Network node and communication method

Abstract

To clarify correspondence between a control session and a signal transmission session.SOLUTION: A network node has: a transmission part for transmitting a handshake ID and a first timer value to SEPP (Security Edge Protection Proxy) in a first TLS (Transport layer security) session for control; a reception part for receiving the handshake ID and a second timer value from the SEPP through the first TLS session; and a control part for establishing a second TLS session for signal transmission on which a cipher system negotiated in the first TLS session applies, with the SEPP. The transmission part transmits an HTTP (Hypertext Transfer Protocol) OPTIONS method signal including the handshake ID to the SEPP through the second TLS session immediately after the second TLS session has been established.SELECTED DRAWING: Figure 15

Description

[Technical Field]

[0001] The present invention relates to a network node in a communication system and a communication method. [Background technology]

[0002] 3GPP (registered trademark) (3rd Generation Partnership Project) is currently studying a wireless communication system called 5G or NR (New Radio) (hereinafter, this wireless communication system will be referred to as "5G" or "NR") in order to achieve even larger system capacity, even faster data transmission speeds, and even lower latency in wireless sections. Various wireless technologies are being studied for 5G to meet the requirements of achieving a throughput of 10 Gbps or more while reducing latency in wireless sections to 1 ms or less.

[0003] In NR, network architectures under consideration include 5GC (5G Core Network), which corresponds to EPC (Evolved Packet Core), the core network in the LTE (Long Term Evolution) network architecture, and NG-RAN (Next Generation - Radio Access Network), which corresponds to E-UTRAN (Evolved Universal Terrestrial Radio Access Network), the RAN (Radio Access Network) in the LTE network architecture (e.g., Non-Patent Documents 1 and 2). [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] 3GPP TS 23.501 V18.6.0 (2024-06) [Non-patent document 2] 3GPP TS 23.502 V18.6.0 (2024-06) [Non-patent document 3] 3GPP TS 29.573 V18.7.0 (2024-06) Summary of the Invention [Problem to be solved by the invention]

[0005] 5GC specifies N32 as the interface between operators. When NFs in a visited public land mobile network (VPLMN) and a home public land mobile network (HPLMN) communicate, an N32 connection is established between devices called SEPPs (Security Edge Protection Proxy), which are placed at the network boundary, and the necessary signals are included in the communication path. The two PLMNs communicate with each other as relay devices (equivalent to an HTTP proxy + alpha) that add security functions to the SEPP.

[0006] N32 consists of two types of interfaces: N32-c for control and N32-f for signal transmission. Currently, the correspondence between N32-c and N32-f is incomplete, making it difficult for SEPP to verify the validity of TLS (Transport layer security) sessions for N32-f.

[0007] The present invention has been made in view of the above points, and has as its object to clarify the correspondence between control sessions and signal transmission sessions. [Means for solving the problem]

[0008] According to the disclosed technology, there is provided a network node having a transmitter that transmits a handshake ID and a first timer value to a SEPP (Security Edge Protection Proxy) in a first TLS (Transport layer security) session for control, a receiver that receives the handshake ID and a second timer value from the SEPP via the first TLS session, and a controller that establishes with the SEPP a second TLS session for signal transmission to which an encryption method negotiated in the first TLS session is applied, wherein immediately after establishing the second TLS session, the transmitter transmits an HTTP (Hypertext Transfer Protocol) OPTIONS method signal including the handshake ID to the SEPP via the second TLS session, and the controller starts a timer that expires with the second timer value, and when the timer expires, causes the transmitter to transmit the HTTP OPTIONS method signal to the SEPP via the second TLS session. [Effects of the Invention]

[0009] According to the disclosed technique, it is possible to clarify the correspondence between a control session and a signal transmission session. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram illustrating an example of a communication system. [Figure 2] FIG. 1 is a diagram for explaining an example (1) of a communication system in a roaming environment. [Figure 3] FIG. 10 is a diagram for explaining an example (2) of a communication system in a roaming environment. [Figure 4] FIG. 2 is a diagram for explaining communication signals between operators. [Figure 5] FIG. 10 is a diagram for explaining a configuration example (1) of N32-c. [Figure 6] FIG. 10 is a diagram for explaining a configuration example (1) of N32-f. [Figure 7]FIG. 10 is a diagram for explaining a configuration example (2) of N32-c. [Figure 8] FIG. 10 is a diagram for explaining a configuration example (2) of N32-f. [Figure 9] FIG. 10 is a diagram for explaining a configuration example (1) of N32. [Figure 10] FIG. 10 is a diagram for explaining a configuration example (2) of N32. [Figure 11] FIG. 2 is a diagram illustrating a configuration example (1) of an N32 according to an embodiment of the present invention. [Figure 12] FIG. 10 is a diagram illustrating a configuration example (2) of N32 in the embodiment of the present invention. [Figure 13] FIG. 10 is a diagram illustrating a configuration example (3) of N32 in the embodiment of the present invention. [Figure 14] FIG. 10 is a diagram illustrating a configuration example (4) of N32 in the embodiment of the present invention. [Figure 15] FIG. 10 is a diagram illustrating a configuration example (5) of N32 in an embodiment of the present invention. [Figure 16] 2 is a diagram illustrating an example of a functional configuration of a base station 10 according to an embodiment of the present invention. [Figure 17] FIG. 2 is a diagram illustrating an example of a functional configuration of a terminal 20 according to the embodiment of the present invention. [Figure 18] 1 is a diagram illustrating an example of a hardware configuration of a base station 10 and a terminal 20 according to an embodiment of the present invention. [Figure 19] FIG. 2 is a diagram showing an example of the configuration of a vehicle 2001 according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0011] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. Note that the embodiment described below is an example, and the embodiment to which the present invention is applied is not limited to the following embodiment.

[0012] In the operation of the wireless communication system according to the embodiment of the present invention, existing technologies are used as appropriate. However, the existing technologies are, for example, but not limited to, the existing LTE. Furthermore, the term "LTE" used in this specification has a broad meaning including LTE-Advanced, a system subsequent to LTE-Advanced (e.g., NR), or a wireless LAN (Local Area Network), unless otherwise specified.

[0013] Furthermore, in the embodiments of the present invention, when radio parameters etc. are "configured," it may mean that predetermined values ​​are pre-configured, or that radio parameters notified from the network node 30 or the terminal 20 are set.

[0014] Fig. 1 is a diagram illustrating an example of a communication system. As shown in Fig. 1, the communication system is composed of a UE, which is a terminal 20, and multiple network nodes 30. Hereinafter, it is assumed that one network node 30 corresponds to each function, but multiple functions may be realized by one network node 30, or multiple network nodes 30 may realize one function. Furthermore, the "connection" described below may be a logical connection or a physical connection.

[0015] The RAN (Radio Access Network) is a network node 30 having a radio access function, which may include a base station 10, and is connected to a UE, an AMF (Access and Mobility Management Function), and a UPF (User plane function). The AMF is a network node 30 having functions such as terminating the RAN interface, terminating the NAS (Non-Access Stratum), and performing registration management, connection management, reachability management, and mobility management. The UPF is a network node 30 having functions such as a PDU (Protocol Data Unit) session point to the outside that interconnects with a DN (Data Network), packet routing and forwarding, and user plane QoS (Quality of Service) handling. The UPF and the DN constitute a network slice. In the wireless communication network according to the embodiment of the present invention, multiple network slices may be configured.

[0016] The AMF is connected to the UE, RAN, SMF (Session Management function), NSSF (Network Slice Selection Function), NEF (Network Exposure Function), NRF (Network Repository Function), UDM (Unified Data Management), AUSF (Authentication Server Function), PCF (Policy Control Function), and AF (Application Function). The AMF, SMF, NSSF, NEF, NRF, UDM, AUSF, PCF, and AF are network nodes 30 that are interconnected via interfaces based on their respective services: Namf, Nsmf, Nnssf, Nnef, Nnrf, Nudm, Nausf, Npcf, and Naf.

[0017] The SMF is a network node 30 that has functions such as session management, UE IP (Internet Protocol) address allocation and management, DHCP (Dynamic Host Configuration Protocol) function, ARP (Address Resolution Protocol) proxy, and roaming function. The NEF is a network node 30 that has a function of notifying other NFs (Network Functions) of capabilities and events. The NSSF is a network node 30 that has functions such as selecting a network slice to which a UE connects, determining allowed NSSAIs (Network Slice Selection Assistance Information), determining the NSSAI to be configured, and determining the AMF set to which the UE connects. The PCF is a network node 30 that has a function of controlling network policies. The AF is a network node 30 that has a function of controlling application servers. The NRF is a network node 30 that has a function of discovering NF instances that provide services. The UDM is a network node 30 that manages subscriber data and authentication data. The UDM is connected to a UDR (User Data Repository) that stores the data.

[0018] Fig. 2 is a diagram for explaining an example (1) of a communication system in a roaming environment. As shown in Fig. 2, the network is composed of a UE, which is a terminal 20, and multiple network nodes 30. Hereinafter, it is assumed that one network node 30 corresponds to each function, but multiple functions may be realized by one network node 30, or multiple network nodes 30 may realize one function. Furthermore, the "connection" described below may be a logical connection or a physical connection.

[0019] The RAN is a network node 30 having a radio access function, and is connected to the UE, the AMF, and the UPF. The AMF is a network node 30 having functions such as RAN interface termination, NAS termination, registration management, connection management, reachability management, and mobility management. The UPF is a network node 30 having functions such as a PDU session point to the outside that interconnects with the DN, packet routing and forwarding, and user plane QoS handling. The UPF and the DN constitute a network slice. In the wireless communication network according to the embodiment of the present invention, multiple network slices are constructed.

[0020] The AMF is connected to the UE, RAN, SMF, NSSF, NEF, NRF, UDM, AUSF, PCF, AF, and SEPP (Security Edge Protection Proxy). The AMF, SMF, NSSF, NEF, NRF, UDM, AUSF, PCF, and AF are network nodes 30 that are interconnected via their respective service-based interfaces, Namf, Nsmf, Nnssf, Nnef, Nnrf, Nudm, Nausf, Npcf, and Naf.

[0021] The SMF is a network node 30 having functions such as session management, UE IP address allocation and management, DHCP function, ARP proxy, and roaming function. The NEF is a network node 30 having a function of notifying other NFs of capabilities and events. The NSSF is a network node 30 having functions such as selecting a network slice to which a UE connects, determining an allowed NSSAI, determining an NSSAI to be configured, and determining an AMF set to which a UE connects. The PCF is a network node 30 having a function of controlling network policies. The AF is a network node 30 having a function of controlling application servers. The NRF is a network node 30 having a function of discovering NF instances that provide services. The SEPP is a non-transparent proxy that filters control plane messages between PLMNs (Public Land Mobile Networks). The vSEPP shown in Figure 2 is the SEPP in the visited network, and the hSEPP is the SEPP in the home network.

[0022] As shown in Figure 2, a UE is in a roaming environment connected to a RAN and an AMF in a Visited PLMN (VPLMN). The VPLMN and a Home PLMN (HPLMN) are connected via a vSEPP and an hSEPP. The UE can communicate with a UDM in the HPLMN via an AMF in the VPLMN, for example. The VPLMN may be referred to as a Visited Network, and the HPLMN may be referred to as a Home Network.

[0023] Figure 2 shows an example of a local breakout scenario where user data is connected to a DN in a visited network. Control signals are exchanged between the visited and home networks via the SEPP.

[0024] Figure 3 is a diagram illustrating an example (2) of a communication system in a roaming environment. Figure 3 shows an example of a home routed scenario in which user data is connected to a DN in a home network. Control signals are exchanged between the visited network and the home network via the SEPP, similar to the local breakout scenario.

[0025] Figure 4 is a diagram for explaining communication signals between operators. As shown in Figure 4, an NF Consumer (NFc) that uses the services of an NF in another network uses each API (Application Programming Interface) provided by an NF Producer (NFp) in the other network via N32-c and N32-f generated by the SEPPs of both networks.

[0026] By using each API, it is possible to make inquiries to the NRF to discover the NF to communicate with, perform authentication by the AUSF, register status such as location to the UDM, obtain subscriber information, and create, change, and disconnect sessions to the SMF.

[0027] 5GC defines N32 as an interface between operators (see Non-Patent Document 3). When NFs in a visited network (VPLMN) and a home network (HPLMN) communicate, an N32 connection is established between devices called SEPPs located at the network boundary, and necessary signals are included in the communication path. The two PLMNs communicate with each other as relay devices (equivalent to HTTP proxy + alpha) that add security functions to SEPPs.

[0028] Currently, N32 consists of two types of interfaces.

[0029] One is N32-c, which is used to control N32 itself. Specifically, it specifies the encryption methods to be used and the additional information exchange required for some encryption methods. It is generally generated using TLS (Transport Layer Security).

[0030] The other is N32-f, which is the actual signal exchanged between the NFs of two operators. The signal is exchanged using the encryption method negotiated in N32-c. Although some relay devices may be used, the signal between the devices is generally generated using TLS.

[0031] N32 specifies two connection methods: the TLS method and the PRINS (Protocol for N32 Interconnect Security) method. These connection methods are N32-f connection methods, and the difference is whether the relay carrier's equipment can check and operate the N32-f signal content.

[0032] Fig. 5 is a diagram for explaining a configuration example (1) of N32-c. As shown in Fig. 5, N32-c is used for controlling N32, and negotiates the security capabilities to be used between cSEPP and pSEPP (see Non-Patent Document 3). It negotiates whether to connect N32-f with TLS or PRINS (Application Level Security). This is usually performed when the device is started up, and N32-c is disconnected immediately after the negotiation is completed.

[0033] Fig. 6 is a diagram for explaining a configuration example (1) of N32-f. As shown in Fig. 6, N32-f is for signal transmission of N32, and is a connection for ensuring security between cSEPP and pSEPP in communication between cNF and pNF. When N32-f is TLS, it transmits HTTP (Hypertext Transfer Protocol) signals on a layer encrypted by TLS.

[0034] Fig. 7 is a diagram for explaining a configuration example (2) of N32-c. As shown in Fig. 7, N32-c is used for controlling N32, and negotiates the security capabilities to be used between cSEPP and pSEPP. It negotiates whether to connect N32-f using TLS or PRINS (Application Level Security). This is usually performed when the device is started up, and N32-c is disconnected immediately after the negotiation is complete. If N32-f uses PRINS, it can be routed via an intermediary device.

[0035] Figure 8 is a diagram for explaining a configuration example (2) of N32-f. As shown in Figure 6, N32-f is for signal transmission of N32, and is a connection that ensures security between cSEPP and pSEPP in communication between cNF and pNF. When N32-f uses PRINS, it becomes possible to provide supplementary services by instructing the intermediary to change some parameters when relaying signals.

[0036] Fig. 9 is a diagram for explaining an example of an N32 configuration (1). As shown in Fig. 9, when multiple N32 connections are established with the same SEPP pair combination (that is, when multiple different N32 connections are established between the same SEPPs for various purposes (roaming, SMS interconnection, and disaster roaming in the example of Fig. 9) due to multiple N32 uses), management becomes impossible unless the correspondence between the TLS sessions of N32-c and N32f is made clear.

[0037] The IP addresses and ports of N32-c and N32-f used by the SEPP can be different. However, as shown in Figure 9, when establishing multiple N32 connections for different N32 purposes with the same SEPP pair combination (when the same SEPP is used in the local network and another network), the combination becomes unclear unless there is a corresponding N32-f connection for the N32-c connection.

[0038] Since it is not clear which N32-c corresponds to which N32-f, it is difficult to verify the validity of the signal content.

[0039] Therefore, in order to associate N32-c and N32-f, the handshake ID was defined in Rel-18.

[0040] Fig. 10 is a diagram for explaining a configuration example (2) of N32. As shown in Fig. 10, n32HandshakeId (=AAA) is notified during capability negotiation of N32-c, and the same value (=AAA) is then notified in the 3gpp-Sbi-N32-Handshake-Id header of the N32-f signal notified through TLS for N32-f, and the receiving SEPP associates that N32-c and N32-f are in a corresponding signal relationship.

[0041] That is, during N32-c capability negotiation, the n32HandshakeId is compared with the 3gpp-Sbi-N32-Handshake-Id header of the N32-f signal notified via TLS for N32-f to verify the validity of the TLS session for N32-f.

[0042] In addition, in the case of a pair combination of different SEPPs, identification is possible through the SEPP FQDN, so it is not necessarily necessary to rely on the handshake ID.

[0043] However, the current mapping between N32-c and N32-f is incomplete, and SEPP may not be able to verify the validity of a TLS session for N32-f.

[0044] After a TLS session carrying N32-f is generated through negotiation in N32-c, such as when SEPP is started, there is a time lag until the actual N32-f signal is sent, making it impossible to verify the validity of the TLS session for N32-f.

[0045] Fig. 11 is a diagram illustrating a configuration example (1) of an N32 in an embodiment of the present invention. The handshake ID is included in the HTTP header of the N32-f signal. However, since the N32-f signal does not actually arrive until the NF on the operator (MNO) side sends the signal to another network, as shown in Fig. 11, it is not possible to verify the validity of the TLS session for N32-f by matching the handshake ID. This raises the risk that the TLS session for N32-f will become floating and unmanageable.

[0046] Therefore, we have made it possible for SEPPs to autonomously send verification N32-f signals to SEPPs in other networks, enabling verification of N32-f TLS sessions and simultaneously realizing alive monitoring.

[0047] Fig. 12 is a diagram illustrating a configuration example (2) of N32 in an embodiment of the present invention. As shown in Fig. 12, after negotiation of N32-c, a TLS session for N32-f is generated, and immediately thereafter, a provision is made to notify an N32-f signal that correlates N32-c and N32-f through the TLS session for N32-f. This signal may be defined as an API. By transmitting this signal at a regular interval, alive monitoring of the N32 connection may be realized. This signal may include a handshake ID.

[0048] In a TLS session for N32-c, an HTTP POST (with "n32HandshakeId" IE (value AAA) in the JSON body) may be sent from cSEPP to pSEPP, or a 200 OK (with "n32HandshakeId" IE in the JSON body) may be sent from pSEPP to cSEPP.

[0049] In the TLS session for N32-f, an HTTP GET (HTTP header "3gpp-Sbi-N32-Handshake-Id" (value AAA)) may be sent from the cSEPP to the pSEPP, and a 200 OK may be sent from the pSEPP to the cSEPP.

[0050] By creating and notifying a dedicated signal that associates N32-c and N32-f immediately after generating the TLS session for N32-f, and by matching the handshake ID during N32-c negotiation with the handshake ID of the dedicated signal, it becomes possible to verify the validity of the TLS session for N32-f in exchanges between SEPPs, regardless of whether or not there is a signal from the NF of the other MNO.

[0051] As shown in FIG. 12, the cSEPP may expect to receive a response 200 OK containing the handshake ID in the TLS session for N32-c.

[0052] Fig. 13 is a diagram illustrating a configuration example (3) of N32 in an embodiment of the present invention. As shown in Fig. 13, after negotiation of N32-c, a TLS session for N32-f is generated, and immediately thereafter, a provision is made to notify an N32-f signal that correlates N32-c and N32-f through the TLS session for N32-f. The provision is made only that the signal is an HTTP signal that passes through N32-f, and the API does not have to be specified. The signal may include a handshake ID.

[0053] In a TLS session for N32-c, an HTTP POST (with "n32HandshakeId" IE (value AAA) in the JSON body) may be sent from cSEPP to pSEPP, or a 200 OK (with "n32HandshakeId" IE in the JSON body) may be sent from pSEPP to cSEPP.

[0054] In the TLS session for N32-f, an HTTP GET (HTTP header "3gpp-Sbi-N32-Handshake-Id" (value AAA)) may be sent from the cSEPP to the pSEPP, and a 200 OK may be sent from the pSEPP to the cSEPP.

[0055] By creating and notifying a dedicated signal that associates N32-c and N32-f immediately after generating the TLS session for N32-f, and by matching the handshake ID during N32-c negotiation with the handshake ID of the dedicated signal, it becomes possible to verify the validity of the TLS session for N32-f in exchanges between SEPPs, regardless of whether or not there is a signal from the NF of the other MNO.

[0056] 13, the cSEPP may assume that it receives a response 200 OK including the handshake ID in the TLS session for N32-c. Also, only if it receives a response 200 OK including the handshake ID in the TLS session for N32-c, the cSEPP may send an HTTP GET (HTTP header "3gpp-Sbi-N32-Handshake-Id" (value AAA)) including the handshake ID to the pSEPP in the TLS session for N32-f.

[0057] Here, feature negotiation may be used to notify support for the HTTP signal in N32-f as one of the features to be notified. Table 1 shows examples of features used in feature negotiation (see Non-Patent Document 3).

[0058] [Table 1]

[0059] As shown in Table 1, the feature "TLSCOR" may be added. The feature "TLSCOR" indicates support for sending and receiving HTTP signals indicating the association between N32-c and N32-f. "TLSCOR" allows the association between N32-c and N32-f to be indicated without the need for an N32-f message from another NF. If the SEPP supports sending and receiving HTTP signals indicating the association between N32-c and N32-f, it may signal "TLSCOR" in security capability negotiation.

[0060] Fig. 14 is a diagram illustrating a configuration example (4) of N32 in an embodiment of the present invention. As shown in Fig. 14, after negotiation of N32-c, a TLS session for N32-f is generated, and immediately thereafter, a provision is made to notify an N32-f signal that correlates N32-c and N32-f through the TLS session for N32-f. The provision is made only that the signal is an HTTP signal that passes through N32-f, and the API does not have to be specified. The signal may include a handshake ID.

[0061] In a TLS session for N32-c, an HTTP POST (with "n32HandshakeId" IE (value AAA) in the JSON body) may be sent from cSEPP to pSEPP, or a 200 OK (with "n32HandshakeId" IE in the JSON body) may be sent from pSEPP to cSEPP.

[0062] In the TLS session for N32-f, HTTP OPTIONS (HTTP header "3gpp-Sbi-N32-Handshake-Id" (value AAA)) may be sent from the cSEPP to the pSEPP. That is, the cSEPP may use the HTTP OPTIONS method to send the handshake ID to the pSEPP.

[0063] In response to the HTTP OPTIONS, pSEPP may send a 200 OK (HTTP header "3gpp-Sbi-N32fkeepalive" (value BBB) as a capability) to cSEPP. pSEPP sends a keep-alive timer value (BBB) ​​to cSEPP as a capability notification. cSEPP may start the timer upon receiving the timer value, and may realize keep-alive of the TLS session for N32-f by sending the HTTP OPTIONS again before the timer (value BBB) expires.

[0064] The pSEPP sends the keep-alive timer value (BBB) ​​to the cSEPP as a capability notification. The cSEPP may start the timer upon receiving the timer value and realize keep-alive by sending the HTTP OPTIONS again after the timer (value BBB) expires.

[0065] The pSEPP sends the keep-alive timer value (BBB) ​​to the cSEPP as a capability notification. The cSEPP may realize keep-alive by starting the timer when it receives the timer value and sending the HTTP OPTIONS again when the timer (value BBB) expires.

[0066] If the pSEPP does not receive the HTTP OPTIONS from the cSEPP within a certain period of time after sending a response to the HTTP OPTIONS to the cSEPP, the pSEPP may determine that keep-alive has failed and release the corresponding TLS session for N32-f. The certain period may be set in association with a timer value (BBB).

[0067] By creating and transmitting a dedicated signal to associate N32-c and N32-f immediately after generating the TLS session for N32-f, and by matching the handshake ID during N32-c negotiation with the handshake ID of the dedicated signal, it becomes possible to verify the validity of the TLS session for N32-f in exchanges between SEPPs, regardless of the presence or absence of a signal from the NF of the other MNO. In other words, if the handshake ID during N32-c negotiation and the handshake ID of the dedicated signal match, it becomes possible to associate the TLS session for N32-c with the TLS session for N32-f.

[0068] 14, the cSEPP may assume that it receives a response 200 OK including the handshake ID in the TLS session for N32-c. Also, only if it receives a response 200 OK including the handshake ID in the TLS session for N32-c, the cSEPP may send an HTTP OPTIONS (HTTP header "3gpp-Sbi-N32-Handshake-Id" (value AAA)) including the handshake ID to the pSEPP in the TLS session for N32-f.

[0069] Here, feature negotiation may be used to notify support for the HTTP signal in N32-f as one of the features to be notified. Table 2 shows examples of features used in feature negotiation (see Non-Patent Document 3).

[0070] [Table 2]

[0071] As shown in Table 2, the feature "TLSCOR" may be added. The feature "TLSCOR" indicates that the NF supports sending and receiving HTTP signals indicating the association between N32-c and N32-f, i.e., the HTTP OPTIONS message described above. "TLSCOR" allows the association between N32-c and N32-f to be indicated without the need for an N32-f message from another NF. If the SEPP supports sending and receiving HTTP signals indicating the association between N32-c and N32-f, the SEPP may notify "TLSCOR" in security capability negotiation.

[0072] Also, as shown in Table 2, the "TLSCOR" characteristic may indicate that the SEPP that received the HTTP OPTIONS message responds with a timer value as a capability, and that the SEPP that sent the HTTP OPTIONS message supports the behavior of starting a timer when it receives the response and sending the HTTP OPTIONS message again before the timer value expires.

[0073] Fig. 15 is a diagram for explaining a configuration example (5) of N32 in an embodiment of the present invention. As shown in Fig. 15, in the security capability exchange at N32-c, negotiation of a new feature for keep-alive (KPALV) may be enabled, and exchange and setting of timer values ​​and retransmission of the HTTP OPTIONS method may be specified.

[0074] In the security capability exchange in N32-c, a new feature for keep-alive (KPALV) may be negotiated. A desired timer value may also be notified. For example, if a timer value is not set in the request, the default value may be applied, and if a timer value is not set in the response, the value in the request may be applied.

[0075] As shown in Figure 15, in a TLS session for N32-c, an HTTP POST (with KPALV added to supported features and the desired timer value in a new "n32KeepaliveTimer" IE) may be sent from the cSEPP to the pSEPP. This may be called a request, and allows negotiation of the new feature KPALV. In the absence of a desired timer value, a default value may be set in the receiving SEPP. The desired timer value may also have upper and lower bounds.

[0076] As shown in Figure 15, in a TLS session for N32-c, a 200 OK (KPALV added to supported features in the JSON of the Body, and the accepted timer value in a new "n32KeepaliveTimer" IE) may be sent from pSEPP to cSEPP. This transmission may be called a response, and this response enables negotiation of the new feature KPALV. Regarding the timer value, if the desired timer value of the received request is accepted, the desired timer value may be set as the accepted timer value of the response, or the accepted timer value may not be set. If a value other than the desired timer value of the received request is desired, the desired timer value may be set as the accepted timer value of the response.

[0077] The SEPP may start the timer exchanged with N32-c, and when it expires, send HTTP OPTIONS to the other party. This realizes keep-alive. When another signal exchange occurs with N32-f (N32-f: HTTP Request / Response shown in Figure 15), the timer may be reset and restarted. This makes it possible to avoid sending unnecessary HTTP OPTIONS. If the HTTP OPTIONS exchange fails, it may be determined that N32-f is not operating normally, and the N32 connection itself may be released, N32-f may be released, or N32-f and N32-c may be released.

[0078] The SEPP that sent the request via N32-c starts a timer based on the received response. When another signal exchange occurs in N32-f (N32-f: HTTP Request / Response shown in Figure 15), the SEPP may reset the timer and restart it. As shown in Figure 15, when the timer expires, an HTTP OPTIONS message may be sent from the SEPP to the SEPP that received the request in the TLS session for N32-f. This allows keep-alive to be achieved.

[0079] A SEPP that receives a request via N32-c responds with 200 OK when it receives N32-f:HTTP OPTIONS in the TLS session for N32-f. If a SEPP that receives a request via N32-c does not receive N32-f:HTTP OPTIONS, it may determine that the N32 connection is invalid and release or close the N32 connection. Note that a SEPP that receives a request via N32-c may start a timer in the same way as the SEPP that sent the request, and may start it again when communication occurs. When a predetermined period of time has passed since the timer expired, it may release or close the N32 connection, or may release N32-f, or may release both N32-f and N32-c.

[0080] As shown in Table 3, a new feature for keep-alive (KPALV) may be added to the features.

[0081] [Table 3]

[0082] The feature KPALV indicates support for TLS session keep-alive for N32-f. A SEPP that supports the feature KPALV may advertise that it will perform TLS session keep-alive for N32-f.

[0083] Table 4 shows an example of n32KeepaliveTimer, which is an IE included in type SecNegotiateReqData in the N32 handshake API.

[0084] [Table 4]

[0085] As shown in Table 4, n32KeepaliveTimer may be set if the initiating SEPP wishes to use TLS session keepalive for the N32-f connection. The value set for n32KeepaliveTimer may be, for example, a value between 300 and 86400 seconds (i.e., 5 minutes to 1 day). If no value is set for n32KeepaliveTimer, for example, 3600 seconds may be assumed to be used.

[0086] Table 5 shows an example of n32KeepaliveTimer, which is an IE included in type SecNegotiateRspData in the N32 handshake API.

[0087] [Table 5]

[0088] As shown in Table 5, n32KeepaliveTimer may be set if the initiating or responding SEPP wishes to use TLS session keepalive for the N32-f connection. The value set for n32KeepaliveTimer is in seconds and may be in the same range as the n32KeepaliveTimer set in SecNegotiateReq. If no value is set for n32KeepaliveTimer, it may be assumed that the value of n32KeepaliveTimer set in SecNegotiateReq is used.

[0089] For example, based on GSMA requirements, when two PLMNs require keep-alive of the TLS session for the N32-f connection, they may negotiate the feature KPALV during the N32-c security negotiation. If the two SEPPs successfully negotiate the feature KPALV, both SEPPs may start a timer with the negotiated value. The timer may be restarted when a message over N32-f is sent. If the timer expires, the SEPP sends an HTTP OPTIONS request to the other SEPP over the TLS session for N32-f. If the SEPP does not receive an HTTP OPTIONS response, it may determine that the N32-f connection is not valid and may release the N32-f or N32 connection.

[0090] If the initiating SEPP requests TLS session keep-alive for the N32-f connection, the initiating SEPP includes support for feature KPALV in the N32-c security negotiation request. The initiating SEPP may also include a timer value.

[0091] If the responding SEPP receives an N32-c security negotiation request that includes support for the feature KPALV, the responding SEPP may decide whether to accept keep-alive for the TLS session for the N32-f connection. If the responding SEPP decides to use keep-alive, it sends an N32-c security negotiation response that includes support for the feature KPALV. The responding SEPP may further include a timer value.

[0092] The above-described embodiment ensures that the N32-f association verification can be performed immediately after the establishment of N32-c. It is possible to prevent the TLS session for N32-f from being left floating due to the inability to verify its validity. It is also possible to monitor the health of N32-f, enabling simpler operation.

[0093] That is, the correspondence between the control session and the signal transmission session can be clarified.

[0094] (Device configuration) Next, a description will be given of examples of functional configurations of the base station 10, network node 30, and terminal 20 that perform the processes and operations described above. The base station 10, network node 30, and terminal 20 include functions for performing the above-described embodiments. However, the base station 10, network node 30, and terminal 20 may each include only a part of the functions of the embodiments.

[0095] <Base Station 10 and Network Node 30> FIG. 16 is a diagram showing an example of the functional configuration of the base station 10. As shown in FIG. 16, the base station 10 has a transmitting unit 110, a receiving unit 120, a setting unit 130, and a control unit 140. The functional configuration shown in FIG. 16 is merely an example. As long as the operations according to the embodiment of the present invention can be performed, the names of the functional divisions and functional units may be any. Note that the network node 30 may have the same functional configuration as the base station 10. Furthermore, a network node 30 having multiple different functions in the system architecture may be composed of multiple network nodes 30 separated by function.

[0096] The transmitter 110 includes a function of generating a signal to be transmitted to the terminal 20 or another network node 30 and transmitting the signal by wire or wirelessly. The receiver 120 includes a function of receiving various signals transmitted from the terminal 20 or another network node 30 and acquiring, for example, information of a higher layer from the received signal.

[0097] The setting unit 130 stores in a storage device preset setting information and various setting information to be transmitted to the terminal 20, and reads out from the storage device as needed. The contents of the setting information include, for example, settings related to the operations described in the embodiments.

[0098] As described in the embodiments, the control unit 140 performs processing related to the operations described in the embodiments. The control unit 140 also performs processing related to communication with the terminal 20. A functional unit related to signal transmission in the control unit 140 may be included in the transmitting unit 110, and a functional unit related to signal reception in the control unit 140 may be included in the receiving unit 120.

[0099] <Terminal 20> Fig. 17 is a diagram showing an example of the functional configuration of terminal 20. As shown in Fig. 17, terminal 20 has a transmitting unit 210, a receiving unit 220, a setting unit 230, and a control unit 240. The functional configuration shown in Fig. 17 is merely an example. The names of the functional divisions and functional units may be any names as long as they can perform the operations related to the embodiment of the present invention.

[0100] The transmitter 210 generates a transmission signal from the transmission data and transmits the transmission signal wirelessly. The receiver 220 receives various signals wirelessly and acquires higher layer signals from the received physical layer signals. The receiver 220 also has a function of receiving NR-PSS, NR-SSS, NR-PBCH, DL / UL control signals, reference signals, etc. transmitted from the network node 30.

[0101] The setting unit 230 stores various setting information received from the network node 30 by the receiving unit 220 in a storage device and reads it from the storage device as needed. The setting unit 230 also stores setting information that is set in advance. The content of the setting information is, for example, settings related to the operations described in the embodiments.

[0102] The control unit 240 performs processing related to the operations described in the embodiments as described in the embodiments. The control unit 240 also performs processing related to the capacity-enhanced cell. The function unit related to signal transmission in the control unit 240 may be included in the transmitting unit 210, and the function unit related to signal reception in the control unit 240 may be included in the receiving unit 220.

[0103] (Hardware configuration) The block diagrams (FIGS. 16 and 17) used to explain the above embodiments show functional blocks. These functional blocks (components) are realized by any combination of at least one of hardware and software. Furthermore, the method for realizing each functional block is not particularly limited. That is, each functional block may be realized using a single device that is physically or logically coupled, or may be realized using two or more physically or logically separated devices that are connected directly or indirectly (for example, by wire, wirelessly, etc.) and these multiple devices. The functional block may be realized by combining the single device or the multiple devices with software.

[0104] Functions include, but are not limited to, judgment, determination, judgment, calculation, computation, processing, derivation, investigation, search, confirmation, reception, transmission, output, access, resolution, selection, election, establishment, comparison, assumption, expectation, consideration, broadcasting, notifying, communicating, forwarding, configuring, reconfiguring, allocation, mapping, and assignment. For example, a functional block (component) that performs transmission is called a transmitting unit or transmitter. As mentioned above, there are no particular limitations on how these functions are implemented.

[0105] For example, the network node 30, the terminal 20, etc. according to an embodiment of the present disclosure may function as a computer that performs processing of the wireless communication method of the present disclosure. Fig. 18 is a diagram illustrating an example of the hardware configuration of the base station 10 and the terminal 20 according to an embodiment of the present disclosure. The network node 30 may have the same hardware configuration as the base station 10. The base station 10 and the terminal 20 described above may be physically configured as a computer device including a processor 1001, a storage device 1002, an auxiliary storage device 1003, a communication device 1004, an input device 1005, an output device 1006, a bus 1007, etc.

[0106] In the following description, the term "apparatus" can be read as a circuit, a device, a unit, etc. The hardware configuration of the base station 10 and the terminal 20 may be configured to include one or more of the apparatuses shown in the drawings, or may be configured to exclude some of the apparatuses.

[0107] Each function in the base station 10 and the terminal 20 is realized by loading predetermined software (programs) onto hardware such as the processor 1001, the memory device 1002, etc., so that the processor 1001 performs calculations, controls communication by the communication device 1004, and controls at least one of reading and writing data in the memory device 1002 and the auxiliary memory device 1003.

[0108] The processor 1001 controls the entire computer by running, for example, an operating system. The processor 1001 may be configured as a central processing unit (CPU) including an interface with peripheral devices, a control device, an arithmetic unit, a register, etc. For example, the above-mentioned control unit 140, control unit 240, etc. may be realized by the processor 1001.

[0109] Furthermore, the processor 1001 reads programs (program codes), software modules, data, etc. from at least one of the auxiliary storage device 1003 and the communication device 1004 into the storage device 1002, and executes various processes in accordance with the programs. The programs used are those that cause a computer to execute at least some of the operations described in the above-described embodiments. For example, the control unit 140 of the base station 10 shown in FIG. 16 may be implemented by a control program stored in the storage device 1002 and running on the processor 1001. Furthermore, for example, the control unit 240 of the terminal 20 shown in FIG. 17 may be implemented by a control program stored in the storage device 1002 and running on the processor 1001. While the above-described various processes have been described as being executed by one processor 1001, they may also be executed simultaneously or sequentially by two or more processors 1001. The processor 1001 may be implemented by one or more chips. The programs may be transmitted from a network via a telecommunications line.

[0110] The storage device 1002 is a computer-readable recording medium and may be configured, for example, by at least one of a read-only memory (ROM), an erasable programmable ROM (EPROM), an electrically erasable programmable ROM (EEPROM), a random access memory (RAM), etc. The storage device 1002 may also be called a register, a cache, a main memory, etc. The storage device 1002 can store executable programs (program codes), software modules, etc. for implementing a communication method according to an embodiment of the present disclosure.

[0111] The secondary storage device 1003 is a computer-readable recording medium, and may be, for example, at least one of an optical disk such as a CD-ROM (Compact Disc ROM), a hard disk drive, a flexible disk, a magneto-optical disk (e.g., a compact disk, a digital versatile disk, a Blu-ray disc), a smart card, a flash memory (e.g., a card, a stick, a key drive), a floppy disk, a magnetic strip, etc. The above-mentioned storage medium may be, for example, a database, a server, or other suitable medium including at least one of the storage device 1002 and the secondary storage device 1003.

[0112] The communication device 1004 is hardware (transmission / reception device) for communicating between computers via at least one of a wired network and a wireless network, and is also referred to as, for example, a network device, a network controller, a network card, or a communication module. The communication device 1004 may be configured to include a high-frequency switch, a duplexer, a filter, a frequency synthesizer, etc. to realize at least one of frequency division duplex (FDD) and time division duplex (TDD). For example, a transmission / reception antenna, an amplifier unit, a transmission / reception unit, a transmission path interface, etc. may be realized by the communication device 1004. The transmission / reception unit may be implemented as a transmission unit and a reception unit that are physically or logically separated.

[0113] The input device 1005 is an input device (for example, a keyboard, a mouse, a microphone, a switch, a button, a sensor, etc.) that receives input from the outside. The output device 1006 is an output device (for example, a display, a speaker, an LED lamp, etc.) that performs output to the outside. Note that the input device 1005 and the output device 1006 may be integrated into one device (for example, a touch panel).

[0114] Furthermore, each device such as the processor 1001 and the storage device 1002 is connected by a bus 1007 for communicating information. The bus 1007 may be configured using a single bus, or may be configured using different buses between each device.

[0115] Furthermore, base station 10 and terminal 20 may be configured to include hardware such as a microprocessor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a programmable logic device (PLD), or a field programmable gate array (FPGA), and some or all of the functional blocks may be realized by the hardware. For example, processor 1001 may be implemented using at least one of these pieces of hardware.

[0116] Fig. 19 shows an example configuration of a vehicle 2001. As shown in Fig. 19, the vehicle 2001 includes a drive unit 2002, a steering unit 2003, an accelerator pedal 2004, a brake pedal 2005, a shift lever 2006, front wheels 2007, rear wheels 2008, an axle 2009, an electronic control unit 2010, various sensors 2021 to 2029, an information service unit 2012, and a communication module 2013. Each aspect / embodiment described in the present disclosure may be applied to a communication device mounted on the vehicle 2001, and may be applied to the communication module 2013, for example.

[0117] The drive unit 2002 is configured, for example, by an engine, a motor, or a hybrid of an engine and a motor. The steering unit 2003 includes at least a steering wheel (also called a handle), and is configured to steer at least one of the front wheels and the rear wheels based on the operation of the steering wheel operated by the user.

[0118] The electronic control unit 2010 is composed of a microprocessor 2031, a memory (ROM, RAM) 2032, and a communication port (IO port) 2033. Signals are input to the electronic control unit 2010 from various sensors 2021 to 2029 provided in the vehicle 2001. The electronic control unit 2010 may also be called an ECU (Electronic Control Unit).

[0119] The signals from the various sensors 2021 to 2029 include a current signal from a current sensor 2021 that senses the current of the motor, a rotation speed signal of the front and rear wheels obtained by a rotation speed sensor 2022, an air pressure signal of the front and rear wheels obtained by an air pressure sensor 2023, a vehicle speed signal obtained by a vehicle speed sensor 2024, an acceleration signal obtained by an acceleration sensor 2025, an accelerator pedal depression amount signal obtained by an accelerator pedal sensor 2029, a brake pedal depression amount signal obtained by a brake pedal sensor 2026, a shift lever operation signal obtained by a shift lever sensor 2027, and a detection signal for detecting obstacles, vehicles, pedestrians, etc. obtained by an object detection sensor 2028.

[0120] The information service unit 2012 is composed of various devices, such as a car navigation system, an audio system, speakers, a television, and a radio, for providing various types of information such as driving information, traffic information, and entertainment information, and one or more ECUs for controlling these devices. The information service unit 2012 uses information obtained from external devices via the communication module 2013, etc., to provide various types of multimedia information and multimedia services to the occupants of the vehicle 2001.

[0121] The driving assistance system unit 2030 is composed of various devices that provide functions for preventing accidents and reducing the driver's driving burden, such as a millimeter-wave radar, a LiDAR (Light Detection and Ranging), a camera, a positioning locator (e.g., GNSS, etc.), map information (e.g., high-definition (HD) map, autonomous vehicle (AV) map, etc.), a gyro system (e.g., an IMU (Inertial Measurement Unit), an INS (Inertial Navigation System), etc.), an AI (Artificial Intelligence) chip, and an AI processor, as well as one or more ECUs that control these devices. The driving assistance system unit 2030 also transmits and receives various information via the communication module 2013 to realize the driving assistance function or the autonomous driving function.

[0122] The communication module 2013 can communicate with the microprocessor 2031 and components of the vehicle 2001 via the communication port. For example, the communication module 2013 transmits and receives data via the communication port 2033 to and from the drive unit 2002, steering unit 2003, accelerator pedal 2004, brake pedal 2005, shift lever 2006, front wheels 2007, rear wheels 2008, axle 2009, microprocessor 2031 and memory (ROM, RAM) 2032 in the electronic control unit 2010, and sensors 2021 to 29, which are provided in the vehicle 2001.

[0123] The communication module 2013 is a communication device that can be controlled by the microprocessor 2031 of the electronic control unit 2010 and can communicate with an external device. For example, it transmits and receives various information to and from the external device via wireless communication. The communication module 2013 may be located either inside or outside the electronic control unit 2010. The external device may be, for example, a base station, a mobile station, or the like.

[0124] The communication module 2013 transmits, via wireless communication to an external device, a current signal from the current sensor that is input to the electronic control unit 2010. The communication module 2013 also transmits, via wireless communication to an external device, the rotation speed signals of the front and rear wheels acquired by a rotation speed sensor 2022, the air pressure signals of the front and rear wheels acquired by an air pressure sensor 2023, the vehicle speed signal acquired by a vehicle speed sensor 2024, the acceleration signal acquired by an acceleration sensor 2025, the accelerator pedal depression amount signal acquired by an accelerator pedal sensor 2029, the brake pedal depression amount signal acquired by a brake pedal sensor 2026, the shift lever operation signal acquired by a shift lever sensor 2027, and the detection signals for detecting obstacles, vehicles, pedestrians, etc. acquired by an object detection sensor 2028, which are input to the electronic control unit 2010.

[0125] The communication module 2013 receives various information (traffic information, traffic signal information, inter-vehicle information, etc.) transmitted from external devices and displays it on an information service unit 2012 provided in the vehicle 2001. The communication module 2013 also stores the various information received from the external devices in a memory 2032 that can be used by the microprocessor 2031. Based on the information stored in the memory 2032, the microprocessor 2031 may control the drive unit 2002, steering unit 2003, accelerator pedal 2004, brake pedal 2005, shift lever 2006, front wheels 2007, rear wheels 2008, axle 2009, sensors 2021 to 2029, etc. provided in the vehicle 2001.

[0126] (Summary of the embodiment) As described above, according to an embodiment of the present invention, there is provided a network node comprising: a transmitter that transmits a handshake ID and a first timer value to a SEPP (Security Edge Protection Proxy) in a first TLS (Transport layer security) session for control; a receiver that receives the handshake ID and a second timer value from the SEPP via the first TLS session; and a controller that establishes with the SEPP a second TLS session for signal transmission to which an encryption method negotiated in the first TLS session is applied, wherein the transmitter transmits an HTTP (Hypertext Transfer Protocol) OPTIONS method signal including the handshake ID to the SEPP via the second TLS session immediately after establishing the second TLS session, and the controller starts a timer that expires with the second timer value, and, when the timer expires, causes the transmitter to transmit the HTTP OPTIONS method signal to the SEPP via the second TLS session.

[0127] The above configuration ensures that N32-f association verification can be performed immediately after N32-c is established. It also prevents the TLS session for N32-f from being left floating due to the inability to verify its validity. It also enables N32-f alive monitoring, enabling simpler operation. In other words, it clarifies the association between the control session and the signal transmission session.

[0128] The control unit may reset and restart the timer when transmission / reception occurs in the second TLS session. This configuration ensures that N32-f association verification is performed immediately after N32-c is established. This prevents the TLS session for N32-f from being left floating due to the inability to verify its validity. This enables N32-f alive monitoring, enabling simpler operation.

[0129] If the second timer value is not set, the control unit may start a timer that expires with the first timer value, and when the timer expires, cause the transmission unit to send an HTTP OPTIONS method signal to the SEPP via the second TLS session. This configuration ensures that N32-f association verification is performed immediately after N32-c is established. It is possible to avoid an event where the validity of the TLS session for N32-f cannot be verified and the session becomes floating. It is possible to enable alive monitoring of N32-f, thereby achieving simpler operation.

[0130] According to an embodiment of the present invention, there is also provided a network node comprising: a receiver that receives a handshake ID and a first timer value from a SEPP (Security Edge Protection Proxy) in a first TLS (Transport layer security) session for control; a transmitter that transmits the handshake ID and a second timer value to the SEPP via the first TLS session; and a controller that establishes with the SEPP a second TLS session for signal transmission to which an encryption method negotiated in the first TLS session is applied, wherein the receiver receives an HTTP (Hypertext Transfer Protocol) OPTIONS method signal including the handshake ID from the SEPP via the second TLS session immediately after establishing the second TLS session, and the controller causes the transmitter to transmit a response to the SEPP when the receiver receives the HTTP OPTIONS method signal from the SEPP via the second TLS session.

[0131] The above configuration ensures that N32-f association verification can be performed immediately after N32-c is established. It also prevents the TLS session for N32-f from being left floating due to the inability to verify its validity. It also enables N32-f alive monitoring, enabling simpler operation. In other words, it clarifies the association between the control session and the signal transmission session.

[0132] The control unit may start a timer that expires with the second timer value, and release the second TLS session after a certain period of time has elapsed since the timer expired and if an HTTP OPTIONS method signal is not received from the SEPP via the second TLS session. This configuration ensures that N32-f association verification can be performed immediately after N32-c is established. This prevents the TLS session for N32-f from being left floating because its validity cannot be verified. This enables N32-f alive monitoring, enabling simpler operation.

[0133] Furthermore, according to an embodiment of the present invention, there is provided a communication method in which a network node executes the following procedures: transmitting a handshake ID and a first timer value to a SEPP (Security Edge Protection Proxy) in a first TLS (Transport layer security) session for control; receiving the handshake ID and a second timer value from the SEPP via the first TLS session; establishing a second TLS session with the SEPP for signal transmission to which the encryption method negotiated in the first TLS session is applied; immediately after establishing the second TLS session, transmitting an HTTP (Hypertext Transfer Protocol) OPTIONS method signal including the handshake ID to the SEPP via the second TLS session; and starting a timer that expires with the second timer value, and, when the timer expires, transmitting an HTTP OPTIONS method signal to the SEPP via the second TLS session.

[0134] The above configuration ensures that N32-f association verification can be performed immediately after N32-c is established. It also prevents the TLS session for N32-f from being left floating due to the inability to verify its validity. It also enables N32-f alive monitoring, enabling simpler operation. In other words, it clarifies the association between the control session and the signal transmission session.

[0135] (Supplementary explanation of the embodiment) Although the embodiments of the present invention have been described above, the disclosed invention is not limited to such embodiments, and those skilled in the art will understand various modifications, alterations, alternatives, and substitutions. While specific numerical examples have been used to facilitate understanding of the invention, unless otherwise specified, these numerical values ​​are merely examples, and any appropriate values ​​may be used. The division of items in the above description is not essential to the present invention; features described in two or more items may be used in combination as needed, and features described in one item may apply to features described in another item (unless inconsistent). The boundaries between functional units or processing units in the functional block diagram do not necessarily correspond to the boundaries between physical components. The operations of multiple functional units may be performed by a single physical component, or the operations of a single functional unit may be performed by multiple physical components. The order of the processing steps described in the embodiments may be reversed as long as there is no contradiction. For convenience of processing description, the network node 30 and the terminal 20 have been described using functional block diagrams. However, such devices may be implemented using hardware, software, or a combination thereof. The software operated by the processor of the network node 30 in accordance with an embodiment of the present invention and the software operated by the processor of the terminal 20 in accordance with an embodiment of the present invention may each be stored in random access memory (RAM), flash memory, read-only memory (ROM), EPROM, EEPROM, registers, hard disk (HDD), removable disk, CD-ROM, database, server or any other suitable storage medium.

[0136] Furthermore, the notification of information is not limited to the aspects / embodiments described in the present disclosure, and may be performed using other methods. For example, the notification of information may be performed by physical layer signaling (e.g., Downlink Control Information (DCI), Uplink Control Information (UCI)), higher layer signaling (e.g., Radio Resource Control (RRC) signaling, Medium Access Control (MAC) signaling, broadcast information (Master Information Block (MIB), System Information Block (SIB)), other signals, or a combination thereof. Furthermore, the RRC signaling may be referred to as an RRC message, and may be, for example, an RRC Connection Setup message, an RRC Connection Reconfiguration message, or the like.

[0137] Each aspect / embodiment described in the present disclosure may be applied to at least one of systems using LTE (Long Term Evolution), LTE-Advanced (LTE-A), SUPER 3G, IMT-Advanced, 4G (4th generation mobile communication system), 5G (5th generation mobile communication system), FRA (Future Radio Access), NR (New Radio), W-CDMA (registered trademark), GSM (registered trademark), CDMA2000, UMB (Ultra Mobile Broadband), IEEE 802.11 (Wi-Fi (registered trademark)), IEEE 802.16 (WiMAX (registered trademark), IEEE 802.20, UWB (Ultra-Wideband), Bluetooth (registered trademark), or other appropriate systems, and next-generation systems extended based on these. Furthermore, a combination of multiple systems (e.g., a combination of at least one of LTE and LTE-A with 5G) may also be applied.

[0138] Each aspect / embodiment described in the present disclosure may be any of the following: LTE (Long Term Evolution), LTE-Advanced (LTE-A), SUPER 3G, IMT-Advanced, 4G (4th generation mobile communication system), 5G (5th generation mobile communication system), 6th generation mobile communication system (6G), xth generation mobile communication system (xG) (xG (x is, for example, an integer or decimal number)), FRA (Future Radio Access), NR (new Radio), New radio access (NX), Future generation radio access (FX), W-CDMA (registered trademark), GSM (registered trademark), CDMA2000, UMB (Ultra Mobile Broadband), IEEE 802.11 (Wi-Fi (registered trademark)), IEEE 802.16 (WiMAX (registered trademark)), IEEE The present invention may be applied to at least one of systems using 802.20, UWB (Ultra-Wideband), Bluetooth (registered trademark), or other appropriate systems, and next-generation systems that are extended, modified, created, or defined based on these systems. The present invention may also be applied to a combination of multiple systems (e.g., a combination of at least one of LTE and LTE-A with 5G).

[0139] The order of the procedures, sequences, flowcharts, etc. of each aspect / embodiment described herein may be changed unless it is consistent. For example, the methods described in this disclosure present elements of various steps using an example order and are not limited to the particular order presented.

[0140] A specific operation described herein as being performed by the network node 30 may also be performed by its upper node in some cases. In a network consisting of one or more network nodes including the network node 30, it is clear that various operations performed for communication with the terminal 20 may be performed by at least one of the network node 30 and another network node other than the network node 30 (such as, but not limited to, an MME or an S-GW). Although the above example illustrates a case where there is one other network node other than the network node 30, the other network node may be a combination of multiple other network nodes (such as an MME and an S-GW).

[0141] The information, signals, etc. described in the present disclosure may be output from a higher layer (or a lower layer) to a lower layer (or a higher layer), or may be input / output via multiple network nodes.

[0142] Input and output information may be stored in a specific location (for example, memory) or may be managed using a management table. Input and output information may be overwritten, updated, or added to. Output information may be deleted. Input information may be sent to another device.

[0143] In the present disclosure, the determination may be made based on a value represented by one bit (0 or 1), a Boolean value (true or false), or a numerical comparison (e.g., comparison with a predetermined value).

[0144] Software shall be construed broadly to mean instructions, instruction sets, code, code segments, program code, programs, subprograms, software modules, applications, software applications, software packages, routines, subroutines, objects, executable files, threads of execution, procedures, functions, etc., whether referred to as software, firmware, middleware, microcode, hardware description language, or otherwise.

[0145] Software, instructions, information, etc. may also be transmitted or received over a transmission medium. For example, if software is transmitted from a website, server, or other remote source using wired technologies (such as coaxial cable, fiber optic cable, twisted pair, Digital Subscriber Line (DSL)), and / or wireless technologies (such as infrared, microwave), then these wired and / or wireless technologies are included within the definition of transmission media.

[0146] The information, signals, etc. described in this disclosure may be represented using any of a variety of different technologies. For example, data, instructions, commands, information, signals, bits, symbols, chips, etc. that may be referred to throughout the above description may be represented by voltages, currents, electromagnetic waves, magnetic fields or magnetic particles, optical fields or photons, or any combination thereof.

[0147] Note that terms explained in this disclosure and terms necessary for understanding this disclosure may be replaced with terms having the same or similar meanings. For example, at least one of a channel and a symbol may be a signal (signaling). Furthermore, a signal may be a message. Furthermore, a component carrier (CC) may be called a carrier frequency, a cell, a frequency carrier, etc.

[0148] As used in this disclosure, the terms "system" and "network" are used interchangeably.

[0149] Furthermore, the information, parameters, etc. described in the present disclosure may be expressed using absolute values, may be expressed using relative values ​​from a predetermined value, or may be expressed using other corresponding information. For example, a radio resource may be indicated by an index.

[0150] The names used for the above-described parameters are not intended to be limiting in any way. Furthermore, the mathematical expressions using these parameters may differ from those explicitly disclosed in this disclosure. The various channels (e.g., PUCCH, PDCCH, etc.) and information elements may be identified by any suitable names, and therefore the various names assigned to these various channels and information elements are not intended to be limiting in any way.

[0151] In the present disclosure, terms such as "base station (BS)," "radio base station," "base station device," "fixed station," "NodeB," "eNodeB (eNB)," "gNodeB (gNB)," "access point," "transmission point," "reception point," "transmission / reception point," "cell," "sector," "cell group," "carrier," and "component carrier" may be used interchangeably. Base stations may also be referred to by terms such as macrocell, small cell, femtocell, and picocell.

[0152] A base station can accommodate one or more (e.g., three) cells. When a base station accommodates multiple cells, the overall coverage area of ​​the base station can be divided into multiple smaller areas, and each smaller area can be provided with communication service by a base station subsystem (e.g., a small indoor base station (RRH: Remote Radio Head)). The term "cell" or "sector" refers to a part or the entire coverage area of ​​a base station and / or base station subsystem that provides communication service within this coverage.

[0153] In this disclosure, the terms "Mobile Station (MS)," "user terminal," "User Equipment (UE)," "terminal," etc. may be used interchangeably.

[0154] A mobile station may also be referred to by those skilled in the art as a subscriber station, mobile unit, subscriber unit, wireless unit, remote unit, mobile device, wireless device, wireless communication device, remote device, mobile subscriber station, access terminal, mobile terminal, wireless terminal, remote terminal, handset, user agent, mobile client, client, or some other suitable terminology.

[0155] At least one of the base station and the mobile station may be called a transmitting device, a receiving device, a communication device, etc. At least one of the base station and the mobile station may be a device mounted on a mobile body, or the mobile body itself. The mobile body may be a vehicle (e.g., a car, an airplane, etc.), an unmanned mobile body (e.g., a drone, an autonomous vehicle, etc.), or a robot (manned or unmanned). At least one of the base station and the mobile station may also include devices that do not necessarily move during communication operations. For example, at least one of the base station and the mobile station may be an IoT (Internet of Things) device such as a sensor.

[0156] Furthermore, a base station in the present disclosure may be read as a user terminal. For example, the aspects / embodiments of the present disclosure may be applied to a configuration in which communication between a base station and a user terminal is replaced with communication between a plurality of terminals 20 (which may be called, for example, D2D (Device-to-Device) or V2X (Vehicle-to-Everything)). In this case, the terminal 20 may be configured to have the functions of the above-mentioned network node 30. Furthermore, terms such as "uplink" and "downlink" may be read as terms corresponding to terminal-to-terminal communication (for example, "side"). For example, terms such as an uplink channel and a downlink channel may be read as a side channel.

[0157] Similarly, the user terminal in the present disclosure may be read as a base station, in which case the base station may be configured to have the functions of the user terminal described above.

[0158] As used in this disclosure, the terms "determining" and "determining" may encompass a wide variety of actions. "Determining" and "determining" may include, for example, judging, calculating, computing, processing, deriving, investigating, looking up, searching, inquiring (e.g., searching in a table, database, or other data structure), ascertaining, and the like. "Determining" and "determining" may also include receiving (e.g., receiving information), transmitting (e.g., sending information), input, output, accessing (e.g., accessing data in memory), and the like. Furthermore, "judgment" and "decision" can include regarding resolving, selecting, choosing, establishing, comparing, etc. as having been "judged" or "decided." In other words, "judgment" and "decision" can include regarding some action as having been "judged" or "decided." Furthermore, "judgment (decision)" can be interpreted as "assuming," "expecting," "considering," etc.

[0159] The terms "connected," "coupled," or any variation thereof, refer to any direct or indirect connection or coupling between two or more elements, and may include the presence of one or more intermediate elements between two elements that are "connected" or "coupled" to each other. The coupling or connection between elements may be physical, logical, or a combination thereof. For example, "connected" may be read as "access." As used in this disclosure, two elements may be considered to be "connected" or "coupled" to each other using one or more wires, cables, and / or printed electrical connections, as well as electromagnetic energy having wavelengths in the radio frequency range, microwave range, and optical (both visible and invisible) range, as some non-limiting and non-exhaustive examples.

[0160] The reference signal may be abbreviated as RS (Reference Signal) or may be called a pilot depending on the applicable standard.

[0161] As used in this disclosure, the phrase "based on" does not mean "based only on," unless expressly stated otherwise. In other words, the phrase "based on" means both "based only on" and "based at least on."

[0162] As used in this disclosure, any reference to an element using a designation such as "first," "second," etc. does not generally limit the quantity or order of those elements. These designations may be used in this disclosure as a convenient method of distinguishing between two or more elements. Thus, a reference to a first and a second element does not imply that only two elements may be employed or that the first element must in some way precede the second element.

[0163] The "means" in the configuration of each of the above devices may be replaced with "part," "circuit," "device," etc.

[0164] When used in this disclosure, the terms "include," "including," and variations thereof are intended to be inclusive, similar to the term "comprising." Furthermore, when used in this disclosure, the term "or" is not intended to be an exclusive or.

[0165] In this disclosure, where articles are added by translation, such as a, an, and the in English, the disclosure may include that the nouns following these articles are in the plural form.

[0166] In the present disclosure, the term "A and B are different" may mean "A and B are different from each other." The term may also mean "A and B are each different from C." Terms such as "separate" and "coupled" may also be interpreted in the same way as "different."

[0167] Each aspect / embodiment described in this disclosure may be used alone, in combination, or switched depending on the implementation. Furthermore, notification of predetermined information (e.g., notification that "X is true") is not limited to being done explicitly, but may be done implicitly (e.g., by not notifying the predetermined information).

[0168] Although the present disclosure has been described in detail above, it is clear to those skilled in the art that the present disclosure is not limited to the embodiments described herein. The present disclosure can be implemented in modified and altered forms without departing from the spirit and scope of the present disclosure as defined by the claims. Therefore, the description of the present disclosure is intended to be illustrative and does not have any limiting meaning on the present disclosure. [Explanation of symbols]

[0169] 10 base station 110 Transmitter 120 Receiver 130 Setting section 140 Control Unit 20 terminals 210 Transmitter 220 Receiving unit 230 Setting Section 240 Control Unit 30 network nodes 1001 processor 1002 Storage device 1003 Auxiliary storage device 1004 Communication equipment 1005 Input Device 1006 Output Device 2001 Vehicle 2002 Drive unit 2003 Steering Section 2004 accelerator pedal 2005 brake pedal 2006 Shift Lever 2007 front wheel 2008 rear wheel 2009 Axle 2010 Electronic Control Unit 2012 Information Services Department 2013 Communication Module 2021 Current Sensor 2022 RPM Sensor 2023 Air Pressure Sensor 2024 Vehicle speed sensor 2025 Acceleration Sensor 2026 Brake pedal sensor 2027 Shift lever sensor 2028 Object Detection Sensor 2029 Accelerator pedal sensor 2030 Driving Assistance Systems Department 2031 microprocessor 2032 memory (ROM, RAM) 2033 Communication port (IO port)

Claims

1. a transmitter that transmits a handshake ID and a first timer value to a Security Edge Protection Proxy (SEPP) in a first Transport Layer Security (TLS) session for control; a receiving unit that receives the handshake ID and the second timer value from the SEPP via the first TLS session; a control unit that establishes, with the SEPP, a second TLS session for signal transmission to which the encryption method negotiated in the first TLS session is applied; the transmitting unit, immediately after establishing the second TLS session, transmits an OPTIONS method signal of HTTP (Hypertext Transfer Protocol) including the handshake ID to the SEPP via the second TLS session; The control unit starts a timer that expires at the second timer value, and when the timer expires, causes the sending unit to send an HTTP OPTIONS method signal to the SEPP via the second TLS session.

2. The network node according to claim 1 , wherein the control unit resets and restarts the timer when transmission or reception occurs in the second TLS session.

3. 2. The network node according to claim 1, wherein the control unit starts a timer that expires at the first timer value when the second timer value is not set, and when the timer expires, causes the transmission unit to transmit an HTTP OPTIONS method signal to the SEPP via the second TLS session.

4. a receiving unit that receives a handshake ID and a first timer value from a security edge protection proxy (SEPP) in a first transport layer security (TLS) session for control; a transmitter that transmits the handshake ID and the second timer value to the SEPP via the first TLS session; a control unit that establishes a second TLS session with the SEPP for signal transmission, to which the encryption method negotiated in the first TLS session is applied; the receiving unit receives an OPTIONS method signal of HTTP (Hypertext Transfer Protocol) including the handshake ID from the SEPP via the second TLS session immediately after establishing the second TLS session; The control unit causes the transmission unit to transmit a response to the SEPP when the reception unit receives a signal of an HTTP OPTIONS method from the SEPP via the second TLS session.

5. 2. The network node according to claim 1, wherein the control unit starts a timer that expires at the second timer value, and releases the second TLS session after a certain period of time has elapsed since the timer expired and if an HTTP OPTIONS method signal is not received from the SEPP via the second TLS session.

6. a procedure of transmitting a handshake ID and a first timer value to a security edge protection proxy (SEPP) in a first transport layer security (TLS) session for control; receiving the handshake ID and a second timer value from the SEPP via the first TLS session; establishing a second TLS session with the SEPP for signal transmission, applying the encryption method negotiated in the first TLS session; immediately after establishing the second TLS session, transmitting an OPTIONS method signal of HTTP (Hypertext Transfer Protocol) including the handshake ID to the SEPP via the second TLS session; starting a timer that expires with the second timer value, and sending an HTTP OPTIONS method signal to the SEPP via the second TLS session when the timer expires.

Images