2106920)) and / or (a set of) minimum / maximum distances, e.g., to one or more access devices B22, or to one or more specific coordinates, or to one or more reference points / devices (e.g., location reference units, as described in R2-2106920) of a target geographic area that is a sub-region of the coverage area of ​​one or more devices B22), and / or to invite or trigger / request one or more of devices UE24 within the coverage area of ​​device B22 to register, via the respective device B22, to the core network operated by device A20. Device B22 derives or calculates distances or positions from a set of devices within its coverage area (possibly in cooperation with other devices and / or location services in the core network) by transmitting and receiving respective location signals (e.g., position reference signals, round trip time measurement signals).Alternatively, device B22 or device A20 may contact a location service or database (e.g. operated by device 20 or by the PLMN to which device UE24 is connected, providing data about the device (e.g. capabilities, type, identity), device location in a particular area, and / or the latest / previously known location of the device, e.g. based on previous data collection and measurements, but also provided by another network service / server such as a Network Data Analysis Function (NWDAF)) to retrieve a set of devices within the target area / volume and, based on this information, send an invite or connection trigger / request only to the respective set of devices. For this purpose, the invite or connection trigger / request may contain device identity information of the target devices or device B22 (possibly together with device A20) or device A20 may filter out devices that match or do not match the respective identities. Instead of sending an invite or connection trigger / request, the device A20 or B22 allows the device UE24 to register in the network and then estimates the location of the device UE24 during or after registration by exchanging location estimation signals or by exchanging location information (e.g. between the device UE24 and the device A20 or B22) (or by the device UE24 providing location / location measurements (e.g. timing of sounding reference signals or position reference signals) during the registration procedure), after which the network aborts the connection setup procedure or de-registers / disconnects the UE if the estimated location is not within the configured target area.Alternatively, after initial registration and / or PDU session setup of device UE 24, device A20 or B22 may contact a location service or database, for example operated by device 20 and / or first responder network 200, or by a PLMN to which device UE 24 is connected (and from which device UE 24 has transmitted its location estimation signal measurements or its location information and / or from which the location of device UE 24 can be determined), to retrieve an estimated location of device UE 24. This requires authorization from device UE 24's home network operator to be able to determine the location of device UE 24 and / or access location services, and therefore requires device A20 or device B22 to provide an emergency certificate / certificate, as described above. Instead of contacting a location service or location database (possibly operated by the home network operator of the device UE 24), the device A20 or B22 also has the target area information and possibly sends a message including the identifier received from the device UE 24 (e.g. the Subscription Hidden Identifier (SUCI)) to the location service or location database, after which the location service or location database will respond with a message having information about whether the UE is currently within the respective target area or not, but not revealing any additional identity information about the device UE 24 (such as the International Mobile Subscriber Identity (IMSI) or the Subscriber Permanent Identifier (SUPI)) in order to preserve the privacy of the device UE 24 towards the network operated by the device A20.

[0074] As another alternative, the first correspondent network has a roaming agreement with the home network of the device UE24 and provides home routed roaming to the home network of the device UE24, e.g., as per TS 23.501. In this case, the device UE24 registers in its home network (via a roaming connection provided by the first correspondent network) and thus uses the location services of this network. The first correspondent network provides information about the target area to the home network of the device UE24, e.g., by the AMF adding information about the target area to a home routed registration request forwarded from the device UE24 to the home network of the device UE24, or by providing this information through, e.g., a NEF between the first correspondent network and the home network of the device UE24. The home network of the device UE24 determines whether the device UE24 is allowed to register with the first responder network based on the provided target area information (e.g., by checking whether the location of the device UE24 is within the target area using a location service of the home network of the device UE24) and if not, the home network of the device UE24 aborts the registration procedure or deregisters the device.

[0075] Additionally or alternatively, device B22 may have multiple antennas and transmit its synchronization signal or invitation or connection trigger / request only on a specific beam or on a specific synchronization signal block (SSB). The signal / message may also be broadcast on all beams in all directions, but may include, for example, an index to a specific SSB, to allow device UE24 to respond or not respond based on the index. Alternatively, device UE24 may transmit an SSB / beam index and / or other beamforming related information (e.g., channel state information, signal direction, or other measurements) to device B22, which device B22 may use to determine whether device UE22 is within a particular coverage area corresponding to the SSB index. Based on configured target area information (e.g., as received through the NEF), one or more beams are adjusted to be narrower (e.g., by applying different OFDM encoding to reduce spatial diversity, adjusting antenna array configurations, applying different transmit power patterns relative to the antenna area, repositioning antennas, moving panels / reflective surfaces, etc.) to target a smaller coverage area. Additionally, device A20 or device B22 may be connected with other access devices / base stations, which may enable the devices to exchange messages to provide a synchronized set of beams from multiple base stations (e.g., by using coordinated multipoint transmission / reception (CoMP)) to make the signal in the configured target area very good (each beam is good enough to use weaker signal strengths, thus making the individual beams less strong in other coverage areas, making service to UEs outside the configured target area much worse or possibly unusable). The area covered by the beams is likely to be circular or spherical in nature. The target areas that can be configured (e.g., through the NEF) are limited to such shapes.To apply beamforming to other configured shapes, device A20 or device B22 may perform some shape matching to cover as much of the configured target area as possible using multiple overlapping beams (from one or more access devices) and reduce coverage outside the configured target area, for example, by algorithmically determining various combinations of overlapping beams and / or beam configurations and, for each combination / configuration, measuring the expected percentage of overlap with the configured target area and / or estimating the areas outside the target area that will be similarly covered by beams (given the various beam configurations) and comparing these percentages and / or estimates to determine the best configuration / collection of overlapping beams.

[0076] It should be noted that the invitation or connection trigger / request may contain information about an (additional) emergency telephone number to enable the device UE24 to set up an (unauthenticated) emergency call upon receiving the invitation or connection trigger / request to the named emergency telephone number.

[0077] The invitation or connection trigger / request may be limited to or targeted to a particular group of devices UE24 (e.g., those operated by a first responder) and / or a particular type of device UE24 (e.g., those with particular capabilities (e.g., sidelink communication or access to a Global Positioning System (GPS))).

[0078] Additionally, if during an MCI event communication with the home PLMN may not be established within a prescribed time (e.g. due to a network failure of the home network), the device A20 may determine the home PLMN identity (e.g. Permanent Equipment Identifier (PEI) or International Mobile Equipment Identity (IMEI) obtained directly from the device UE24 through a pre-installed user application via a secure out-of-band communication such as Wi-Fi) and / or based on a non-hidden subscriber identity (e.g. Globally Unique Temporary Identity (GUTI)) obtained from the device UE24 in the absence of a security context in an emergency scenario (e.g. RRC setup in a 5G network as specified in 3GPP TS33.501 Security Architecture and Procedures for 5G Systems) (e.g. during the setup of an emergency connection between the first responder network 200 and the device UE24) (e.g. according to GSMA-SGP.22 The device UE 24 is provided with network credentials (e.g., a SIM profile) of the first responder network 200 via a Universal Subscriber Identity Module (SIM) provisioning server (such as specified in the Route Discovery Service specified in the RSP technical specification).Alternatively, the device A20 may initiate the setup of a connection (e.g., emergency connection) via a UE-network repeater to the first responder network by the first responder UE providing the public key of the first responder network (e.g., via a discovery message or other sidelink message) and / or by the first responder UE connecting via a sidelink / PC5 to a ProSe application / service provided by the device UE24 for such purpose (e.g., using a PC5 direct communication as specified in TS 23.304 between the first responder UE and the device UE24 for this particular application / service (e.g., ProSe configuration service or ProSe emergency service)). As a UE-network relay to the device UE24, the first responder UE provides access via a control plane connection (e.g. through NAS / RRC messages) or a Restricted Local Operator Services (RLOS) user plane connection with the device UE24, or via a sidelink connection between a device connected to the first responder network (e.g. a UE carried by the first responder) and the device UE24, downloading / providing security credentials (e.g. a TLS certificate), after which the device A20 provides (additional) security credentials and possibly further policy information to enable the device UE24 to register and use all services of the first responder network.

[0079] In an embodiment, combined with any other embodiment or implemented independently, the first responder network can discard the location privacy setting of the device UE 24 (e.g., set a privacy discard indicator POI, as specified in 3GPP TS 23.273 5G System (5GS) Location Services (LCS)) if the device B 22 of the first responder network 200 can prove to the device UE 24 or the home network of the device UE 24 that the first responder network is authorized to do so (e.g., by representing a PLMN operator class, as specified in the Functionality Stage 2 Description of 3GPP TS 23.271 Location Services (LCS)). By way of example, the device UE 24 has special permissions set for such a situation, such that even the government cannot have access in any case. The device UE 24 stores permissions for the device or for services / applications on the device, for example by setting Android permissions (e.g., android.permission.emergency-location or android.permission.location-override (which do not yet exist)) to allow (e.g., granted / approved when installing / configuring the device or service / application, or explicitly set by a user of the device). Such permissions are linked to passwords, keys, or other credentials that need to be provided to the device to verify / grant / allow such permissions.The user of the device UE24 also pre-agreed to provide such special permissions by storing consent to the special permissions in the Unified Data Manager (UDM), Unified Data Repository (UDR) or Home Subscriber Server (HSS) of the home PLMN of the device UE24, and consent to the special permissions is verified by a first responder by connecting, for example through a NEF or indirectly through a Public Safety Answering Point (PSAP), to the respective Unified Data Manager (UDM), Unified Data Repository (UDR) or Home Subscriber Server (HSS) that has access to the respective permission data or has the ability to revoke the respective permission. In such a scenario, the user or the user's friends / family (added to their information in the subscriber database (HSS) or listed as emergency contacts on the respective mobile phone's SIM card, non-volatile storage, or wearable connected to the mobile phone) receive a notification to accept the incoming invitation or connection trigger / request, or the incoming SIM profile, or to "unlock" the device, discard the location privacy indicator setting on the device, or discard the security lock on the device UE 24 or SIM card to grant authority to perform these actions on behalf of the casualty. Alternatively, the device A 20 of the first responder network 200 can provide a new location service profile (e.g., as specified in 3GPP TS 23.273 5G System (5GS) Location Services (LCS)) when establishing a network connection with one or more access devices B 22 or devices UE 24 in the MCI area.

[0080] As another option, the first responder is allowed to unlock device UE24 (e.g. based on special permissions granted in the first responder's wireless communication device by the network controller device A20), after which the identity of the first responder (e.g. the Subscriber Hidden Identity SUCI of the first responder's wireless communication device) is recorded in device UE24 or device A20 for later checking whether this was a legitimate action. Alternatively, the first responder device UE24 may be authorized to provide a new location service profile to one or more devices UE24 (e.g., by device 20), or to override the location privacy settings and enable ranging between the first responder device and one or more devices UE24 (e.g., via a NEF as specified by 3GPP TS23.273 5G Systems (5GS) Location Services (LCS), or via secure out-of-band communication such as NFC), or to enable location sharing services of the device UE24 (e.g., by setting a location privacy indicator LPI to be allowed for a specified time).

[0081] Furthermore, the invitation or connection trigger / request is limited to devices UE24 (e.g., first responders) that can access a particular network slice (e.g., available network resources), for example, by including a specific slice identifier (S-NSSAI) as part of the invitation signal / message or connection trigger / request. Also, victim devices UE24 are assigned to different network slices, for example, depending on the severity of the victim's injuries. Groups of devices UE24 are invited or triggered / requested to connect, for example, based on a special information element in the signaling information or a special RRC message from device B22. Thus, multiple network slices delivering the same characteristics for different groups of devices UE24 are deployed. Inviting or triggering / requesting devices UE24 to connect with a particular network slice can also be achieved, for example, by adding the network slice to an allowed network slice selection assistance information (NSSAI) list for specific devices UE24 in a group of devices UE24, for devices UE24 in a particular geographical area, and / or for devices UE24 with an explicit invitation or connection trigger / request. In one example, a network slice is limited to a particular geographical area smaller than the coverage or tracking area of ​​a single device B 22. Additionally or alternatively, the device UE 24 is configured with preferred non-public network roaming steering information / list that also includes information about which (preferred) network slice / NSSAI to connect with next to the PLMN / NPN information. Thus, in the case of the first responder network 200, the device UE 24 is provided with the identity of the first responder network and the (preferred) network slice / NSSAI to connect with upon registration.Based on this information, whenever the device UE 24 registers with the first responder network 200, the device UE 24 will automatically request the configured (preferred) network slice / NSSAI upon registration with the first responder network.

[0082] The network controller device A20, via the device B22, has to securely but authoritatively invite or trigger / request the device UE24 to connect in the MCI area with the first responder network 200. In addition to explicit invitation or connection trigger / request messages transmitted from the device B22 (i.e. sent to the device UE24 without prior backing of the home PLMN), invitations or connection triggers / requests can also be implicit (i.e. sent to the device UE24 with prior backing of the home PLMN), which allows to distinguish the following scenarios:

[0083] a) The device UE 24 is within the coverage area of ​​an existing network infrastructure connected with a PLMN with which the first responder network 200 has a roaming agreement. In this scenario, the first responder network 200 may have been given a higher priority in the roaming steering information or the priority list of non-public networks, and thus the invitation or connection trigger / request is implicit and the involved device UE 24 will automatically connect to the respective first responder network 200 as soon as it discovers such network. In this case, the device B 22 (possibly in cooperation with the device B 20) will filter out devices outside the designated target area by determining the distance / position (e.g. through triangulation / trilateration of different signals received by one or more access devices) or by comparing the location information (e.g. GPS coordinates) of such devices UE 24, or through one of the other methods as described above. The estimation of the location of the device UE 24 is performed before the UE completes the registration procedure (including authentication) and / or PDU session setup procedure by, for example, using a pre-registration message (e.g. location estimation signal) to perform location estimation (e.g. TDOA measurements, signal strength information, SSB index / pattern, e-CID time difference value) or by the UE transmitting (encrypted) location information (including location estimation signal measurements (e.g. time of arrival of location reference signals)) to the network (e.g. encrypted using the network's public key, e.g. based on the same home network public key or a similar / derived key used to encrypt the SUCI (as in TS33.501) or a different public key published, e.g. through the System Information (SI) provided by the access device or an emergency certificate).The estimation of the location of the device UE 24 is also performed by exchanging location estimation signals (e.g. directly from the device UE 10) or by exchanging location information (or by retrieving the location information of the device UE 24 from a location service or database operated, e.g. by the device 20 and / or by the first correspondent network or by a PLMN to which the device UE 24 is connected and to which the device UE 24 has sent its location estimation signal measurements or its location information and / or which can determine the location of the device UE 24) after the UE has (partially) completed the registration procedure and / or the PDU session setup procedure, after which the network aborts the connection setup procedure or deregisters / disconnects the UE if the estimated location is not within the configured target area. In a particular example, the device UE 24 uses home routed roaming via the first correspondent network 200 to the home network of the device UE 24 and thus registers with the home network of the device UE 24 and thus uses the location service of the home network of the device UE 24. The first responder network provides information about the target area to the home network of the device UE24, for example by the AMF adding the target area information to a home routed registration request forwarded from the device UE24 to the home network of the device UE24, or by providing this information, for example, through a NEF between the first responder network and the home network of the device UE24. The home network of the device UE24 decides based on the provided target area information whether the device UE24 is allowed to register with the first responder network (for example by checking using its location service whether the location of the device UE24 is within the target area). If not, the home network of the device UE24 aborts the registration procedure or deregisters the device.

[0084] In an embodiment combined with any other embodiment or implemented independently, the above-mentioned mechanisms for estimating the location of the device UE 24 (i.e., by performing a location estimation (e.g., TDOA measurements, signal strength information, SSB index / pattern, e-CID time difference value) using a pre-registration message (e.g., a location estimation signal), or by transmitting (encrypted) location information (e.g., encrypted using the network's public key or an emergency certificate) by the UE to the network, or by estimating the location of the device UE 24 after the UE has (partially) completed the registration procedure and / or the PDU session setup procedure by exchanging a location estimation signal or by exchanging location information), are applied for geofencing, e.g. during registration of the UE to the network.Such geofencing may involve the access device, location service, or other network entity, for example, verifying / ensuring, based on information about the area (e.g., a set of coordinates / distances) and information about the estimated location of the UE, that the UE does not attempt to register from an unauthorized / prohibited area, e.g. rejecting the registration or de-registering the UE if the UE attempts to register from an unauthorized / prohibited area, or verifying / ensuring that the UE registers with the access device in the correct country / area (e.g., ensuring that the UE is registered on a satellite from a specified country and / or on a PLMN operating within a particular country) and rejecting the registration or de-registering the UE if the UE accesses the network from an incorrect country / area, e.g. It is possible to de-register the UE, or to verify / ensure that it is authorized to use a particular licensed frequency band and, if not authorized to use this frequency band, to send a message to the UE and / or the access device to which the UE is connected with information / trigger to switch to another frequency band, or to verify / ensure that the UE is registered in the correct network covering a particular area / location and otherwise reject the connection attempt and / or force the UE to roam / register in another network covering this particular area / location (e.g. by providing the identity of the other network in a rejection / error / (re)configuration message), or to verify / ensure that a public alert signal is sent only to the UE.

[0085] b) The device UE 24 is within the coverage area of ​​an existing network infrastructure connected with a PLMN for which the first correspondent network 200 has no roaming agreement (e.g., since the new first correspondent network 200 always starts as a fresh network). In this scenario, the network controller device A 20 of the first correspondent network 200 captures the hidden device identity (e.g., SUCI) or globally unique temporary identifier (e.g., GUTI) of the device UE 24 via the device B 22. An initial and temporary radio resource allocation (e.g., PDCCH in 5G networks) without a security context (e.g., RRC setup phase in 5G networks) can be established between the device B 22 and the device UE 24 (e.g., as specified by the 3GPP TS38.331 Radio Resource Control (RRC) protocol specification) to enable the exchange of these temporary network identifiers without a security context. A function in the network controller device A20 (e.g., a 5G access and mobility function AMF) can be used to identify the home PLMN of the device UE24 by decoding the temporary identifier (e.g., obtain the MCC and MNC information from the SUCI) and to establish a temporary roaming agreement at the specific location of the MCI event and for the duration of the MCI event. The temporary roaming agreement is established if the first responder network 200 can prove its integrity to the home PLMN based on a hardware root of trust established by a network operator recognized trusted platform (e.g., a GSMA root of trust) or if the first responder network 200 can prove that it is involved in an emergency situation (e.g., via a digital certificate signed by a first responder agency or government).Communications between the first responder network 200 and the remote provisioning platform can only be established if the first responder network 200 can prove its integrity with a root of trust established with a network operator recognised trusted platform (e.g. the GSMA Root of Trust and Security Domains as described in the GSMA SGP.22-RSP technical specification).

[0086] c) The device UE 24 is not provided with any network credentials (e.g., a (new) mobile phone with no network Subscriber Identity Module (SIM) profile). In this scenario, the device UE 24 is provided with network credentials for the first responder network 200 via a generic provisioning server (e.g., as specified in the Route Discovery Service specified in the GSMA-SGP.22 RSP technical specification) using an out-of-band (e.g., Wi-Fi) communication link established between the device B 22 and the device UE 24, either directly or via another device UE 24 (e.g., a first responder UE connected with the device UE 24 via a sidelink).

[0087] Further, in all the above scenarios, or as an independent embodiment, an implicit invite or connection trigger / request can be sent to active PLMNs in a given MCI area (e.g., by device 20 after these devices are discovered by device UE 22 (e.g., by receiving several signals from device UE 24 in the target geographic region of the MCI area)) by contacting these devices. In such a case, legally regulated device B 22 of first responder network 200 can scan the PLMNs in the MCI area and request (for permission) each of these PLMNs to trigger control plane steering of roaming (e.g., as specified in GSMA IR.73 Roaming Steering Implementation Guidelines, version 5.0) or to trigger device UE 24 to move to a private network connection mode, e.g., by setting up a secure channel between first responder network 200 and the respective PLMN, using the methods described above. The home PLMN of the device UE 24 in the MCI area may temporarily set the first responder network 200 as the most preferred network for a defined period of time after the occurrence of the MCI event. Alternatively, a function in the network controller device A20 of the first responder network 200 may be communicatively coupled to a function in the home PLMN network in the target MCI area (e.g. an access and mobility function AMF in a 5G system) via a secure and integrity protected channel (e.g. a network exposure function NEF in a 5G system or one of the other above mentioned methods for setting up a secure channel between the first responder network 200 and the respective PLMN) to distribute roaming steering information (e.g. a list of PLMN identities including the identity of the first responder network and its priority) and / or a preferred list of non-public networks to all devices UE 24 connected with the particular home PLMN.

[0088] Additionally, in all the above scenarios or as an independent embodiment, an explicit invite or connection trigger / request can be sent by device B22 to device UE24 in the target geographic area of ​​the MCI area (e.g., when there is no home and / or preferred PLMN available in the target geographic area of ​​the MCI area). In such a case, special and legally restricted broadcast information about the MCI event (e.g., System Information Block SIB, as specified by the 3GPP TS38.331 Radio Resource Control (RRC) protocol specification) can be sent as a signaling message during the initial random access radio setup phase (e.g., Signaling Radio Bearer 1 SRB1 and RRC setup in 5G systems) or as part of the information (e.g., System Information) broadcast by device B22 of the first responder network 200. Such signaling messages (e.g., broadcasted system information messages) or the payloads / information elements of such signaling messages are securely signed / encrypted (e.g., using mechanisms such as those described in TR33.809) by a key used for emergency / MCI events (e.g., a pre-shared key preconfigured in the device UE 24) and / or by using a key provided by, for example, a first responder organization or government using a digitally signed certificate or by using a key derived from one of such keys / certificates. The signaling message includes an identifier of the key used (in case there are multiple keys for similar purposes (e.g., for emergency situations)) and includes information about the nonce / salt used to derive a certificate to verify / decrypt the signed signaling message, so that the device UE 24 can decrypt the signaling message and / or verify that the signaling message is authentic.Alternatively, the signaling message may include a unique string (e.g., as part of a human readable name or as part of a network or cell identifier) ​​that is known / pre-configurable in the device UE24 to represent a first responder network, an emergency network, or another network that can / should be connected to in an emergency situation, in a particular geographical area, or for example when other known networks are unavailable, and / or the signaling message may include a public key (e.g., as part of a digitally signed certificate) and / or a key identifier (e.g., a pre-shared (public) key) and / or an address (e.g., a URL) from which key material can be obtained, so that the device UE24 uses such a key during authentication by the network (e.g., after retrieving the key material from its storage or a given address), so that the network can prove to the device that it has the matching / private key. In the case of a digitally signed certificate, the device UE24 verifies whether the digitally signed certificate has been signed by a trusted certificate authority by checking whether the digitally signed certificate corresponds / links to a trusted root certificate stored / pre-configured in the device UE24.

[0089] Alternatively or additionally, the device UE24 may contact a server (e.g., an authentication server operated by its home PLMN, a certification authority, the device manufacturer, or other trusted organization) through a data connection, for example, via the home PLMN to which the device UE24 is connected, or via a Wi-Fi network to which the device UE24 is connected (either directly connected to the Internet or through which the device UE24 connects with a Non-3GPP Interworking Function (N3IWF) to connect to a mobile operator network's data network), or via an emergency / RLOS connection (e.g., through a first responder network). Upon contacting such an (authentication) server, the device UE24 may request authentication of the respective network (e.g., from which the device UE24 has received a signaling message) and / or obtain authorization to access the respective network, and / or request validation of the public key / certificate received from the respective network (e.g., to verify if the certificate is still valid and has not been revoked), and / or verify if the respective network can be trusted (e.g., is not part of a blacklist), and / or request decryption of encrypted signaling messages or encrypted payloads in signaling messages. Contacting such an authentication server may include sending a message containing a copy of the signaling message or a subset of its contents (e.g., the public key), the identity of the network / cell from which the authentication server received the signaling message, and / or the identity of the device UE24, and / or the certificate of the device UE24.Alternatively, after receiving a signaling message (e.g., an invite / request / system information block) from the first correspondent network, the device UE 24 may use its current connection to its home network (e.g., via a nearby base station) or set up a new connection to its home network and send a message (e.g., an RRC or NAS message) to the home network with a copy / subset of the information received from the first correspondent network (e.g., through the signaling message) to request and / or be granted by the home network permission to connect with the first correspondent network. The home network may send a message to the device UE 24 to grant such request / permission and / or update the roaming steering information, the list of non-public network preference lists, and / or the policy information of the device UE 24 by adding the identity of the first correspondent network (e.g., to the roaming steering information or the non-public network preference list) to allow the device UE 24 to connect with the first correspondent network. The home network also deregisters the device UE 24 .

[0090] Signaling messages as described above are also received indirectly by the device UE 24 from the first responder network through the sidelink (e.g. via a ProSe UE-network relay providing signaling information during a connection setup as in TS 23.304, such as in the ProSe discovery information, and further including information about the emergency situation, such as PLMN identity information, and (e.g. via an emergency situation specific relay service code). Signaling messages are also received from the home network to which the device UE 24 is connected or from an access device operated by the home network, whereby the signaling messages include messages / information to request and / or authorize the device UE 24 to connect with the first responder network instead (e.g. via a roaming trigger or by sending a message to the device UE 24 to (temporarily) discard the roaming steering / configuration of the priority list of non-public networks). The home network may also trigger an update of the tracking area to trigger the device UE 24 to connect with the first responder network instead of the device UE's home network, and / or (temporarily) configure the device UE in a non-authorized / prohibited area such that the area (partially) covers the MCI area, and / or configure the access device to (temporarily) add the device UE 24 to the non-authorized / prohibited area. For this purpose, the first responder network provides the home network of the device UE 24 with information about the target geographical area (e.g., MCI area). This also allows the home network of the device UE 24 to only send a signaling message to the device UE 24 that is currently present in the target geographical area, for example. This signal or message is sent in a dedicated frequency band to indicate that it originates from the first responder network 200 and / or to indicate an emergency situation. Furthermore, the signal is sent in several different frequencies.For this purpose, the device B 22 receives information about the network configuration from the network controller device 20 so that it can set up a communication channel with the device UE 24. The network configuration information includes information for configuring the access device to invite or trigger / request the device UE 24 to connect to a specific slice / frequency of the network in the MCI area and / or can be used to authorize the access device. The network configuration information includes, for example, the authorization for the access device to invite or trigger / request wireless communication devices or additional access devices in the area to connect with the core network, network / slice specific settings (bands / frequencies, allowed devices, services offered, Restricted Local Operator Services (RLOS), steering / priority list for roaming non-public networks, emergency / non-emergency slice indication, etc.), certificates (e.g. private keys) required to authorize the first responder device UE 24. The operating band / frequency to be provided in the network configuration information is a special emergency band for MCI events or first responder networks. It can also be one or more common frequency bands supported by many UEs and / or well-known operators in the area. To determine whether a first responder network in an MCI area is authorized to transmit on a particular frequency, the first responder network must first scan the area for existing PLMNs operating in the area, identify their MCC / MNC codes, identify the nearest base stations and measure their signal strengths, and then connect with these PLMNs to request permission to transmit an invitation or connection trigger / request signal on one or more frequency bands operated by the PLMNs.If a particular band is not measured to be in use because the nearest base station is too far away and / or a particular PLMN is not active in the area or, for example, because a base station in the area is destroyed or has a very faint signal, the network controller provides the respective frequencies as part of the network configuration information and permits / authorizes the access device B 22 to use these frequency bands to transmit the invitation or connection trigger / request signal. The invitation to the device UE 24 can also be transmitted (through a Wi-Fi beacon or probe response message or, for example, an information element in a paging message from a non-3GPP interworking function to which the device UE 24 connects via a Wi-Fi access point) via an access device B 22 (e.g., a Wi-Fi access point) different from the access device B 22 (e.g., a cellular base station) to which the device UE 24 will connect with the first responder network.

[0091] Furthermore, the invitation is limited or targeted to a specific group of victims and their corresponding devices UE 24, grouped based on victim characteristics, including but not limited to movement, location, and injury severity. For this purpose, a location management service or other location estimation function (e.g., in device A 20 or device B 22) can detect UE movement based on observing the location of a set of devices UE 24 within the MCI area over a certain period of time. For example, a victim with severe leg injuries may not be able to move around the MCI area, meaning that the victim's device UE 24 is not moving for an extended period of time. On the other hand, a victim without injuries may be walking around the MCI area, meaning that the victim's device UE 24 is moving. The device B 22 of the first responder network scans the area to identify such characteristics of the devices UE 24 within the MCI area and groups them based on the victim's derived characteristics, e.g., moving and non-moving groups of devices UE. In general, the non-moving group of victims may require priority triage, since they are considered to be severely injured. Additionally, before assigning device UE 24 to such a cluster / group, device A 20 or device B 22 may exclude first responder devices from the cluster / group (e.g., by distinguishing first responder devices from other devices based on their registration details or capabilities) and exclude devices that belong to other clusters / groups (e.g., clusters of areas that group people, for example, directing victims or bystanders within a particular triage area).

[0092] Based on this clustering, device B22 initially sends invites or connection triggers / requests only to non-mobile devices UE24 within the MCI area, since it is highly certain that the victim of the corresponding non-mobile device UE24 is severely injured and requires immediate triage.

[0093] More generally, several devices UE24 are grouped into clusters based on the triage status of the tarp, the spatial location of the device UE24, and other characteristics of the devices in the cluster and / or the device UE at the center of the cluster, including but not limited to dimensions in the horizontal and vertical planes (e.g., size of the area or tarp), number of associated devices, location accuracy, location of the cluster and devices within the cluster, distance from the center of the cluster to the device UE24, etc. A cluster is typically represented by a set / group of devices that have a common set of characteristics (e.g., communication / device / user characteristics) and / or are within a certain bounded area or within a certain maximum distance from each other.

[0094] The characteristics for recognizing / forming a cluster are also (sets of) distinguishing features for a set of devices that are not available / applicable to other devices. For example, devices are clustered according to whether they are moving around (which indicates that the victim carrying the device is less seriously injured) or have not moved for a certain period of time (which indicates that the victim carrying the device is more seriously injured).

[0095] Alternatively, the devices 20 of the first responder network recognize the center of a cluster / group through their communication characteristics (e.g., high bandwidth, low latency, QoS requirements). Additionally, the devices 20 detect / infer devices that will belong to a particular cluster / group if all the devices have similar communication characteristics (e.g., same QoS, similar traffic patterns, operating within the same band or same slice or closed access group, supporting the same capabilities, or all connected to each other via D2D / sidelink communication or operating in similar (application controlled) group / multicast communication).

[0096] Such clusters / groups of devices can be recognized / formed at device A based on triage applications or information provided / collected by device A via device B or via a third party positioning server, for example, by a network analysis function (such as NWDAF) or according to ranging distances between multiple UEs and the cluster / group, or based on communication characteristics of devices within a particular cluster / group.

[0097] Device A sends information about a cluster / group of wireless communication devices to device B, and device B invites / trigger / requests each of these devices in such cluster / group to join the wireless communication network.

[0098] To this end, device B operates or is connected to a first apparatus for supporting the establishment of a wireless communication network (200), the apparatus comprising: - connecting to a network controller device A (20) of a wireless communication network (200) and providing wireless connections to wireless communication devices (24) within the target geographic area; - receiving information about a cluster / group of wireless communication devices (24) (or at least a subset of the cluster / group of wireless communication devices whose determined locations are within a target geographic region / coverage area), the information including (but not limited to) device identifiers, locations, and / or common characteristics of the wireless communication devices in the cluster / group; - receiving from a network controller device (20) information about a network configuration for setting up a communication channel with a wireless communication device (24); - inviting or triggering wireless communication devices (24) of a cluster / group of wireless communication devices to register or deregister via a communication channel or other communication channels with a core network operated by a network controller device (20); The present invention is configured to:

[0099] The device A20 (or another device in the first responder network) includes or interfaces with a second apparatus for determining clusters / groups of wireless communication devices in a wireless network (e.g., the first responder network 200), the apparatus receiving or learning at least one of resource usage data, location or distance measurement information, device characteristics, communication characteristics, measurement data, and user characteristics of a plurality of wireless communication devices (e.g., device UE24); assigning a minimum number of wireless communication devices to determine the clusters / groups of wireless communication devices; the distance between the wireless communication devices; the distance between the wireless communication device and an anchor device (e.g., device B22); the distance between the wireless communication device and the target geographic area or the location of the wireless communication device relative to the target geographic area; Communication pattern information; and Overlap in communication characteristics, device characteristics, and user characteristics Calculating at least one of: the calculated distances between at least a minimum number of the wireless communication devices are between a minimum distance measurement threshold and a maximum distance measurement threshold; the calculated distances between at least a minimum number of the wireless communication devices and the anchor device are between a minimum distance measurement threshold and a maximum distance measurement threshold; the calculated distances between at least a minimum number of the wireless communications devices and the target geographic area are between a minimum distance measurement threshold and a maximum distance measurement threshold; The communication patterns of at least a minimum number of wireless communication devices are the same, or whereby the time variation is between a minimum time variation threshold and a maximum time variation threshold; and The communication characteristics, device characteristics, and user characteristics of at least a minimum number of wireless communication devices are the same at least a minimum number of characteristics. determining a cluster / group of wireless communication devices based on at least one of:

[0100] The above-mentioned apparatus for supporting establishment of a wireless network or for determining clusters / groups of mobile devices in a wireless network may comprise the steps of: identifying mobile wireless devices (e.g., device UE 24) in a cluster / group; monitoring the location of the identified devices in the cluster / group to detect movement of the identified devices between different clusters / groups; and / or associating a cluster / group with the identified devices or monitoring at least one communication characteristic of the identified devices in the cluster / group to determine a change in the associated cluster / group of the identified devices; and / or - triggering deregistration of an identified device from a network or slice; - triggering a handover to a different access device or a connection to a device via a sidelink; - Assigning devices to different clusters / groups of devices; - sending different invitation messages to the devices; - Changing the QoS or adapting resource allocation for a device; - Changing the set of allowed slices for a device; - modifying communication parameters of the access device; - Triggering the sending of a message (e.g., via NEF, SMS) containing an alert that a particular victim or wireless communication device has been moved to a different tarp or out of the area (e.g., to a hospital). The actions are triggered when the identified device moves beyond a configured threshold distance from the center of the cluster / group or from another device in the cluster / group and / or moves below a configured threshold distance from the center of another cluster / group or other device. These actions are also triggered when the current access device (anchor node, e.g., device B22) cannot achieve the QoS of the devices in the cluster / group or in a particular target geographic region at its current location.

[0101] Any of the above devices, the first and second apparatus, and a set of wireless communication devices (e.g., device UE 24) form a system, where the wireless communication devices transmit at least one of resource usage data, location or distance measurement information, device characteristics, communication characteristics, measurement data, user characteristics to the second apparatus, and the first apparatus receives information about a cluster or group of wireless communication devices (24) and sets up communication channels with the wireless communication devices (24) and invites or triggers the wireless communication devices (24) of the cluster or group of wireless communication devices to register or deregister via the communication channel or other communication channel to a core network operated by the network controller device (20).

[0102] Upon registration, the unique identifier (e.g., 5G-GUTI) of the wireless communication device UE24 received by device B22 in the first responder network 200 can be used to derive / obtain subscriber information and device identifiers to authenticate the wireless communication device.

[0103] A robotic device, drone, vehicle, or other mobile device acting as an access device is configured to receive information from device A20 such that it can authenticate and / or identify itself as a first responder device and have the ability to locally perform corresponding core network functions (e.g., AMF / MME, AUSF, UDM / HSS) so that it can perform the task of locally performing network registration (e.g., for wireless communication devices within the coverage area of ​​the access device operated by the mobile device) if it goes out of coverage and loses connection to device A20. This approach is similar to having an external device (from another emergency department) tethered to device A20 to authenticate to the wireless communication device, rather than device A20 having to perform the authentication itself. The UDM / HSS operated by such a device includes only a (pre-registered) subset of subscribers available in the UDM / HSS of the first responder network and / or a (pre-registered) subset of subscribers authorized to register in the first responder network (e.g., through a roaming connection to a UDM / HSS operated by the wireless communication device's home PLMN).

[0104] As another or additional option that can be added to or implemented independently of any other embodiment, if the wireless communications device is not known to or pre-registered with the Unified Data Management Function (UDM) or Home Subscriber Server (HSS) of the first responder network 200, and is not known to or available to a home network with which the first responder network 200 has a roaming agreement, the first responder network 200 may authenticate the device and derive the device's identity and subscriber information by contacting an external device that is temporarily coupled to the first responder network 200 during the MCI event and running (a copy of) an AUSF / UDM / HSS of another network (e.g., from a first responder department in a neighboring region) and redirecting the authentication request to the external device.

[0105] In one example, a wireless communication device carried by personnel from a different region (e.g., a fire department in a neighboring region) may be considered an inbound roaming device to the first responder network 200. Typically, the visiting network may connect with the home network of the inbound roaming device to verify the membership and other information of the inbound roaming device. In the case of an MCI event involving a temporary non-public network, this may occur if the backend infrastructure is down. One of the devices (e.g., UE, mobile base station / drone, or specially dedicated device carried by personnel from different geographies) can connect (i.e., wirelessly or wireline) to a network controller and be coupled (e.g., with appropriate certificates, through SCEF / NEF, or through SBA framework) to the core network of device A20 of the first responder network 200 in order to (temporarily) assume the role of acting as an authenticator (e.g., Authentication Server Function (AUSF)) and subscription holder registry (e.g., UDM, HSS) for these inbound roaming devices. This device has duplicate versions of these components from its home network and / or contains a (pre-registered) subset of the subscribers available in the UDM / HSS of the respective home network (e.g., network for personnel from different geographies).

[0106] In other words, the device A20 incorporates or is connected to an apparatus for supporting the establishment of a wireless communication network (200), the apparatus comprising: - coupling an external device to a core network of the wireless communication network (200) via a limited range local connection and / or on-boarding the external device to enable the external device to act as an authenticator and / or subscriber registry for a set of wireless communication devices (24); The present invention is configured to:

[0107] For this purpose, the external device (operated / owned by a different operator or a different network) operates a built-in interface or protocol and / or enables the setup of a connection to the network controller device A20 via a local connection of limited range, and couples to another core network (in this case wireless communications network 200) enabling the external device to act as an authenticator and / or subscription rights holder registry for a set of wireless communications devices (24).

[0108] Such an external device and such a network controller device A20 incorporating or connected with an apparatus for supporting establishment of a wireless communications network are used in a wireless communications system comprising one or more wireless communications devices (24), an access device (22) connected with the network controller device (20), and such external devices, and the system is configured to perform device authentication of the wireless communications devices (24) via an interface between the network controller device (20) and the external device (operated / owned by a different operator or a different network).

[0109] This association is temporary in nature, all information related to the registered device (e.g., related to AUSF / UDM / UDR) is removed before unbinding, and specific security credentials are refreshed before binding to another network. Such coupling may be achieved by performing a mobile registration procedure via the access device (22) (EAP-AKA using a SIM-based certificate available to the external device), by the external device connecting to the network operated by the network controller device (20), or by initiating an unauthenticated emergency connection to the network operated by the network controller device (20), or by setting up a disaster roaming connection such as TS 23.501, or by setting up a connection to a Network Exposure Function (NEF) such as TS 23.501 of the network operated by the network controller device (20), or by setting up a Service Based Interface (SBI) connection such as TS 33.501 (e.g. between the AMF of the network operated by the network controller device 20 and the UDM / AUSF operated by the external device), and / or by providing the address of an AAA server to the network controller device (20) which configures its AUSF or Network Slice and SNPN Authentication and Authorization Function (NSSAAF) to use such external AAA server for authentication. To securely set up the association, the external device and network controller device 20 conduct a security handshake, for example using pre-shared / pre-configured certificates, or using emergency / disaster roaming certificates, or by providing / proving possession of a special key or certificate during association (e.g., digitally signed by a certificate authority for emergency personnel or by a government).

[0110] Additionally, first responder devices may be capable of supporting sidelink communications (e.g., ProSe D2D communications) and thus be able to set up ad-hoc / mesh type networks. In such a situation, it may be prudent to have a set of devices belonging to first responders in different specific geographical facilities or different first responder networks 200, which typically know each other and can form an ad-hoc / mesh type network, all join a distributed ledger, so that devices in this ledger can attest that an incoming roaming device belongs to a first responder facility in this same network / region.

[0111] Alternatively or additionally, the devices may each run a group application such that each device of a particular group has the same core group key by which each of these devices can check whether another device (i.e., an inbound roaming device to the first responder network 200) belongs to this same group by verifying whether an ephemeral key, hash / nonce, authentication code, signature, or other data was signed with a key derived from this group key. As a result, such a group of devices (i.e., such a group of devices having the same group key or running the same distributed ledger) can be added to the first responder network 200 all at once, or alternatively, if one device of a group of devices (from a first responder department / network in a different region) is properly authenticated, authorized, and registered with the network, this device can act as an authenticator for other devices from the same group that are seeking to register. This one single registered device must first perform some additional authentication, authorization, and verification steps, for example, by having a special key or certificate (e.g., digitally signed by a certificate authority on behalf of the emergency personnel) during registration to prove that the wireless communication device belongs to the first responder.

[0112] Alternatively or additionally, the first responder network performs additional verification checks based on the capabilities of the wireless communications device, for example, by checking whether the wireless communications device has certain inherent capabilities common to first responder devices (such as support for Band 14 (Firstnet), high power operation, ProSe relay support, etc.) that are typically not the case for typical consumer devices.

[0113] Alternatively, the first responder network 200 contacts a third party portal trusted by the network (e.g. an identity server run by the government, the GSMA, or another organization) that can securely process user and device data.

[0114] The device and user information obtained from the User Data Resolution Server is used to register the device or securely provide network credentials (e.g., Subscriber Identity Module (SIM) profile) to the first responder network 200 via a remote provisioning platform (e.g., as described in the GSMA SGP.21-RSP architecture). Communication between the first responder network 200 and the remote provisioning platform is only established if the first responder network 200 can prove its integrity with a root of trust (e.g., GSMA Root of Trust) established with a network operator recognized trusted platform.

[0115] Moreover, the invitation or connection trigger / request includes information about the cause of the emergency establishment in the invitation or connection trigger / request signal / message sent to the device UE 24. The information is provided in a special or dedicated information element (IE) or in the preamble part of the invitation or connection trigger / request message.

[0116] To achieve the required communication links, device B 22 supports, inter alia, a single-hop relay link 22S and / or a multi-hop relay link 22M to device UE 24 and / or a base station relay link 22R.

[0117] The target geographical area may be focused on triage specific areas (e.g. areas with the most injured people, areas with few seriously injured people, etc.) or linked to a set of spatial formation requirements for identifying cluster formation (e.g. when multiple devices UE24 are within a configurable radius around a specified relative coordinate, a specified device UE24, a center of gravity, a reference line, etc.). In one example, information about potential target areas (e.g. high concentration of potentially injured people) can be provided by one or more devices B22, e.g. via a network exposure function (NEF) and an application function (AF), or by a separate device. In another example, a LiDAR camera is used to find the heat signature of mobile phones and / or people, thus identifying the location of (clusters of) devices. Additionally, victim / injured triage specific areas are identified by triage tarps of different colors (e.g. each indicating the severity of the injury). The location (and color) of these tarps is determined via cameras or other color detectors operated on a drone or other access device (e.g., a mobile base station), cameras on ambulances or fire engines, or security cameras available on-site, or provided by first responders to a network (e.g., via the NEF or directly via a data connection with the SLAM function). As another or additional option that can be added to or implemented independently of any other embodiment, the tarp can be provided with a wireless device (possibly including a GPS module) that can register with the network to enable automatic determination of its location. In that capacity, or through matching the identity of the wireless device, the color of its corners and its size / shape / metric / relative position can be determined. Alternatively, the tarp can be equipped with a location indicator (e.g., a Bluetooth iBeacon®) that broadcasts its location, size, etc.

[0118] As another or additional option that can be added to or implemented independently of any other embodiment, the tarp can be digitally recreated by device B or any device capable and connected or not connected to the first responder network in the MCI area such that the boundaries and dimensions of the tarp are depicted with visible optical markers (e.g., using a laser projector). Depending on the number of victims physically present within the digital tarp, the dimensions of the tarp can be increased or decreased automatically by device A 20 of the first responder network or via a third party service. Additionally, if a physical tarp is placed such that the boundaries of the tarps overlap each other, the actual ranging distance of device UE 24 present at the center of the tarp can be reduced by the device directly or via device B or via a third party ranging service. First responders operating from locations remote from the MCI area can digitally recreate the MCI area with tarps, devices, the MCI environment, and characteristics including but not limited to the locations, communication patterns, and movements of first responders, victims, and bystanders based on information acquired by the devices UE24 of each of the first responders physically present within the MCI area. First responders in such remote locations also monitor the health of the victim through intense patient monitoring connected directly to the victim or shared among multiple victims depending on the severity of the injury and the triage status of the victim.

[0119] Additionally, first responders in MCI areas can be assisted with drones or robotic devices capable of performing tasks including, but not limited to, transporting victims, medications, and / or tools to tarps or designated locations in and around the MCI area, beacons for a variety of functions including, but not limited to, road conductors or road finders for first responders, victims, and bystanders, cluster formation, victim identification and tracking, asset positioning, medication delivery. In one example, such beacon drones can assist first responders in moving victims to a specific tarp based on relative positioning between different tarp locations when there are multiple tarps in the vicinity.

[0120] Additionally, if an emergency or restricted local operator service (RLOS) connection is mandated by the home PLMN of the device UE 24 or by national regulations for mobile networks in an MCI area, an initial connection to the first responder network 200 with limited service access can be established with the device UE 24 (e.g., as specified in the service continuity provisions in 3GPP® TS 22.011 Service Accessibility). The device 20 is configured with special privileges to update or abort the PLMN selection procedure to enable roaming of the device UE 24 within the first responder network 200 (e.g., as specified in the roaming steering information in 3GPP® TS 22.011 Service Accessibility), or similarly to update a priority list of preferred non-public networks, as in TS 23.501. The device UE24 is currently connected to the first responder network 200 as a roaming device after successfully completing a roaming authentication procedure (e.g., as specified under Service Access Privileges in 3GPP TS33.501 Security Architecture and Procedures for 5G Systems), based on a special cooperation between an emergency or RLOS operator and the mobile operator of the device UE24, or a national regulation to identify, authorize, and permit the device A20 of the first responder network 200 to establish restricted services with the device UE24 in an MCI location.This can be indicated (e.g., by including a unique certificate or key identifier of a pre-configured key, or by including a securely signed information element in the system information (e.g., as described in TR33.809) or securely signed system information) such that a key for the emergency / MCI event (e.g., a pre-configured pre-shared key in the device UE 24) is used, and / or a key provided by the first responder organization or government using a digitally signed certificate, or a key derived from one of such keys / certificates in one of the network broadcast information blocks (e.g., a System Information Block (SIB) as specified in the 3GPP TS38.331 Radio Resource Control (RRC) Protocol Specification) of the first responder network 200 is used while sending implicit and explicit invites or connection triggers / requests to the device UE 24 in the MCI location.

[0121] Once the wireless communication devices of first responders and victims in an MCI area are connected with the first responder network 200, the connection can be readily used to communicate relationship information between first responder personnel and (groups of) victims to, for example, keep them informed of what has happened, provide instructions on what to do next, or allow a victim to state that they are beginning to feel unwell. To do this, the first responder can remotely configure and control (e.g., by using the device 20, or the access device 22, or a first responder UE connected to a first responder network operated by / accessible through the device 20 and / or the access device 22) a victim's device UE 24, or a group of devices UE 24, belonging to a particular class of victims (e.g., seriously injured, slightly injured) so that an audio / video / data call is automatically answered from or initiated to a particular device UE 24 of the first responder, for example, by calling a special number related to the telephone number of the device UE 24, or by sending a USIM application / service command or a (secret) dialing code to the device UE 24, or by sending a public alert signal or broadcast message or an SMS with a special code (e.g., via a multicast / broadcast service framework), by sending an emergency instruction (and / or emergency certificate) during the call setup to the device UE 24, especially when the victim is unable to operate the device UE 24 manually. Alternatively, the device UE can be configured to answer all incoming audio / video / data calls initiated by the first responder and bar all other calls for a prescribed period of time.Alternatively, if device UE 24 supports push-to-talk functionality, the message may be transmitted over one or more frequencies or by transmitting one or more messages supported by one or more push-to-talk systems (e.g., Mission Critical Push-to-Talk as defined in 3GPP TS 24.379).

[0122] Alternatively, the first responder may use the device 20, or the access device 22, or a first responder UE connected to a first responder network operated by / accessible through the device 20 and / or the access device 22 to set up a sidelink / PC5 to a ProSe application / service provided by the device UE 24 for such purposes (e.g., a ProSe application / service enabling the establishment of a connection to the device UE 24 that is automatically accepted (without showing any pop-up / user confirmation dialog) and / or a ProSe application / service for configuring the device by sending a configuration message (e.g., to override some restrictions / policies or to prevent notification pop-ups on the device UE 24 that need to be approved through a user action) and / or a ProSe application / service for retrieving the location of the device and / or a ProSe application for requesting the device UE 24 to set up a connection to the first responder network). For example, this is achieved by using PC5 direct communication as specified in TS 23.304 between the device 20, access device 22, or first responder UE and the device UE 24 for this particular application / service (e.g., ProSe configuration service or ProSe emergency service).

[0123] In one example, the device UE 24 is configured with a special permission to revoke / reconfigure other permissions / restrictions / policies or to prevent pop-ups, possibly together with a password, key, or other credential that needs to be provided to the device (e.g., through one of the above-mentioned methods for establishing a connection and / or after such a connection is established) to confirm / enable / allow such special permission. Alternatively, the device UE 24 is configured with a password, key, or other credential that can revoke / reconfigure a set of permissions / restrictions / policies. In another example, the user of the device UE 24 has also pre-agreed to a permission to revoke / reconfigure other permissions / restrictions / policies or to prevent pop-ups under certain conditions (such as emergency / MCI events) by storing consent to such special permission in, for example, a Unified Data Manager (UDM), Unified Data Repository (UDR), or Home Subscriber Server (HSS) of the home network of the device UE 24. The first responder, using device 20, or access device 22, or first responder UE, may request information that allows it to verify if such special permissions have been granted or are valid, or to confirm that such special permissions have been granted or are valid, or to be authorized to access such permissions, or to be authorized to connect with device UE 24 based on such permissions, or to allow device UE 24 to connect to / through the first responder network, access device, or first responder UE.Such a request for information, validation or authority may be made, for example, during connection setup with the device UE 24 or when the device UE 24 registers / registers a connection with the first responder network, access device or first responder UE by connecting with the respective Unified Data Manager (UDM), Unified Data Repository (UDR), Home Subscriber Server (HSS), for example, through a roaming connection (e.g., between the AMF of the first responder network and the UDM in the home network of the device UE 24) or through a connection with a Public Safety Answering Point (PSAP). During setup, the PSAP has access to the respective permission data or is capable of revoking / granting the respective permissions on behalf of or in cooperation with the home network of the device UE 24, or the PSAP allows the first responder network to set up a connection with the home network of the device UE 24 (e.g., to connect with its UDM) via the PSAP, whereby the PSAP acts as a relay / bridge between the two networks to allow the exchange of information. In another scenario, additional information about the user of the device UE 24 (e.g., the name, phone number, emergency contact number of the subscriber of the subscription linked to the device UE 24) is retrieved from the UDM / UDR / HSS.Using the phone number and / or emergency contact information (added to the information in the UDM / UDR / HSS or listed as an emergency contact on the respective device UE 24's SIM card, non-volatile storage, or wearable connected to the device UE 24), the first responder network (or the home network of the device UE 24, or the PSAP) can send a request / notification to the device UE 24 or device linked to the emergency contact phone number to "unlock" the device and discard certain permission / policy settings of the device UE 24 (such as location privacy indicator settings), or to discard a security lock on the device UE 24 or SIM card, or to accept an incoming invitation (e.g. to connect with the first responder network), a connection request (e.g. to retrieve information about the device such as the device's location), a location estimation request, a user identification request, or to retrieve the SIM profile, or to grant authorization to perform these actions on behalf of the injured person. Such an invitation may be, for example, an SMS message containing a specific keyword or character code / combination or identity information, originating from a pre-configured phone number (e.g., operated by a government agency, such as a PSAP), including identity information of a first responder network, and including some emergency credentials.After confirming the request / notification to "unlock" device UE24 (e.g., by responding to the message and / or by providing a certificate to unlock the device (e.g., in a response message) and / or by the receiving device sending a message (e.g., an SMS message) to device UE24 having a specific keyword or character code / combination or identity information and originating from a pre-configured phone number, such as the phone number of one of the emergency contacts stored on the device UE's SIM card, non-volatile storage, or a wearable device connected to device UE24), the first responder network is authorized to access information of device UE24, such as the location of device UE24, and / or device UE24 initiates a connection setup to the first responder network. Additionally or alternatively, when device UE24 receives a notification to “unlock” the device and / or receives a specific message (e.g., an SMS containing a specific keyword or character code / combination or identity information and coming from a pre-configured phone number (e.g., operated by a government agency, such as a PSAP), device UE24 may retrieve a list of emergency contacts (e.g., a set of phone numbers) from device UE's SIM card, non-volatile storage, or a wearable connected to device UE24, and automatically send a message (e.g., SMS) to these emergency contact phone numbers containing a request / notification to “unlock” device UE24.

[0124] The device A20 stores information about the identified victims and also the devices associated with these victims (e.g. information about mobile phones, wearable monitoring devices along with the victim's identifier, phone number, personal data, emergency contacts, severity of the victim's injury, triage color, received electronic patient records, current location of the victim, etc.) in a database, allowing easy filtering, providing an overview of all victims with a particular severity, and facilitating contacting victims as a group or individually.

[0125] The one or more devices UE 24 comprise a subscriber identity module 242 (e.g., a subscriber identity module (SIM) card or a universal integrated circuit card (UICC) including a universal mobile telecommunications system (UMTS) SIM (USIM) card) associated with a mobile operator subscription, a radio module 244 for wireless communication, and at least one user application (app) 246. The devices UE 24 are configured to support a sidelink communication link 24SL therebetween.

[0126] As an additional option, if the device UE24 is still connected to an existing PLMN operating within the same MCI area, the first responder network 200 (e.g., device A20) may send a message (e.g., via a data connection) via an application server (e.g., on the Internet or operated by the home PLMN) to a specific emergency application running on the device UE24 that enables the device UE24 to set up an emergency call (or RLOS) connection to the first responder network 200, either directly or routed via the home PLMN, and / or provide location information to the first responder network 200 via the home PLMN.

[0127] The device A20 is configured to receive device identity information from one or more devices UE24 and determine a user identity associated with the device identity of the device UE24, e.g., based on mobile operator subscription information, or possibly by user identity information (e.g., digitally signed identity card, name / email / contact address, fingerprint scan) provided by the device UE24 in addition to the device identity information (e.g., during registration or through a subsequent PDU session). As mentioned above, information about the user identity may also be requested from or provided by the home network of the device UE24, e.g., when the device UE24 registers with the first responder network, which causes the first responder network to request the home PLMN of the device UE24 to provide user identity related information (e.g., subscription information, subscription holder's name, phone number, emergency contacts) and / or location information of the device UE24. For this purpose, the first responder network needs to provide an emergency certificate (e.g., a digital certificate signed by a first responder authority or government) by means of which the first responder network can prove to the home PLMN of the device UE 24 that it is involved in an emergency and that it is important to provide device identity information of the device UE 24 (e.g., based on the SUCI provided by the responder network to the home PLMN, which in return provides user identity or location information about the device UE 24). Alternatively, the first responder network requests information about the user identity related information and / or location information of the device UE 24 via the NEF of the home network of the home PLMN. Similarly, the first responder network needs to provide an emergency certificate to be able to make such a request and to exchange the user identity or location information securely through the NEF.Optionally, at least some of the devices UE 24 (e.g., identified and pre-connected to a default network connection, but not tailored to a particular first responder's network settings) are not distributed to the first responder when the first responder arrives in the MCI area. Thus, there is no mapping to a particular person in the mobile operator's subscription database. In such a case, the device UE 24 can be manually linked to the first responder by retrieving details of the FRDB 28 via the device A 20, by securely and confidentially entering user information into the device UE 24 (e.g., manually scanning a government-issued first responder ID card, or scanning biometrics including, but not limited to, face, fingerprint, and iris data). The information retrieved from the FRDB 28 can be used by the device A 20 to tailor the device UE 24 to a particular first responder according to the role of the particular first responder in the MCI area. Provisioning of the network settings is done using a UE Configuration Update or UE Parameter Update procedure, or by using a remote provisioning server (e.g., as specified in the Route Discovery Service specified in the GSMA-SGP.22 RSP technical specification).

[0128] Alternatively, the fully connected and mated device UE24 of first responder A can securely retrieve and download the network configuration and settings (e.g., Subscriber Information Module SIM profile) of first responder B to the disconnected and unmated UE24 via an out-of-band channel (e.g., NFC or peer-to-peer Wi-Fi, Bluetooth connection) by identifying first responder B at a communicatively linked FRDB server based on user identity information securely and privately collected at first responder A's device UE24.

[0129] The first responder network 200 is thus established by devices A20, B22, and UE24 (e.g., as described in 3GPP® specifications as 2G / 3G / 4G or 5G networks, including but not limited to non-3GPP® access of unlicensed wireless spectrum, such as Wi-Fi, Bluetooth, Industrial, Scientific, and Medical (ISM) bands, or the like). The infrastructure of the first responder network 200 follows the specifications of the corresponding technology in which the network chooses to operate its devices A20, B22, and UE24.

[0130] Additionally, all devices UE 24 deployed by first responders within the first responder network 200 are typically capable of operating in one of the ISM bands, while deployment of private mobile user devices (i.e., BYOD (“bring your own device”) user devices) within an MCI area is limited to the radio technology available on the user device.

[0131] Thus, the proposed first responder network 200 allows for automatic identification and registration (on-boarding) of first responder pre-registered devices UE 24 (e.g., cellular devices) from the network side (i.e., device A 20) to the first responder network available within the MCI area. Furthermore, deployed devices UE 24 can be blocked from connecting with public networks during MCI events and unauthorized devices can be blocked from registering with the first responder network 200. When pre-registered, devices UE 24 can be pre-provisioned with necessary configuration steering of roaming information, or similarly with a preferred list and certificate of preferred non-public networks, to facilitate registration with the first responder network 200.

[0132] Additionally, the proposed first responder network 200 allows for automatic registration of unregistered devices either directly by validating an identity linked to a user (e.g., through a cellular device platform such as the Global System for Mobile Communications Association (GSMA) IMEI platform) or via network-side pre-registration of the first responder device in the deployed infrastructure (e.g., the core network's FRDB 28). In cases where certificates are not required, the first responder network 200 may provide some sort of emergency or RLOS connectivity in lieu of fully registering and authenticating unregistered devices.

[0133] As mentioned above, wireless communication devices carried by personnel from a different region (e.g., a fire department in a neighboring region) may be considered inbound roaming devices, or the first responder devices may be capable of supporting sidelink communications and thus an ad-hoc / mesh type network may be set up, or the wireless communication devices may each be capable of running a group application and thus may be added all at once to the first responder network 200, or one of a group of devices may act as an authenticator for other devices from the same group attempting to register, or additional validation checks may be added based on the capabilities of the wireless communication devices.

[0134] Additionally, the proposed first responder network 200 (e.g., device A20) allows automatic authorization and registration of base station devices (e.g., device B22) from various emergency services (e.g., fire department, health department, and police department) and other public and non-public network operators. The base station devices may also be IAB devices (e.g., as specified in TS38.174 Integrated Access and Backhaul Radio Transmission and Reception), in which case the first responder network access device B22 may act as an IAB donor to initiate a first wireless link establishment with the IAB device (e.g., via S1 / NG interface security and integrity protected by IPSec using a hardware root of trust within the IAB device). Additionally, the IAB device may be equipped with the id, private / public key pair, and manufacturer certificate necessary to establish a link (e.g., an X2 / Xn link) between device A20 in the first responder network 200 and device B22 via a special service (e.g., an X2AP global procedure, as specified in 3GPP TS36.423 X2 Application Protocol (X2AP)).

[0135] Moreover, the proposed first responder network 200 (eg, device A 20 ) allows for automatic retrieval of capabilities of a base station device (eg, device B 22 ) that is to be registered with the first responder network 200 .

[0136] Additionally, the proposed first responder network 200 (e.g., device A20) enables automatic retrieval of identity information (e.g., 5G_GUTI as specified in 3GPP® TS33.501 Security Architecture and Procedures for 5G Systems) of device UE24 (e.g., wearable device) belonging to the injured person during the initial radio setup phase. Functions (e.g., Access and Mobility Functions (AMF) as specified in 3GPP® TS23.501 System Architecture for 5G Systems) in device A20 of the first responder network 200 can be communicatively coupled to similar functions in the home PLMN (of device UE24) to securely retrieve the user context (e.g., subscriber information) of device UE24 and the device identity (e.g., IMEI) of device UE24. The injured person can be identified by matching the device ID to user information stored in a common cellular device platform (e.g. GSMA IMEI platform) or by different network operators of the involved device UE 24 or by government authorities. The AMF of the first responder network 200 can be communicatively coupled to the AMF / UDM / HSS of the home network (of the device UE 24) to derive / transfer the context of the device UE 24 (i.e. to provide such context information to the first responder network 200), including the Permanent Equipment Identifier (PEI), which in 5G / 3GPP is the IMEI.

[0137] In one example, wearable monitoring devices are provided to the victim by the first responder. These monitoring devices are already pre-configured for the first responder network 200 and attach automatically. Yet, these monitoring devices are not yet linked to a specific person (or only to a temporary / anonymous person identifier, e.g., John Doe1). In this case, some automatic identity matching with the closest nearby mobile phone or other wireless communication device can be done, for example, by measuring the distance between the monitoring device and the mobile phone, or by measuring the distance between the first responder's wireless communication device and the mobile phone (whereby the first responder's mobile phone is used to link the two devices together). If the mobile phone is registered and the victim's identity can be determined (e.g., using one of the mechanisms described above), it is also clear to which person the output of the monitoring device belongs. Alternatively or additionally, a photograph of the victim or casualty can be uploaded (e.g., to the monitoring device, the first responder's mobile phone, and / or the network) to link the monitoring device to a particular casualty or victim. The color of the triage tarp or label provided to the victim can also be uploaded to indicate the severity of the patient's injuries. This information (e.g., color of triage label) and / or the location of the device can be broadcast periodically to allow easy tracking of the casualty. Alternatively, a copy of the casualty or casualty's emergency information (e.g., stored locally on the mobile phone or electronic health report (EHR) identity) in the mobile phone can be read by near field communication (NFC) or provided aloud or visually to the first responder's monitoring device or mobile phone, which can then upload this information to the network.It should be noted that NFC in the monitoring device or first responder mobile device can also be used to provide network credentials to the victim's mobile phone to enable the victim's mobile phone to connect with the first responder network 200.

[0138] Additionally, if a person is moved to a different triage area (e.g., if their condition becomes more severe), the person's wireless communication device (e.g., mobile phone or wearable monitor or location tag) is updated to broadcast a different color. The person's move is also detected by the drone or access device camera or through location services (i.e., if the victim's location now points to a different geographic area, e.g., covered by a tarp of a different color). The wireless communication device is re-invited or triggered / requested to connect with the first responder network 200 and requested or updated to attach to a different slice (e.g., if more resources are needed for monitoring devices for a more severe patient or if additional monitoring devices need to be attached to the victim, e.g., a 12-lead ECG).

[0139] FIG. 3 illustrates a schematic block diagram of a network controller device (i.e., device A) in accordance with various embodiments.

[0140] Device A is installed in the first arriving emergency vehicle (e.g., medical care vehicle, fire engine, unmanned aerial vehicle (UAV)) of the first responder to an MCI event and includes a power supply (PS) unit 34 connected to the emergency vehicle's uninterrupted power supply.

[0141] Device A further comprises a transceiver (TRX) 31 for wireless transmission and reception to and from the first responder network 200, and at least one controller (RAN CTRL) 32 configured to provide a network controller function 202 of Figure 2 and provide a Radio Access Network (RAN) capability, e.g. equivalent to a base station of a cellular network. The controller 32 is configured to set up integrity protected secure communication channels for communication coupling to device B, device UE, a central identity server, a first responder database, and other services external to the described system, providing an identity service function 204 of Figure 2.

[0142] Additionally, device A further comprises a backhaul communication module 35, which is likely a base station device or other network access device coupled with the functionality of a core network, providing a direct satellite link as a backhaul communication for enabling Internet access and a data path to a backbone network. Other means of backhaul communication, such as optical wireless communication (OWC), may additionally or alternatively be deployed in device A. In one example, device A may be configured to provide a standalone end-to-end wireless system (e.g., a cellular network with the necessary hardware and software for base stations, a core network, and a backhaul network for providing Internet and data paths) over an off-the-grid connection (e.g., deployed as a small cell system with a non-public network) or an existing telecommunications grid (e.g., deployed with an existing Mobile Network Operator (MNO) backbone). Additionally, device A includes a simultaneous localization and mapping (SLAM) module 33 (corresponding to SLAM function 206 of FIG. 2) having sensors and computer systems (e.g., Radar, Lidar subsystems, etc.) for determining MCI areas and determining the number and type of devices to be deployed within the MCI areas.

[0143] 4 illustrates a schematic block diagram of an access device (i.e., device B) according to various embodiments, which may be an unmanned robotic device, including but not limited to drones and rovers, or an access device mounted on, for example, an ambulance.

[0144] Device B comprises a transceiver (TRX) 31 for wireless transmission and reception to and from the first responder network (e.g., functioning as a gNB or Wi-Fi access point) and comprises a relay function (RLF) 42 providing relay node capabilities (e.g., as described in 3GPP® TS24.334 V16.0.0 (2020-07): “Technical Specification Group Core Network and Terminals; Proximity-services (ProSe) User Equipment (UE) to ProSe function protocol aspects”) or as described in 3GPP® TS38.174 V16.3.0: “Technical Specification Group Radio Access Network; NR Integrated access and backhaul radio transmission and reception”) controllable by device A at a specific location limited to the MCI area.

[0145] Additionally, device B comprises a controller (CTRL) 43 configured to provide capabilities for accessing the wireless first responder network provided by device A. Controller 43 is further configured to set up an integrity protected secure communication channel for communicatively coupling to device A and device UE.

[0146] Additionally, device B is also equipped with an exclusive wireless system (XWS) 44 (e.g., Wi-Fi, Bluetooth, LoRa, etc.) in addition to the wireless access capabilities necessary to access the first responder network provided by device A. In one example, the exclusive wireless system 44 can be used for separate sidelink communication links both from device B to device A and between devices B, as well as to enable more accurate positioning (e.g., by further transmitting signals from these other wireless access capabilities to a hybrid positioning module in the location services operated by network 200).

[0147] FIG. 5 illustrates a schematic flow diagram of a first responder network deployment procedure (eg, at device A) according to various embodiments.

[0148] Upon first initiation of device A in an MCI area, a predefined number of devices B (and / or other devices, such as drones dedicated to the task of mapping, that do not provide cellular access) are deployed in the field (step S510) to survey and map the MCI area and to calculate the severity and scale of the MCI area, for example in the SLAM module 33 of FIG. 3. In step S520, the deployed device B, communicatively coupled to the device via a wireless link, updates the measurement parameters of device B (e.g., total area in square meters, structural anchor points, number of victims, etc.) to a local SLAM service deployed on device A or on a cloud communicatively coupled via device A and controlled by the SLAM function 206 of FIG. 2 or the SLAM module 33 of FIG. 3. In step S530, the SLAM service, with or without human supervision, predicts the total number of devices B needed in the field to completely cover the MCI area and their locations. The procedure in step S530 is supported by using machine learning models.

[0149] Based on the results of the SLAM service, device B is deployed or removed from the field based on a predicted estimate of the number of first responders required to handle a particular MCI event.

[0150] More specifically, in step S530, the SLAM service estimates landmarks of a given geographical area based on sensor measurements obtained from sensors of the device B22 and / or other devices dedicated to the task of mapping. A landmark is a uniquely identifiable surface / object whose properties are estimated by sensors. For example, a concrete wall of a high-rise building can be a landmark. The dimensional and refractive properties of such a landmark can be estimated, for example, by using laser scanners or other optical measurement devices present in at least some of the deployed device B22 and / or other devices dedicated to the task of mapping.

[0151] The SLAM service in device A20 builds a virtual 3D map of the MCI area using sensor data obtained from sensors of device B22 and / or other devices dedicated to the task of mapping, while determining landmark boundaries using sensors of device B22 and / or other devices dedicated to the task of mapping.

[0152] In addition to location and mapping measurements, the wireless radio provided on device B22 simultaneously measures wireless link quality parameters (including but not limited to received signal strength, channel state information, reference signal received power) of wireless signals between device A20 and device B22 at their current locations, and between device B22 and device UE24 attached to device B22 covering the MCI area (and its location). The SLAM service or other network functionality (such as NWDAF) on device A20 receives this wireless link quality information from each of device B22 at a configurable sampling rate to determine wireless signal white spots within the target geographic area.

[0153] The sensor measurements and wireless link quality parameters between device A20 and device B22 and / or other measurement devices can be used to predict an accurate location for the placement of access points (i.e., device B22) so as to ensure sufficient and reliable coverage of the wireless system of the first responder network 200. Based on this accurate prediction of the placement of device B, device A20 deploys additional access devices B22 and / or relay devices to enhance coverage in white spot areas of the wireless link between device A20 and device UE24 in the field. If there is a redundant device B22 in a location with good link quality, such redundant device B22 can be removed (e.g., taken out of the location).

[0154] In MCI areas, the environment may change dynamically due to the disastrous nature of the event. Large buildings may collapse into rubble, and large debris may fill open spaces. New metallic debris in open spaces may change the environment to both more and less favorable conditions for wireless communication. In such a constantly changing environment, the SLAM service will receive continuous measurement parameters from the sensors and wireless radios of the device B22 and / or other devices dedicated to the task of mapping, during the entire duration of the triage process in the MCI area, to update the SLAM service and ensure a reliable and sufficient coverage for wireless connections.

[0155] Alternatively, the SLAM service can use an existing map (e.g., OpenStreetMap) of the target geographic area as a starting point for determining the number of devices B22 and update the existing map with measurement data obtained from the devices B22 and / or other devices dedicated to the task of mapping. Machine learning models can be used to predict both small environmental changes (e.g., collapsed compound walls) and large environmental changes (e.g., collapsed multi-storey buildings) based on the sensor data and to determine anchor points (devices B22 and / or other devices dedicated to the task of mapping) based on new landmarks obtained from the SLAM service.

[0156] Alternatively, when no large landmarks are present in the MCI area (e.g., a plane crash in a grass field with no buildings), wireless link quality measurements can be used as an indication of or as a function of distance between device B22 and device A20. In one example, sensors on device B22 can be used for a coarse distance estimate between device A20 and device B22, and wireless link quality is mapped as a function of distance between device A20 and device B22.

[0157] Finally, in step S540, device A20 registers the device UE24 detected and invited or triggered / requested by device B22 to connect with the first responder network 200, e.g., if the detected device UE24 is a predefined / pre-registered first responder wireless communications device. To accomplish this, device A20 uses the device identity information received from the detected device UE24 to determine a user identity associated with the received device identity information of the detected device UE24 and checks whether the user is a registered first responder or whether the detected device UE24 is a registered first responder device. Alternatively, as described above, wireless communication devices carried by personnel from a different region (e.g., a fire department in a neighboring region) may be considered inbound roaming devices, or the first responder devices may be capable of supporting sidelink communications and thus an ad-hoc / mesh type network may be set up, or the wireless communication devices may each be capable of running a group application and thus may be added all at once to the first responder network 200, or one of a group of devices may act as an authenticator for other devices from the same group attempting to register, or additional validation checks may be added based on the capabilities of the wireless communication devices.

[0158] Additionally, device B 22 is used to detect signals of victim's or casualty's devices UE 24 (eg, mobile phones) (eg, under the rubble).

[0159] FIG. 6 illustrates generally a flow diagram of a first responder network location and mapping procedure (eg, at device B) according to various embodiments.

[0160] In step S610, device B is deployed in the target field of the MCI area based on the initial determination of device A. Then, in step S620, the deployed device B performs measurements to derive measurement parameters (e.g., for total area in square meters, structural anchor points, number of victims, etc.) within the target field of the MCI area.

[0161] Then, in step S630, the acquired or updated measurement parameters are transmitted to device A. Furthermore, deployed device B invites or triggers / requests device UE in the target field to register with the core network operated by device A.

[0162] In optional step S640, a deployed device B communicatively coupled to device A may be controlled by the device to function as a relay base station (e.g., as described in 3GPP® TS 36.216 “Evolved Universal Terrestrial Radio Access (E-UTRA); Physical layer for relaying operation” or in 3GPP® TS 38.174 “Integrated Access and Backhaul (IAB) radio transmission and reception”), which may relay messages received from device UE (e.g., extract data from the received signal, apply noise correction techniques, and retransmit a new “clean” signal within its own coverage zone) so that the device’s signal coverage can be extended to the entire field of the MCI area without overloading the resources of device A.

[0163] Device B may be configured to automatically switch on or off its relay functionality, for example by constantly monitoring the load capacity of first responder network 200, and to optimize the network topology in cooperation with device A.

[0164] Alternatively, an authorized network controller (automated software function or human) may interact with device A (e.g., as specified in 3GPP TS 29.522: “Network Exposure Function Northbound APIs”) to manually tear down the network topology and alternately replace the relay function of device B.

[0165] Then, in an optional subsequent step (not shown in FIG. 6), the first responder network (e.g., operated by device A) performs device identification, user identification, positioning, device counting, provision of emergency communication services, or other operations for / on behalf of the device UE registered with the first responder network (through device B).

[0166] In one example, to identify a particular first responder as a user UE of the device, a user A, who is likely to be a pre-registered first responder, arrives in an MCI area with a device UE, which has a device identity (devID) and an IMSI linked to the particular user in a centralized server (e.g., as specified in the Route Discovery Service specified in the GSMA-SGP.22 RSP technical specification). This centralized server is communicatively coupled to a first responder database (see FRDB 28 in FIG. 2 ), such that upon identifying the device identity and IMSI of the device UE at the device A, the IMSI can be used to verify the first responder in the first responder database, for example, by biometric identity information including, but not limited to, the user's face, fingerprint, and / or iris data captured at the device UE.

[0167] Alternatively, a personal identification number (PIN) code can be used to identify the user in the first responder database. In yet another alternative, after verification of the registration of the device UE with the first responder, a user interface (UI) prompt is triggered at the device UE by the first responder database to identify the user via their own choice of verification method. Upon successful identification of the user and device UE, device A can automatically register (onboard) the device UE in the first responder network.

[0168] Yet another alternative for identifying a user on the device may be to use a government-issued radio frequency ID card (eg, an NFC-based first responder ID) on the device.

[0169] Alternatively, device A may limit device UE to ignore other mobile network operators in the MCI area and be strictly connected only to services provided by the device for a period of time pre-determined for a particular MCI event or set by the SLAM service on the device when surveying the MCI area.

[0170] In yet another example, after initiation of the first responder network in device A, first responder A can register (onboard) an unregistered device UE of another first responder B registered in the first responder database by first self-registering itself to the first responder network via device A and authorizing the device UE of first responder B to register for the network services provided by device A. The device identification (devID) of the device UE of first responder A is then captured in the first responder database along with the registration details of first responder B so that a legitimate authorization record is available given MCI events.

[0171] If first responder B is injured in the MCI event after arriving at the MCI field, or first responder B changes his / her designation at the scene, or first responder B's device UE is handed over to another first responder, or first responder B has to leave the MCI area for an unprecedented reason, first responder B's device UE is deregistered from the first responder database as a first responder either directly by first responder B's device UE or via other first responder's device UE present in the MCI area. The device identification (devID) of the first responder's device UE deregistering first responder B from the first responder database is then further captured in the first responder database along with the deregistration details.

[0172] In yet another example, device B is shared by different emergency services (e.g., medical, fire, and police drones) that will be used in an MCI event as a heterogeneous access device in the first responder network. Device A can identify and authorize heterogeneous device B to securely retrieve services from heterogeneous device B in the exclusive emergency services network with information about the capabilities of device B (e.g., battery, radio resources, antennas), or about the capabilities of heterogeneous device B. This information can be used by the devices while planning the deployment of access devices in the MCI area.

[0173] In another example for identifying the injured person / victim as a device user UE, the injured person's registered device UE, likely a powered-on wearable device or a mobile phone, has an intact radio frequency (RF) module (e.g., a 3GPP radio module) with an IMSI stored in a subscriber identity module (e.g., an eSIM). The IMSI is identified by device B or device A (e.g., by initiating a scan for IMSIs in the vicinity of device B, e.g., using an IMSI scanner) or is derived from a temporary identifier (e.g., 5G GUTI) assigned to device UE 24 by the home PLMN or, e.g., by a first responder network (operated by device A) to ask its UDM or UDM of the home PLMN of device UE 24 to unmask the SUCI received from device UE 24 upon registration. Upon identifying the injured person's device UE in the vicinity, device A or device B connects (possibly automatically) to a central identity server to communicate the subscriber details (e.g., IMSI) and retrieve the person information linked to the device UE. Device A is communicatively coupled to a service provider (e.g., a mobile network operator) and may register (include) the victim's device UE with the first responder network and, for example, may use its location services and / or device B to automatically triangulate the location of the victim or request the location of device UE 24 from a location service in the home network of device UE 24.

[0174] Alternatively, an identity service running on device A may coordinate with a similar identity service of the victim's device UE's network provider (e.g., home PLMN) (e.g., by the first responder network setting up a connection to the device UE's home PLMN's UDM via the NEF or by requesting the home PLMN to provide user identity information related to the device identity (e.g., SUCI) provided by the device UE during registration) to retrieve relevant patient or user information details including, but not limited to, the name of the subscriber of the subscription related to the IMSI / SUPI, emergency contact details, or electronic medical record identity (EMR ID) of the user (i.e., victim / victim) who owns / operates the device UE. This identity service can securely access the IMSI details from a Subscriber Identity Module (e.g., as specified in the GlobalPlatform Card Specification v2.2) stored in the victim's device UE. The first responder network device then securely transports the subscriber details to the victim's device UE's network provider over an integrity-protected communication channel.

[0175] In yet another example, device B or device A, upon identifying a device UE in the vicinity, may detect the presence of a vital signs sensor on the device UE (e.g., by capturing the device class of the device UE) by a pre-specified device class identifier of the device classified as a vital signs device (e.g., a smart watch with an integrated vital signs sensor such as a heart rate sensor or the like) simultaneously with or possibly prior to registering the device UE with the first responder network. If device B is itself a UE (e.g., from the first responder), this may be done through discovery or through a sidelink interface (e.g., PC5 of ProSe) that provides a list of device B's capabilities, device class, or specific ProSe services during or after the sidelink connection setup. Device B may also set up a sidelink (e.g., PC5) connection to the device UE to directly communicate with the victim's device, e.g., to retrieve vital signs information.

[0176] Upon detecting the presence of a device UE equipped with a vital signs sensor, device B coordinates with device A to enable a virtual sub-network under the first responder network so that the isolated victim's device UE can register (on-board) the device UE in the virtual private sub-network by being provided with a network credential of the first responder network. Upon successful registration, network services of the first responder network can access the device UE to enable network specific services on the device UE including, but not limited to, location determination, device power management, and application specific services including, but not limited to, retrieval of data from the vital signs sensor, and installation of network optimized applications for first responder operations.

[0177] Alternatively, device A may be communicatively coupled to a network service provider (e.g., a home PLMN) of the victim's device UE to enable the device UE to roam to the first responder network and perform network and application specific services. The device UE's PLMN may provide an interface or application programming interface (API) via the NEF to enable the first responder network to send such requests for the particular device UE and under specific permissions and / or privileges.

[0178] In yet another example, a victim's intact vital signs device UE may be used to track the victim's health status after being communicatively coupled to the first responder network.

[0179] Upon detecting the presence of a vital signs built-in device UE (e.g., a smart watch), a prioritization service on device B is used to prioritize the device UE over non-built-in device UEs (e.g., a smart phone) that may register with the first responder network, so that upon registering the device UE, device B can securely retrieve the latest vital signs from the victim's device UE in an optimized balance with the first responder network.

[0180] In yet another example, devices A and B operate multiple network slices, each with its own performance characteristics.

[0181] In summary, a wireless communication system for a first responder network has been described that can securely register various wireless devices to ensure faster response times in MCI fields. Existing wireless devices belonging to both triage officers and victims in MCI fields can be automatically registered to the first responder network for automated tracking, identification, and location of first responders and victims, emergency communications between first responders and victims, and enhanced coverage in MCI fields. Expansion of the wireless infrastructure of the first responder network can be enabled by securely registering heterogeneous central nodes (e.g., base stations) on demand.

[0182] While the present invention has been illustrated and described in detail in the drawings and the foregoing description, such illustration and description should be considered illustrative or exemplary and not restrictive. The present invention is not limited to the disclosed embodiments. It is applicable to various types of devices UE, such as mobile phones, vital signs monitoring / telemetry devices, smart watches, detectors, or other types of portable devices. The term geographic area as used throughout this description is used interchangeably with any spatial area or volume determined by a set of coordinates (absolute or relative to a reference point / device) or a set of minimum / maximum distances to a reference point / device. The geographic areas are outdoors and indoors.

[0183] The wireless communication device (device UE) can be various types of devices, such as a mobile phone, a vehicle (for vehicle-to-vehicle (V2V) communication or the more general vehicle-to-exchange (V2X) communication), a V2X device, an IoT hub, an IoT device including low power medical sensors for health monitoring, medical (emergency) diagnosis and treatment devices for hospitals or first responders, a virtual reality (VR) headset, etc.

[0184] Device A is any network access device providing a geographical coverage area (such as a base station, Node B (eNB, eNodeB, gNB, gNodeB, ng-eNB, etc.), access point, or similar, or e.g. a PC / portable / server device providing network control or core network functionality).

[0185] Furthermore, at least some of the above embodiments are based on 5G New Radio (5G NR) radio access technology. Specifically, the relay function enables multi-hop indirect network connectivity for remote communication devices, specifically achieving improved coverage for communication devices in a first responder network and improved low power operation for IoT communication devices.

[0186] Furthermore, the present invention is applicable in medical applications or connected healthcare where multiple wireless (e.g. 4G / 5G) connected sensor or actuator nodes participate, where the wireless (e.g. 4G / 5G) connected devices utilize or generate continuous data streams at certain average data rates from time to time, such as video, ultrasound, X-ray, computed tomography (CT) imaging devices, real-time patient sensors, audio or voice or video streaming devices used by medical personnel, in general IoT applications including wireless, mobile or fixed, sensor or actuator nodes (e.g. smart cities, logistics, agriculture, etc.), in emergency services and critical communication applications, in V2X systems, in systems for improved coverage for 5G cellular networks using high frequency (e.g. mmWave) RF, and in any other application field of 5G communications where relaying is used.

[0187] Other variations to the disclosed embodiments can be understood and effected by those skilled in the art in practicing the claimed invention, from a study of the drawings, the disclosure, and the appended claims. In the claims, the word "comprises" does not exclude other elements or steps, and singular elements do not exclude a plurality. A single processor or other unit fulfills the functions of several items recited in the claims. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be advantageously used. The foregoing description details certain embodiments of the invention. Nevertheless, no matter how detailed the foregoing appears in this text, it will be recognized that the invention may be practiced in many ways and is therefore not limited to the disclosed embodiments. It should be noted that the use of certain terminology when describing certain features or aspects of the invention should not be taken to imply that the terminology is redefined herein to be limited to include any inherent characteristics of the feature or aspect of the invention with which it is associated.

[0188] A single unit or device fulfills the functions of several items recited in the claims. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage.

[0189] The described operations, such as those indicated in Figures 5 and 6, may be implemented as program code means of a computer program and / or as dedicated hardware in the relevant communication or access device, respectively. The computer program may be stored and / or distributed on a suitable medium, such as optical storage media or solid state media, supplied together with or as part of other hardware, but also in other forms, such as via the Internet or other wired or wireless telecommunications systems.

Claims

1. 1. An apparatus for supporting establishment of a wireless communications network, the apparatus comprising: connecting to a network controller device of the wireless communications network and providing wireless connections to wireless communications devices in the target geographic area; receiving information about the target geographic area; receiving from the network controller device information about a network configuration for setting up a communication channel with a wireless communication device; inviting or triggering wireless communication devices located within the target geographic area to register over the communication channel or other communication channels with a core network operated by the network controller device; An apparatus for performing the above.

2. 10. The apparatus of claim 1, wherein the apparatus is configured to restrict triggers or registration invitations to at least one of a predetermined group and / or type of the wireless communication device, a network service, and a network slice of the wireless communication network.

3. The apparatus of claim 1 , wherein the apparatus receives information about the target geographic area, the target geographic area being an area smaller than a coverage area of ​​an access device.

4. The apparatus of claim 1 , wherein the apparatus comprises a relay node functionality that can be activated by the network controller device.

5. 10. The apparatus of claim 1, further comprising: a network controller device configured to: perform measurements within the target geographic area; and forward corresponding measurement parameters to the network controller device for prediction of a total number of access devices, relay devices, or wireless communication devices required in a mass casualty incident (MCI) or emergency area.

6. The apparatus of claim 1 , further comprising: an invitation signal or message sent to the wireless communication device that includes information about the emergency situation.

7. 10. The apparatus of claim 1, further comprising: an access point for accessing a wireless communication device from a cellular device platform; and a user of the wireless communication device, the user accessing the wireless communication device from a cellular device platform;

8. 13. An access device for providing a wireless connection to a wireless communication device in a wireless communication network, the access device comprising the apparatus of claim 1.

9. A wireless communication system comprising an access device according to claim 8 connected to one or more wireless communication devices and a network controller device.

10. 10. The wireless communication system of claim 9, wherein the wireless communication system performs device authentication via a link between the network controller device and an external device that is not registered in the wireless communication network.

11. 11. The wireless communication system of claim 10, wherein the network controller device interfaces with the external device via a limited range local connection to couple to a core network of the wireless communication network to enable the external device to act as an authenticator and / or a subscription owner registry for inbound roaming devices.

12. The wireless communication system of claim 10 , wherein the network controller device enables the external device to prove that an incoming roaming device belongs to the same network, facility, or group.

13. 10. The wireless communication system of claim 9, wherein the network controller device provides authentication and / or identification information to the external device such that a core network function of the external device can provide local network registration functionality.

14. The wireless communication system of claim 10 , wherein the external device is a drone or a mobile server device.

15. 10. The wireless communication system of claim 9, further comprising: exchanging information between the wireless communication network and another wireless communication network to obtain location information, requesting a wireless communication device to connect to the wireless communication network, or requesting an access device of the other wireless communication network to temporarily join the wireless communication network for user identification.

16. 10. The wireless communications system of claim 9, further comprising: identifying and tracking legitimate network authorizations and transactions in the wireless communications network and / or subscriber database.

17. 1. A method for supporting establishment of a wireless communications network, the method comprising: connecting to a network controller device of the wireless communications network and providing wireless connections to wireless communications devices in the target geographic area; receiving information about the target geographic area; receiving from the network controller device information about a network configuration for setting up a communication channel with a wireless communication device; inviting or triggering wireless communication devices located within the target geographic area to register with a core network operated by the network controller device; The method comprising:

18. A computer program comprising code means for causing the performance of the steps of the method according to claim 17 when said computer program is executed on a computing device.

Images