Policy Control Function (PCF) Method and PCF

Abstract

Current 3GPP standards lack mechanisms or procedures for an important problem. This disclosure provides a solution to this important problem. [Solution] A method of a user plane function (UPF) receives at least one of a user equipment identity (UE identity), a data network name (DNN), a single network slice selection assistance information (S-NSSAI), and information related to a UE route selection policy (URSP) rule from a core network node. The method checks whether user data for a user equipment (UE) using a user equipment (UE) session with the DNN and S-NSSAI matches the information related to a UE route selection policy (URSP) rule. The method transmits a result of the check to the core network node.

Description

[Technical field]

[0001] The present disclosure relates to a User Plane Function (UPF) method and a UPF. [Background technology]

[0002] At the SA2#149e plenary meeting, Non-Patent Document 2 describes the 5GC's recognition of the implementation of the URSP in the key issues, namely, research items on improving 5G UE policies. The key issues agreed upon include the following research items: -The UE can implement URSP rules to route application traffic to a PDU session based on URSP rules provisioned by the 5GC, and whether and how the 5GC can be made aware of this. -Whether there are any actions that the 5GS can take after the 5GC knows whether the UE enforces URSP rules for a particular application traffic. If so, what actions should the 5GC take? [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] 3GPP TR 21.905: "Vocabulary for 3GPP Specifications". V17.1.0 (2021-12) [Non-Patent Document 2] S2-2201363 https: / / www.3gpp.org / ftp / tsg_sa / WG2_Arch / TSGS2_149E_Electronic_2022-02 / Docs / S2-2201363.zip [Non-Patent Document 3] 3GPP TS 23.501: "System architecture for the 5G System (5GS)". V17.3.0 (2021-12) [Non-Patent Document 4] 3GPP TS 23.502: "Procedures for the 5G System (5GS)". V17.3.0 (2021-12) [Non-Patent Document 5] 3GPP TS 23.503: "Policy and charging control framework for the 5G System (5GS) Stage 2". V17.3.0 (2021-12) [Non-Patent Document 6] IETF RFC 5905: "Network Time Protocol Version 4: Protocol and Algorithms Specification" https: / / datatracker.ietf.org / doc / html / rfc5905 [Non-Patent Document 7] 3GPP TS 38.413: NG-RAN; NG Application Protocol (NGAP). V16.8.0 (2021-12). Summary of the Invention [Problem to be solved by the invention]

[0004] Current 3GPP standards do not have any mechanisms or procedures that address the above key issues.

[0005] The present disclosure provides a solution, i.e., a mechanism or procedure, regarding this important problem. [Means for solving the problem]

[0006] In an aspect of the disclosure, a method of a User Plane Function (UPF) receives at least one of a User Equipment ID (UE ID), a Data Network Name (DNN), a Single-Network Slice Selection Assistance Information (S-NSSAI), and information related to a UE Route Selection Policy (URSP) rule from a core network node. The method checks whether user data for a User Equipment (UE) using a User Equipment (UE) session with the DNN and S-NSSAI matches the information related to a UE Route Selection Policy (URSP) rule. The method transmits a result of the check to the core network node.

[0007] In an aspect of the disclosure, a User Plane Function (UPF) includes a memory and at least one processor, the at least one processor being configured to access the memory and configured to receive at least one of a User Equipment ID (UE ID), a Data Network Name (DNN), a Single-Network Slice Selection Assistance Information (S-NSSAI), and information related to a UE Route Selection Policy (URSP) rule from a core network node, verify whether user data for a User Equipment (UE) using a User Equipment (UE) session with the DNN and S-NSSAI matches the information related to a UE Route Selection Policy (URSP) rule, and transmit a result of the verification to the core network node. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 is a signaling diagram of a first example of the first aspect (UE policy confirmed by AMF). [Diagram 2] FIG. 2 is a signaling diagram of a second example of the first aspect (UE policy confirmed by SMF). [Diagram 3] FIG. 3 is a signaling diagram of a third example of the first aspect (UE policy confirmed by UPF). [Figure 4] Figure 4 is a signaling diagram of a fourth example of the first aspect (UE policy confirmed by AMF for existing PDU sessions (UE trigger)). [Diagram 5]Figure 5 is a signaling diagram of a fifth example of the first aspect (UE policy confirmed by AMF for existing PDU sessions (AMF trigger)). [Figure 6] FIG. 6 is a diagram showing an outline of the system. [Figure 7] FIG. 7 is a block diagram showing a user equipment (UE). [Figure 8] FIG. 8 is a block diagram illustrating an (R)AN node. [Figure 9] FIG. 9 is a diagram illustrating a system overview of an (R)AN node based on the O-RAN architecture. [Figure 10] FIG. 10 is a block diagram showing a Radio Unit (RU). [Figure 11] FIG. 11 is a block diagram showing a distributed unit (DU). [Figure 12] FIG. 12 is a block diagram showing a centralized unit (CU). [Figure 13] FIG. 13 is a block diagram illustrating the Access and Mobility Management Function (AMF). [Figure 14] FIG. 14 is a block diagram illustrating the Session Management Function (SMF). [Figure 15] FIG. 15 is a block diagram illustrating the User Plane Function (UPF). [Figure 16] FIG. 16 is a block diagram illustrating a Policy Control Function (PCF). [Figure 17] FIG. 17 is a block diagram illustrating the Authentication Server Function (AUSF). [Figure 18]FIG. 18 is a block diagram illustrating Unified Data Management (UDM). [Figure 19] FIG. 19 shows verification of the UE's URSP implementation by the network. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] <abbreviation> For purposes of this specification, the abbreviations given in Non-Patent Document 1 and the following apply: An abbreviation defined in this specification takes precedence over the definition of the same abbreviation in Non-Patent Document 1 if such abbreviation exists.

[0010] 4G-GUTI 4G Globally Unique Temporary UE Identity 5GC 5G Core Network 5GLAN 5G Local Area Network 5GS 5G System 5G-AN 5G Access Network 5G-AN PDB 5G Access Network Packet Delay Budget 5G-EIR 5G-Equipment Identity Register 5G-GUTI 5G Globally Unique Temporary Identifier 5G-BRG 5G Broadband Residential Gateway 5G-CRG 5G Cable Residential Gateway 5G GM 5G Grand Master 5G-RG 5G Residential Gateway 5G-S-TMSI 5G S-Temporary Mobile Subscription Identifier 5G VN 5G Virtual Network 5QI 5G QoS Identifier AF Application Function AMF Access and Mobility Management Function AMF-G Geographically selected Access and Mobility Management Function AMF-NG Non-Geographically selected Access and Mobility Management Function ANDSF Access Network Discovery and Selection Function AS Access Stratum ATSSS Access Traffic Steering, Switching, Splitting ATSSS-LL ATSSS Low-Layer AUSF Authentication Server Function AUTN Authentication token BCCH Broadcast Control Channel BMCA Best Master Clock Algorithm BSF Binding Support Function CAG Closed Access Group CAPIF Common API Framework for 3GPP northbound APIs CHF Charging Function CN PDB Core Network Packet Delay Budget CP Control Plane DAPS Dual Active Protocol Stacks DL Downlink DN Data Network DNAI DN Access Identifier DNN Data Network Name DRX Discontinuous Reception DS-TT Device-side TSN translator ePDG evolved Packet Data Gateway EBI EPS Bearer Identity EPS Evolved Packet System EUI Extended Unique Identifier FAR Forwarding Action Rule FN-BRG Fixed Network Broadband RG FN-CRG Fixed Network Cable RG FN-RG Fixed Network RG FQDN Fully Qualified Domain Name GFBR Guaranteed Flow Bit Rate GMLC Gateway Mobile Location Centre GPSI Generic Public Subscription Identifier GUAMI Globally Unique AMF Identifier GUTI Globally Unique Temporary UE Identity HPLMN Home Public Land Mobile Network HR Home Routed (roaming) IAB Integrated access and backhaul IMEI / TAC IMEI Type Allocation Code IPUPS Inter PLMN UP Security I-SMF Intermediate SMF I-UPF Intermediate UPF LADN Local Area Data Network LBO Local Break Out (roaming) LMF Location Management Function LoA Level of Automation LPP LTE Positioning Protocol LRF Location Retrieval Function MCC Mobile country code MCX Mission Critical Service MDBV Maximum Data Burst Volume MFBR Maximum Flow Bit Rate MICO Mobile Initiated Connection Only MITM Man In the Middle MNC Mobile Network Code MPS Multimedia Priority Service MPTCP Multi-Path TCP Protocol N3IWF Non-3GPP InterWorking Function N3GPP Non-3GPP access N5CW Non-5G-Capable over WLAN NAI Network Access Identifier NAS Non-Access-Stratum NEF Network Exposure Function NF Network Function NGAP Next Generation Application Protocol NID Network identifier NPN Non-Public Network NR New Radio NRF Network Repository Function NSI ID Network Slice Instance Identifier NSSAA Network Slice-Specific Authentication and Authorization NSSAAF Network Slice-Specific Authentication and Authorization Function NSSAI Network Slice Selection Assistance Information NSSF Network Slice Selection Function NSSP Network Slice Selection Policy NSSRG Network Slice Simultaneous Registration Group NW-TT Network-side TSN translator NWDAF Network Data Analytics Function PCF Policy Control Function PCO Protocol Configuration Options PDB Packet Delay Budget PDR Packet Detection Rule PDU Protocol Data Unit PEI Permanent Equipment Identifier PER Packet Error Rate PFD Packet Flow Description PLMN Public Land Mobile Network PNI-NPN Public Network Integrated Non-Public Network PPD Paging Policy Differentiation PPF Paging Proceed Flag PPI Paging Policy Indicator PSA PDU Session Anchor PTP Precision Time Protocol QFI QoS Flow Identifier QoE Quality of Experience RACS Radio Capabilities Signalling optimisation (R)AN (Radio) Access Network RAT Radio Access Technology RG Residential Gateway RIM Remote Interference Management RQA Reflective QoS Attribute RQI Reflective QoS Indication RSN Redundancy Sequence Number SA NR Standalone New Radio SBA Service Based Architecture SBI Service Based Interface SCP Service Communication Proxy SD Slice Differentiator SEAF Security Anchor Functionality SEPP Security Edge Protection Proxy SMF Session Management Function SMSF Short Message Service Function SN Sequence Number SN name Serving Network Name. SNPN Stand-alone Non-Public Network S-NSSAI Single Network Slice Selection Assistance Information SSC Session and Service Continuity SSCMSP Session and Service Continuity Mode Selection Policy SST Slice / Service Type SUCI Subscription Concealed Identifier SUPI Subscription Permanent Identifier SV Software Version TMSI Temporary Mobile Subscriber Identity TNAN Trusted Non-3GPP Access Network TNAP Trusted Non-3GPP Access Point TNGF Trusted Non-3GPP Gateway Function TNL Transport Network Layer TNLA Transport Network Layer Association TSC Time Sensitive Communication TSCAI TSC Assistance Information TSN Time Sensitive Networking TSN GM TSN Grand Master TSP Traffic Steering Policy TT TSN Translator TWIF Trusted WLAN Interworking Function UCMF UE radio Capability Management Function UDM Unified Data Management UDR Unified Data Repository UDSF Unstructured Data Storage Function UE User Equipment UL Uplink UL CL Uplink Classifier UPF User Plane Function UPSI UE Policy Section Identifier URLLC Ultra Reliable Low Latency Communication URRP-AMF UE Reachability Request Parameter for AMF URSP UE Route Selection Policy VID VLAN Identifier VLAN Virtual Local Area Network VPLMN Visited Public Land Mobile Network W-5GAN Wireline 5G Access Network W-5GBAN Wireline BBF Access Network W-5GCAN Wireline 5G Cable Access Network W-AGF Wireline Access Gateway Function

[0011] <Definition> For purposes of this specification, the terms and definitions given in Non-Patent Document 1 and the following apply. Terms defined in this specification take precedence over the definition of the same term in Non-Patent Document 1 if such term appears therein.

[0012] <General remarks> Those skilled in the art will appreciate that elements in the figures may be shown in simplified form and not necessarily drawn to scale. Further, with respect to the structure of a device, one or more components of the device may be represented by conventional symbols in the figures, and the figures may show only certain details appropriate to understanding aspects of the present disclosure, so as not to obscure the figures with details that will be readily apparent to one of ordinary skill in the art having the benefit of the description herein.

[0013] To promote an understanding of the principles of the present disclosure, reference will now be made to the embodiments illustrated in the drawings and specific language will be used to describe the principles. It will nevertheless be understood that no limitation of the scope of the present disclosure is intended thereby. Such alterations and further modifications in the illustrated system, and such further applications of the principles of the present disclosure that would normally occur to one skilled in the art, are to be construed as being within the scope of the present disclosure.

[0014] The terms "comprises," "comprising," or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process or method comprising a list of steps may include not only those steps, but also other steps not expressly listed or inherent in such process or method. Similarly, the term "comprising" preceding one or more devices, entities, subsystems, elements, structures, or components does not, absent further constraints, preclude the presence of other devices, subsystems, elements, structures, components, additional devices, additional subsystems, additional elements, additional structures, or additional components. Throughout this specification, the phrases "in an embodiment," "in another embodiment," and similar terms may all refer to the same embodiment, but do not necessarily do so.

[0015] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs. The systems, methods, and examples provided herein are illustrative only and are not intended to be limiting.

[0016] In the following specification and claims, reference will be made to a number of terms that shall be defined to have the following meanings: The singular forms "a," "an," and "the" include plural references unless the context clearly dictates otherwise.

[0017] Information as used herein refers to data and knowledge, since data is meaningful information and represents values ​​attributed to parameters. Moreover, knowledge refers to an understanding of an abstract or concrete concept. It should be noted that the exemplary system is simplified to facilitate the description of the subject matter of the present disclosure and is not intended to limit the scope of the present disclosure. Other devices, systems, and configurations may be used in addition to or instead of the system to implement aspects disclosed herein, and all such aspects are contemplated to be within the scope of the present disclosure.

[0018] Each of the aspects and elements included in each of the following aspects may be implemented independently or in combination with each other, and each aspect includes different novel features, and thus contributes to achieving different objectives or solving different problems and achieving different advantages.

[0019] An exemplary object of the present disclosure is to provide a method and apparatus that can solve the above problems.

[0020] For example, a Policy Control Function (PCF) provides a policy for PDU session selection, i.e., a UE Route Selection Policy (URSP), to the UE. For example, this policy is used by the UE to determine how to route outgoing traffic from an application at the UE. For example, for an existing PDU session, the UE checks the URSP rules in the UE policy information to determine whether the existing PDU session can be reused.

[0021] However, for example, currently there is no solution in the 3GPP specifications (or 3GPP standards) that can prevent unauthorized applications in a UE.

[0022] A method of a communications apparatus according to an exemplary aspect of the present disclosure receives a policy for a user equipment (UE). The method receives information from the UE related to an application in the UE. The method checks whether the information is consistent with the policy. The method transmits a rejection message if the information is not consistent with the policy.

[0023] A method for a user equipment (UE) according to an example aspect of the present disclosure includes transmitting a first message. The first message includes first information related to an application in the UE. The method includes receiving a second message after transmitting the first message. The second message includes second information. The second information indicates that the application is rejected. The method includes stopping use of the application if the second message is received.

[0024] A method of a communication device according to an exemplary aspect of the present disclosure receives a policy for a user equipment (UE) and information indicating that validation of data of the UE is required. After receiving the information, the method validates whether the data is consistent with the policy. If the data is not consistent with the policy, the method deactivates communication related to the data.

[0025] A method of a communications device according to an example aspect of the present disclosure receives a policy for a user equipment (UE). The method receives a service request message. The service request message includes an identifier of an application in the UE. The method checks whether the identifier is consistent with the policy. If the identifier is consistent with the policy, the method sends an accept message. If the identifier is not consistent with the policy, the method sends a reject message.

[0026] A method for a user equipment (UE) according to an example aspect of the present disclosure includes: sending a service request message when the UE has an established PDU session; the service request message includes an identifier of an application in the UE; the method receives a first message after sending the service request message; the method transmits data if the first message is an accept message; and the method stops using the application if the first message is a reject message.

[0027] A method of a communications device according to an exemplary aspect of the present disclosure receives a policy for a user equipment (UE). The method transmits a request to transmit an identifier of an application in the UE. The method receives the identifier. The method checks whether the identifier is consistent with the policy. The method transmits a message after checking whether the identifier is consistent with the policy. The message includes at least one of information indicating allowed applications and information indicating not allowed applications.

[0028] A method for a user equipment (UE) according to an example aspect of the present disclosure includes receiving a request to transmit an identifier of an application in the UE. The method transmits the identifier. After transmitting the identifier, the method receives a message. The message includes at least one of information indicating an allowed application and information indicating a disallowed application. After receiving the message, the method stops use of the disallowed application.

[0029] A communications apparatus according to an exemplary aspect of the disclosure includes a memory and at least one hardware processor coupled to the memory. The at least one hardware processor is configured to receive a policy for a user equipment (UE). The at least one hardware processor is configured to receive information from the UE related to an application in the UE. The at least one hardware processor is configured to verify whether the information is consistent with the policy. The at least one hardware processor is configured to send a rejection message if the information is not consistent with the policy.

[0030] A user equipment (UE) according to an example aspect of the disclosure includes a memory and at least one hardware processor coupled to the memory. The at least one hardware processor is configured to transmit a first message. The first message includes first information related to an application in the UE. The at least one hardware processor is configured to receive a second message after transmitting the first message. The second message includes second information. The second information indicates that the application is rejected. The at least one hardware processor is configured to stop using the application if the at least one hardware processor receives the second message.

[0031] A communication device according to an exemplary aspect of the present disclosure includes a memory and at least one hardware processor coupled to the memory. The at least one hardware processor is configured to receive a policy for a user equipment (UE) and information indicating that validation of data of the UE is required. After receiving the information, the at least one hardware processor is configured to validate whether the data is consistent with the policy. The at least one hardware processor is configured to deactivate communication associated with the data if the data is not consistent with the policy.

[0032] A communications device according to an exemplary aspect of the disclosure includes a memory and at least one hardware processor coupled to the memory. The at least one hardware processor is configured to receive a policy for a user equipment (UE). The at least one hardware processor is configured to receive a service request message. The service request message includes an identifier of an application in the UE. The at least one hardware processor is configured to verify whether the identifier is consistent with the policy. The at least one hardware processor is configured to send an accept message if the identifier is consistent with the policy. The at least one hardware processor is configured to send a reject message if the identifier is not consistent with the policy.

[0033] A user equipment (UE) according to an example aspect of the present disclosure includes a memory and at least one hardware processor coupled to the memory. The at least one hardware processor is configured to send a service request message when the UE has an established PDU session. The service request message includes an identifier of an application in the UE. The at least one hardware processor is configured to receive a first message after sending the service request message. The at least one hardware processor is configured to send data if the first message is an acceptance message. The at least one hardware processor is configured to stop using the application if the first message is a rejection message.

[0034] A communication device according to an exemplary aspect of the present disclosure includes a memory and at least one hardware processor coupled to the memory. The at least one hardware processor is configured to receive a policy for a user equipment (UE). The at least one hardware processor is configured to send a request to send an identifier of an application in the UE. The at least one hardware processor is configured to receive the identifier. The at least one hardware processor is configured to check whether the identifier is consistent with the policy. The at least one hardware processor is configured to send a message after checking whether the identifier is consistent with the policy. The message includes at least one of information indicating an application that is allowed and information indicating an application that is not allowed.

[0035] A user equipment (UE) according to an example aspect of the present disclosure includes a memory and at least one hardware processor coupled to the memory. The at least one hardware processor is configured to receive a request to transmit an identifier of an application in the UE. The at least one hardware processor is configured to transmit the identifier. The at least one hardware processor is configured to receive a message after transmitting the identifier. The message includes at least one of information indicating an allowed application and information indicating a disallowed application. The at least one hardware processor is configured to stop use of the disallowed application after receiving the message.

[0036] A method of a first device according to an exemplary aspect of the present disclosure includes receiving policy information related to a communication terminal from a second device. The method includes receiving information related to an application for the communication terminal from the communication terminal. The method includes verifying whether the information related to the application for the communication terminal is consistent with the policy information for the communication terminal. The method includes transmitting information related to a rejection to the communication terminal if the information related to the application for the communication terminal is not consistent with the policy information for the communication terminal.

[0037] A method of a third device according to an exemplary embodiment of the present disclosure stores policy information related to a communication terminal from a second device. The method receives information related to an application for the communication terminal from the communication terminal. The method checks whether the information related to the application for the communication terminal is consistent with the policy information for the communication terminal. The method transmits information related to a rejection to the first device if the information related to the application for the communication terminal is not consistent with the policy information for the communication terminal.

[0038] A fourth device method according to an exemplary embodiment of the present disclosure stores policy information related to a communication terminal from a second device. The method receives information related to an application for the communication terminal from a third device for session management. The method receives information indicating that verification of data related to the communication terminal is required from the third device for session management. The method checks whether the information related to the application for the communication terminal is consistent with the policy information related to the communication terminal based on the information indicating that verification of data related to the communication terminal is required. The method transmits information related to a rejection if the information related to the application for the communication terminal is not consistent with the policy information related to the communication terminal.

[0039] A method for a communication terminal according to an exemplary aspect of the present disclosure includes sending a service request message to a first device, the service request message including information regarding an application for the communication terminal, the first device storing policy information regarding the communication terminal from a second device, the first device checking whether the information regarding the application for the communication terminal is consistent with the policy information regarding the communication terminal, and if the information regarding the application for the communication terminal is not consistent with the policy information regarding the communication terminal, the first device sending information related to a rejection to the communication terminal.

[0040] A method for a communication terminal according to an exemplary aspect of the present disclosure includes sending a service request message to a first device including information regarding an application for the communication terminal, the first device storing policy information regarding the communication terminal from a second device, the first device checking whether the information regarding the application for the communication terminal is consistent with the policy information regarding the communication terminal, and if the information regarding the application for the communication terminal is consistent with the policy information regarding the communication terminal, the first device sending information related to approval to the communication terminal.

[0041] A method of a first device according to an exemplary aspect of the present disclosure stores policy information related to a communication terminal from a second device. The method receives a service request message from the communication terminal, the service request message including information related to an application for the communication terminal. The method checks whether the information related to the application for the communication terminal is consistent with the policy information for the communication terminal. The method transmits information related to a rejection to the communication terminal if the information related to the application for the communication terminal is not consistent with the policy information for the communication terminal.

[0042] A method of a first device according to an exemplary embodiment of the present disclosure stores policy information related to a communication terminal from a second device. The method receives a service request message from the communication terminal, the service request message including information related to an application for the communication terminal. The method checks whether the information related to the application for the communication terminal is consistent with the policy information related to the communication terminal. If the information related to the application for the communication terminal is consistent with the policy information related to the communication terminal, the method sends information related to the authorization to the communication terminal.

[0043] A method of a first device according to an exemplary aspect of the present disclosure stores policy information related to a communication terminal from a second device. The method transmits a request message to the communication terminal for information related to an application for the communication terminal. The method receives information related to the application for the communication terminal from the communication terminal. The method checks whether the information related to the application for the communication terminal is consistent with the policy information related to the communication terminal. The method transmits information related to a rejection to the communication terminal if the information related to the application for the communication terminal is not consistent with the policy information related to the communication terminal.

[0044] A method of a first device according to an exemplary aspect of the present disclosure stores policy information related to a communication terminal from a second device. The method sends a request message to the communication terminal for information related to an application for the communication terminal. The method receives information related to the application for the communication terminal from the communication terminal. The method checks whether the information related to the application for the communication terminal is consistent with the policy information related to the communication terminal. The method sends information related to the authorization to the communication terminal if the information related to the application for the communication terminal is consistent with the policy information related to the communication terminal.

[0045] <First aspect> The present aspect discloses a method for network verification as to whether a UE correctly applies URSP rules provisioned by a core network, for example.

[0046] <First Example of the First Aspect> A first example of the first aspect discloses a method in which the PCF 73 sends a UE policy to the AMF 70 when the AMF 70 establishes a UE policy association with the PCF 73. The AMF 70 then checks the request PDU session from the UE 3 as to whether the request from the UE 3 is consistent with the latest UE policy provisioned from the PCF 73 to the UE 3.

[0047] A detailed process of the first example of the first embodiment is described below with reference to FIG.

[0048] Step 1: The UE 3 performs the registration procedure as defined in clause 4.2.2.2.2 in Non-Patent Document 4.

[0049] Step 2: During or after the registration procedure, UE policy establishment through PCF procedures is performed by the PCF 73. This process may be performed based on 4.16.11 in Non-Patent Document 4.

[0050] Step 3: The PCF 73 decides to update the UE policy or a part of the UE policy, for example, the UE policy rules that have been updated since the last UE update on the UE policy. For example, the PCF 73 may decide to update the UE policy based on a local configuration in the PCF 73. For example, if a new UE policy is created and the previous UE policy needs to be updated by the new UE policy, the PCF 73 may decide to update the UE policy. The new UE policy may be created by the PCF 73.

[0051] Step 4: The PCF73 sends a Namf_Communication_N1N2MessageTransfer message or any other existing or new message to the AMF70 on the interface between the PCF73 and the AMF70, and the PCF73 includes the UE ID, the UE policy container, and the UE policy as separate parameters in the message. The UE policy may include the same data as the data in the UE policy container. The UE ID may be an identifier of the UE3. At least one of the UE policy container and the UE policy may be referred to as UE policy information or UE policy rule. If the PCF73 decides to update the UE policy or a part of the UE policy, the PCF73 may send a Namf_Communication_N1N2MessageTransfer message. The PCF73 may send a Namf_Communication_N1N2MessageTransfer message periodically.

[0052] Step 5: Upon receiving the Namf_Communication_N1N2MessageTransfer message from the PCF 73 in step 4 or any other message carrying UE policy information from the PCF 73, the AMF 70 stores or updates the UE context with the UE policy received from the PCF 73. The UE policy may include the NSSP, DNN selection, Time Window and Location criteria, as well as other information, as defined in the URSP rules in Non-Patent Document 5.

[0053] Step 6: Upon receiving the Namf_Communication_N1N2MessageTransfer message from the PCF 73 in step 4, the AMF 70 sends a UE Configuration Update Command message including a UE policy container to the UE 3. The UE policy container in step 6 may be the same as that received in step 4. Step 5 may be performed after step 6.

[0054] Step 7: At some point, the UE 3 sends a UL NAS transport message, a service request message, or any other NAS message to the AMF 70, including a PDU session ID, an App_Id, a DNN, an S-NSSAI, and a NAS container including a PDU session establishment request for establishing a PDU session, to establish a new PDU session, or to reuse an already established PDU session or to modify an already established PDU session. In this disclosure, the App_Id may be used to identify an application running in the OS of the UE 3. In this disclosure, the App_Id may be used to identify an application running in the UE 3. In this disclosure, the DNN and S-NSSAI in the UL NAS transport message may be the DNN and S-NSSAI that the UE 3 or an application of the UE 3 requests to use.

[0055] Step 8: Upon receiving the UL NAS transport message from the UE 3, the AMF 70 checks whether at least one of the App_Id, S-NSSAI, DNN, and other information provided by the UE 3 is consistent or matches the UE policy rule stored in the UE context for the UE 3 in the AMF 70. The UE policy rule stored in the UE context for the UE 3 in the AMF 70 may be the UE policy stored in step 4.

[0056] If the AMF 70 checks whether at least one of the App_Id etc. provided by the UE 3 is consistent with a UE policy, the AMF 70 may check the UE policy or URSP rule corresponding to the PDU session ID received in step 7.

[0057] Step 9: If the AMF 70 finds that at least one of the parameters received in the UL NAS transport message or any other NAS message is not consistent with the UE policy rule for the UE 3 (for example, the received application identity (i.e., App_Id) does not match any route descriptor rule defined in the NSSP corresponding to the application identity, the received App_Id does not match any application identity in the URSP rule, or the received App_Id does not match any application identity in the "application descriptor" of the URSP rule), the AMF 70 sends the DL NAS transport message or any other NAS message to the UE 3, and the AMF 70 includes a reject cause parameter in the message. Otherwise (for example, if the AMF 70 finds that at least one of the parameters received in the UL NAS transport message or any other NAS message is consistent with the UE policy rule for the UE 3), the AMF 70 continues the PDU session establishment procedure according to clause 4.3.2.2.1 of TS 23.502. If the PDU session establishment request is rejected, or if the AMF 70 finds that at least one of the parameters received in the UL NAS transport message or any other NAS message is not consistent with the UE policy rules for the UE 3, the rejection cause parameter in the NAS message to the UE 3, the DL NAS transport message, or any other NAS message may have one or more values ​​from the rejection causes listed below. They may be 5GMM causes. The rejection cause may correspond to the App_Id received from the UE 3 in step 7.

[0058] - According to the URSP rules in the UE context for UE 3 in AMF 70, either "S-NSSAI not allowed" or "application in S-NSSAI not allowed" (i.e., the application with App_Id is not an allowed service in S-NSSAI), or any other indication of the rejection cause, to indicate to UE 3 that an application in UE 3 requesting a service in a particular S-NSSAI is not an allowed service in that S-NSSAI. If UE 3 receives the rejection cause "S-NSSAI not allowed", UE 3 does not allow the rejected application in UE 3 to start another service in the S-NSSAI where the service was rejected. Alternatively, if the UE 3 receives the rejection cause "S-NSSAI not allowed", the S-NSSAI selection rule (e.g., NSSP) in the UE policy in the UE 3 is updated, and then the UE 3 does not allow the rejected application in the UE 3 to start another service in the S-NSSAI for which the service was rejected, until the updated S-NSSAI selection policy (e.g., NSSP) allows the application to trigger a service in the S-NSSAI. The AMF 70 may also include a per-application S-NSSAI back-off timer (e.g., App_Id, S-NSSAI, back-off timer, or any other indication of a back-off timer that is applicable only to a specific application in a specific S-NSSAI) in the DL NAS transport message. In this case, the UE 3 stores the received per-application S-NSSAI back-off timer, and the UE 3 does not allow a service from the rejected application in the S-NSSAI for the duration of the back-off timer for that application in the S-NSSAI. The backoff timer may be referred to as a backoff timer value in this disclosure.

[0059] -Unauthorized DNN, application in unauthorized DNN (i.e., the application with App_Id is not an authorized service from the DNN), or any other indication of the denial cause to indicate to the UE3 that the application in the UE3 requesting the service in a particular DNN is not an authorized service in the DNN according to the URSP rules in the UE context for the UE3 in the AMF70. If the UE3 receives the denial cause "Unauthorized DNN", the UE3 does not allow the denied application in the UE3 to start another service in the DNN where the service is denied. Alternatively, if the UE3 receives the denial cause "Unauthorized DNN", the DNN selector policy in the UE policy in the UE3 (e.g., "DNN Selection" in the "Route Selection Descriptor" of the URSP rule) is updated, and then the updated DNN selector policy allows the application to trigger a service in the DNN, until the UE3 does not allow the denied application in the UE3 to start another service in the DNN where the service is denied. The AMF 70 may also include a per-application DNN backoff timer (e.g., App_Id, DNN, backoff timer, or any other indication of a backoff timer that is applicable only to a particular application in a particular DNN) in the DL NAS transport message. In this case, the UE 3 stores the received per-application DNN backoff timer, and the UE 3 does not allow service from a denied application in that DNN for the duration of the DNN backoff timer.

[0060] - S-NSSAI out of time window (i.e., application with App_Id is not currently an authorized service in S-NSSAI) or any other indication of the rejection cause to indicate to UE3 that an application in UE3 requesting a service in a particular S-NSSAI is not currently an authorized service in that S-NSSAI (i.e., the service is requested outside of the authorized time window for the service in S-NSSAI) according to the URSP rules in the UE context for UE3 in AMF70. If UE3 receives the rejection cause "S-NSSAI out of authorized time window", UE3 does not allow the rejected application in UE3 to start another service in the S-NSSAI for which the service is rejected. Alternatively, if UE3 receives the rejection cause "S-NSSAI out of allowed time window", the S-NSSAI selection time window rule in the UE policy at UE3 (e.g., the "Route Selection Descriptor" of the URSP rule or the "Time Window" in the "Route Selection Descriptor" for the S-NSSAI of the URSP rule) is updated, and then UE3 does not allow the rejected application at UE3 to start another service in the S-NSSAI for which the service was rejected until the updated S-NSSAI selection time window policy allows the application to trigger a service in the S-NSSAI. AMF70 may also include a per-application S-NSSAI backoff timer (e.g., App_Id, S-NSSAI, backoff timer, or any other indication of a backoff timer that is applicable only to a particular application in a particular S-NSSAI) in the DL NAS transport message. In this case, UE3 stores the received S-NSSAI backoff timer for each application, and UE3 does not allow service from a denied application in the S-NSSAI for the duration of the backoff timer for that application in the S-NSSAI.The AMF 70 may calculate a value for the S-NSSAI backoff timer such that the S-NSSAI backoff timer for a rejected application expires within the allowed time window for that S-NSSAI.

[0061] -DNN out of time window (i.e., application with App_Id is not currently an authorized service in the DNN) or any other indication of the denial cause to indicate to the UE3 that an application in the UE3 requesting a service in a particular DNN is not currently an authorized service in that DNN (i.e., the service is requested outside of the authorized time window for the service in the DNN) according to the URSP rules in the UE context for the UE3 in AMF70. If the UE3 receives the denial cause "DNN out of authorized time window", the UE3 does not allow the denied application in the UE3 to start another service in the DNN for which the service is denied. Alternatively, when the UE3 receives the rejection cause "DNN out of allowed time window", the DNN selection time window rule in the UE policy in the UE3 (e.g., in this disclosure, the "Route Selection Descriptor" of the URSP rule or the "Time Window" in the "Route Selection Descriptor" for the DNN of the URSP rule) is updated, and then the UE3 does not allow the rejected application in the UE3 to start another service in the DNN for which the service is rejected until the updated DNN selection time window policy allows the application to trigger a service in the DNN. The AMF70 may also include a per-application DNN backoff timer (e.g., App_Id, DNN, backoff timer, or any other indication of a backoff timer that is applicable only to a specific application in a specific DNNI) in the DL NAS transport message. In this case, the UE3 stores the received per-application DNN backoff timer, and the UE3 does not allow a service from the rejected application in the DNN for the duration of the backoff timer for the application in the DNN. The AMF 70 may calculate a value for the DNN backoff timer such that the DNN backoff timer for a rejected application expires within the allowed time window for that DNN.

[0062] - S-NSSAI out of location (i.e., the application with App_Id is not an authorized service for S-NSSAI at this location or area) or any other indication of the rejection cause to indicate to the UE3 that the application in the UE3 requesting the service in a particular S-NSSAI is not an authorized service in that S-NSSAI at the current location (i.e., the service is requested out of the authorized location for the service in the S-NSSAI) according to the URSP rules in the UE context for the UE3 in the AMF70. If the UE3 receives the rejection cause "S-NSSAI out of location", the UE3 does not allow the rejected application in the UE3 to start another service in the S-NSSAI for which the service was rejected. Alternatively, if the UE 3 receives the rejection cause "S-NSSAI out of location", the UE 3 does not allow the rejected application in the UE 3 to start another service on the S-NSSAI for which the service was rejected until the UE 3 reselects another cell, the UE 3 moves to another Tracking Area (TA), another Registration Area (RA), or another PLMN, or the S-NSSAI selection location rule in the UE policy in the UE 3 (e.g., the "Route Selection Descriptor" of the URSP rule or the "Location Criteria" in the "Route Selection Descriptor" for the S-NSSAI of the URSP rule) is updated, and then the updated S-NSSAI selection location policy allows the application to trigger a service on the S-NSSAI. AMF70 may also include a per-application S-NSSAI backoff timer (e.g., App_Id_S-NSSAI, backoff timer, or any other indication of a backoff timer that is applicable only to a particular application in a particular S-NSSAI) in the DL NAS transport message.In this case, UE3 stores the received S-NSSAI backoff timer for each application, and UE3 does not allow service from a rejected application in the S-NSSAI for the duration of the backoff timer for that application in the S-NSSAI, unless the UE reselects another cell or the UE moves to another TA, another RA, or another PLMN.

[0063] - Out-of-location DNN (i.e., application with App_Id is not an authorized service in the DNN in this location or area) or any other indication of the rejection cause to indicate to the UE3 that an application in the UE3 requesting a service in a particular DNN is not an authorized service in that DNN in the current location or area (i.e., the service is requested out of an authorized location for the service in the DNN) according to the URSP rules in the UE context for the UE3 in AMF70. If the UE3 receives the rejection cause "out-of-location DNN", the UE3 does not allow the rejected application in the UE3 to start another service in the DNN for which the service was rejected. Alternatively, if the UE 3 receives the rejection cause "DNN out of location", the UE 3 does not allow the rejected application in the UE 3 to start another service in the DNN for which the service is rejected, until the UE 3 reselects another cell, the UE 3 moves to another Tracking Area (TA), another Registration Area (RA), or another PLMN, or the DNN selection location rule in the UE policy in the UE 3 (e.g., the "Route Selection Descriptor" of the URSP rule or the "Location Criteria" in the "Route Selection Descriptor" for the DNN in the URSP rule) is updated, and then the updated DNN selection location policy allows the application to trigger a service in the DNN. The AMF 70 may also include a per-application DNN backoff timer (e.g., App_Id, DNN, backoff timer, or any other indication of a backoff timer that is applicable only to a specific application in a specific DNN) in the DL NAS transport message. In this case, the UE3 stores the DNN backoff timer for each received application, and the UE3 does not allow service from a rejected application in the DNN for the duration of the backoff timer for that application in the DNN, unless the UE reselects another cell or the UE moves to another TA, another RA, or another PLMN.

[0064] The rejection cause may refer to information that indicates that the application identified by the App_Id is rejected.

[0065] The rejection cause may be referred to as information indicating that an application in the UE3 is rejected.

[0066] For example, if the UE 3 receives a rejection cause, the UE 3 may stop using the application identified by the App_Id sent in step 7.

[0067] For example, if the UE 3 receives a rejection cause, the UE 3 may stop using the application.

[0068] The rejection cause may be referred to as information requesting that the use of the application identified by the App_Id sent in step 7 be stopped.

[0069] The rejection cause may be referred to as information that requests the use of the application in the UE3 to be stopped.

[0070] For example, AMF 70 may check whether the current time matches the "time window" in the "route selection descriptor" defined in the URSP rule. If AMF 70 determines that the current time does not match the "time window" (e.g., if AMF 70 determines that the current time is not within the period or time window defined by the "time window"), AMF 70 may send a DL NAS transport message with a rejection cause set to "S-NSSAI out of time window" or "DNN out of time window".

[0071] When the AMF 70 checks the "time window", it uses the time data provided by the Network Time Protocol (NTP) as defined in Non-Patent Document 6 as the current time.

[0072] For example, the AMF 70 may check whether the current UE 3 location matches the "Location Criteria" in the "Route Selection Descriptor" defined in the URSP rule. If the AMF 70 determines that the current UE 3 location does not match the "Location Criteria" (e.g., if the AMF 70 determines that the current UE 3 location does not match the location or area defined by the "Location Criteria" or that the current UE 3 location is not included in the location or area defined by the "Location Criteria"), the AMF 70 may send a DL NAS transport message including a rejection cause set to "S-NSSAI out of location" or "DNN out of location".

[0073] When the AMF 70 determines the location for UE 3 (e.g., the location of UE 3), the AMF 70 uses the user location information in the INITIAL UE message from RAN 5 when the UL NAS transport message is conveyed from RAN 5 to AMF 70 in accordance with non-patent document 7.

[0074] For example, AMF 70 may check whether the S-NSSAI received in step 7 matches the S-NSSAI. If AMF 70 determines that the S-NSSAI received in step 7 does not match the S-NSSAI in "Network Slice Selection", AMF 70 may send a DL NAS Transport message with a reject cause set to "S-NSSAI not allowed" or "Application in S-NSSAI not allowed".

[0075] For example, AMF 70 may check whether the DNN received in step 7 matches the DNN in the URSP rule (e.g., "DNN Selection" in the "Route Selection Descriptor" defined in the URSP rule). If AMF 70 determines that the DNN received in step 7 does not match the DNN in the URSP rule, AMF 70 may send a DL NAS transport message with a rejection cause set to "DNN not allowed" or "Application in DNN not allowed".

[0076] The AMF 70 may check whether at least one of the App_Id, DNN, S-NSSAI, current time, and current UE 3 location matches the corresponding parameters in the URSP rule as described above. If the AMF 70 determines that at least one of the App_Id, DNN, S-NSSAI, current time, and current UE 3 location does not match the corresponding parameters in the URSP rule, the AMF 70 may send a DL NAS transport message including a rejection cause as described above.

[0077] According to the first example of the first aspect, for example, 5GC (e.g., AMF) can recognize whether or when a UE implements a URSP rule. In addition, according to the first example of the first aspect, for example, an action that 5GS (e.g., AMF) can take after 5GC recognizes whether a UE implements a URSP rule can be provided. Furthermore, according to the first example of the first aspect, for example, a solution can be provided that can prevent unauthorized applications in a UE.

[0078] For example, a first device corresponding to AMF 70 receives policy information related to the communication terminal from a second device corresponding to PCF 73. The first device receives information related to applications for the communication terminal from a communication terminal corresponding to UE 3. The first device checks whether the information related to applications for the communication terminal is consistent with the policy information related to the communication terminal. If the information related to applications for the communication terminal is not consistent with the policy information related to the communication terminal, the first device sends information related to rejection to the communication terminal.

[0079] <Modification 1 of the first example of the first aspect> In step 2, the PCF 73 may send the UE policy to the AMF 70 by a Create Npcf_UEPolicyControl response message. The UE policy may be the same as the UE policy that the PCF 73 provides to the UE 3 in a UE Policy Container during the UE Configuration Update procedure for the transparent UE policy delivery procedure as defined in clause 4.2.4.3 of 3GPP TS 2013-010111.

[0080] <Modification 2 of the first example of the first aspect> In step 7, the UL NAS transport message may be replaced with a service request message. In this case, the UL NAS transport message in step 7 is replaced with a service request message.

[0081] In addition, the DL NAS transport message in step 9 is replaced with a service denial message.

[0082] The Service Request message may contain the same information as the UL NAS Transport message.

[0083] The service denial message may contain the same information as the DL NAS transport message.

[0084] <Modification 3 of the first example of the first aspect> In step 4, instead of including the entire UE policy in the message to AMF 70, PCF 73 may include in the message to AMF 70 only the UE policy for UE 3 related to the PDU Session establishment parameters provided by UE 3 to AMF 70 in step 7.

[0085] For this purpose, the PCF73 may include in the message to the AMF70 an S-NSSAI selection policy for the UE3 (e.g., NSSP), a DNN selection policy for the UE3 (e.g., "DNN Selection" in the "Route Selection Descriptor"), a Time windows parameter for the UE3 that defines a time window during which services in the S-NSSAI or DNN are allowed (e.g., "Time Window" in the "Route Selection Descriptor"), and a Location parameter for the UE3 that defines a location during which services or access in the S-NSSAI or DNN are allowed (e.g., "Location Criteria" in the "Route Selection Descriptor"). The DNN selection policy may be referred to as a DNN selection rule. The DNN selection policy may be referred to as the DNN selection rule. The time window parameter may be referred to as an allowed time window parameter. The location parameter may be referred to as an allowed location. The location parameter may be indicated as a cell identity, a list of cell identities, a Tracking Area (TA) identity, a list of TA identities, or a registration area identity. The AMF 70 stores or updates these parameters provided by the PCF 73 in the UE context in the AMF 70. In step 8, the AMF 70 verifies whether at least one of the S-NSSAI and DNN provided by the UE 3 for the application with the App_Id parameter in the NAS message to the AMF 70 in step 7 matches at least one of the S-NSSAI selection rules, the DNN selection rules, the allowed time windows, and the allowed locations for the application with the App_ID from the UE context in the AMF 70. If at least one of these rules does not match, the AMF 70 rejects the NAS message from the UE 3 with a reject cause according to the description of step 9 in FIG.

[0086] For example, the PCF 73 may obtain information about PDU sessions that the UE 3 may establish from other network nodes. For example, the PCF 73 may store information about PDU sessions that the UE 3 may establish in advance. The information about the PDU sessions that the UE 3 may establish may include an S-NSSAI selection policy (NSSP) for the UE 3, a DNN selection policy for the UE 3, a time window parameter for the UE 3 that defines a time window in which a service in the S-NSSAI or DNN is allowed, and a location parameter for the UE 3 that defines a location in which a service or access in the S-NSSAI or DNN is allowed. The PCF 73 may determine the content of the message in step 4 based on the information about the PDU sessions that the UE 3 may establish.

[0087] <Second Example of the First Aspect> A second example of the first aspect discloses a method in which the PCF 73 sends a UE policy to the SMF 71 via the AMF 70 when a PDU session establishment is requested by the UE 3. The SMF 71 then checks the request PDU session from the UE 3 as to whether the request from the UE 3 is consistent with the UE policy.

[0088] A detailed process of the second example of the first embodiment is described below with reference to FIG.

[0089] Step 1 is the same as steps 1 to 6 in the first example of the first aspect.

[0090] Step 2: The UE policy including the URSP is provided by the PCF 73 to the AMF 70 as specified in steps 4 and 5 of the first example of the first aspect. If the AMF 70 has already received the UE policy from the PCF 73 in step 1, step 2 may be skipped.

[0091] Step 3: At some point, the UE 3 sends a UL NAS Transport message, a Service Request message, or any other NAS message to the AMF 70, including a PDU Session ID, App_Id, DNN, S-NSSAI, and a NAS container including a PDU Session Establishment Request for establishing a PDU session, to establish a new PDU session, or to reuse an already established PDU session or to modify an already established PDU session.

[0092] Step 4: Upon receiving the UL NAS transport message from the UE 3, the AMF 70 sends a Nsmf_PDUSession_CreateSMContext request message to the SMF 71, including a SM NAS container including the PDU Session ID, App_Id, DNN, S-NSSAI, UE Policy, and PDU Session Establishment Request message. The Nsmf_PDUSession_CreateSMContext request message may include location information. A UE Policy parameter (or UE Policy) is populated by the AMF 70 from the UE context of the UE 3. The UE Policy may be received from the PCF 73 in step 1 or step 2. The location information is populated by the AMF 70 from the user location information received in the INITIAL UE message from the RAN 5. The location information may indicate a current location for the UE 3. The AMF 70 may use the user location information in the INITIAL UE MESSAGE from the RAN 5 as location information when the UL NAS transport message is conveyed from the RAN 5 to the AMF 70, according to Non-Patent Document 7.

[0093] Step 5: Upon receiving the Nsmf_PDUSession_CreateSMContext request message from AMF70, SMF71 checks whether at least one of the App_Id, S-NSSAI, DNN, and other information provided by AMF70 is consistent with the UE policy received from AMF70 (for example, SMF71 checks whether the received application identity (i.e., App_Id) matches any route descriptor rule defined in the NSSP corresponding to the application identity, whether the received App_Id matches any application identity in the URSP rule, or whether the received App_Id matches any application identity in the "application descriptor" of the URSP rule).

[0094] If the SMF71 checks whether at least one of the App_Id etc. provided by the AMF70 is consistent with a UE policy, the SMF71 may check the UE policy or URSP rule corresponding to the PDU session ID received in step 4.

[0095] Step 6: If the SMF 71 finds that at least one of the parameters received in the Nsmf_PDUSession_CreateSMContext request message is not consistent with the UE policy (e.g., the received application identity (i.e., the received App_Id) does not match any root descriptor rule defined in the NSSP corresponding to the application identity, the received App_Id does not match any application identity in the URSP rule, or the received App_Id does not match any application identity in the "application descriptor" of the URSP rule), the SMF 71 sends a Nsmf_PDUSession_CreateSMContext response message including a cause parameter to the AMF 70. Otherwise (e.g., if the SMF 71 finds that at least one of the parameters received in the Nsmf_PDUSession_CreateSMContext request message is consistent with the UE policy), the SMF 71 continues the PDU session establishment procedure according to clause 4.3.2.2.1 of TS 23.502. If the PDU session establishment request is rejected by the SMF 71 or if the SMF 71 finds that at least one of the parameters received in the Nsmf_PDUSession_CreateSMContext request message is not consistent with the UE policy, the cause parameter included in the Nsmf_PDUSession_CreateSMContext response message to the AMF 70 may have one or more values ​​from the causes listed below. They may be all SM causes. The cause parameter may correspond to the App_Id received from the UE 3 in step 3.

[0096] - According to the URSP rules in SMF71, to indicate to the UE3 that the application in the UE3 requesting the service in a particular S-NSSAI is not an authorized service in the S-NSSAI, either S-NSSAI not authorized or application in the S-NSSAI not authorized (i.e., the application with App_Id is not an authorized service in the S-NSSAI), or any other indication of the rejection cause. If the UE3 receives the rejection cause "S-NSSAI not authorized", the UE3 does not allow the rejected application in the UE3 to start another service in the S-NSSAI for which the service is rejected. Alternatively, if the UE3 receives the rejection cause "S-NSSAI not authorized", the S-NSSAI selection rule in the UE3 (e.g., NSSP) is updated in the UE policy in the UE3, and then the UE3 does not allow the rejected application in the UE3 to start another service in the S-NSSAI for which the service is rejected, until the updated S-NSSAI selection policy (e.g., NSSP) allows the application to trigger a service in the S-NSSAI. SMF 71 may also include a per-application S-NSSAI backoff timer (e.g., App_Id, S-NSSAI, backoff timer, or any other indication of a backoff timer that is applicable only to a particular application in a particular S-NSSAI) in the Nsmf_PDUSession_CreateSMContext response message. In this case, UE 3 stores the received per-application S-NSSAI backoff timer, and UE 3 does not allow service from a denied application in the S-NSSAI for the duration of the backoff timer for that application in the S-NSSAI.

[0097] -Unauthorized DNN, application in unauthorized DNN (i.e., the application with App_Id is not an authorized service from the DNN), or any other indication of the denial cause to indicate to the UE3 that the application in the UE3 requesting the service in a particular DNN is not an authorized service in the DNN according to the URSP rules in SMF71. If the UE3 receives the denial cause "Unauthorized DNN", the UE3 does not allow the denied application in the UE3 to start another service in the DNN where the service is denied. Alternatively, if the UE3 receives the denial cause "Unauthorized DNN", the DNN selector policy in the UE3's UE policy (e.g., "DNN selection" in the "Route Selection Descriptor" of the URSP rule) is updated, and then the UE3 does not allow the denied application in the UE3 to start another service in the DNN where the service is denied, until the updated DNN selector policy allows the application to trigger a service in the DNN. SMF71 may also include a per-application DNN backoff timer (e.g., App_Id, DNN, backoff timer, or any other indication of a backoff timer that is applicable only to a specific application in a specific DNN) in the Nsmf_PDUSession_CreateSMContext response message. In this case, UE3 stores the received per-application DNN backoff timer, and UE3 does not allow service from denied applications in that DNN for the duration of the DNN backoff timer.

[0098] - S-NSSAI out of time window (i.e., application with App_Id is not currently an authorized service in S-NSSAI) or any other indication of the rejection cause to indicate to UE3 that an application in UE3 requesting a service in a particular S-NSSAI is not currently an authorized service in that S-NSSAI (i.e., the service is requested outside of the authorized time window for the service in S-NSSAI) according to the URSP rules in SMF71. If UE3 receives the rejection cause "S-NSSAI out of authorized time window", UE3 does not allow the rejected application in UE3 to start another service in the S-NSSAI for which the service was rejected. Alternatively, if the UE3 receives the rejection cause "S-NSSAI out of allowed time window", the S-NSSAI selection time window rule in the UE policy at the UE3 (e.g., the "Route Selection Descriptor" of the URSP rule or the "Time Window" in the "Route Selection Descriptor" for the S-NSSAI of the URSP rule) is updated, and then the UE3 does not allow the rejected application at the UE3 to start another service in the S-NSSAI for which the service was rejected until the updated S-NSSAI selection time window policy allows the application to trigger a service in the S-NSSAI. SMF71 may also include a per-application S-NSSAI backoff timer (e.g., App_Id, DNN, backoff timer, or any other indication of a backoff timer that is applicable only to a particular application in a particular S-NSSAI) in the Nsmf_PDUSession_CreateSMContext response message. In this case, UE3 stores the received S-NSSAI backoff timer for each application, and UE3 does not allow service from a denied application in the S-NSSAI for the duration of the backoff timer for that application in the S-NSSAI.SMF71 may calculate a value for the S-NSSAI backoff timer for a rejected application such that the S-NSSAI backoff timer expires within the allowed time window for that S-NSSAI.

[0099] -DNN out of time window (i.e., application with App_Id is not currently an authorized service in the DNN) or any other indication of the denial cause to indicate to the UE3 that an application in the UE3 requesting a service in a particular DNN is not currently an authorized service in that DNN (i.e., the service is requested outside of the authorized time window for the service in the DNN) according to the URSP rules in SMF71. If the UE3 receives the denial cause "DNN out of authorized time window", the UE3 will not allow the denied application in the UE3 to start another service in the DNN for which the service was denied. Alternatively, when the UE3 receives the rejection cause "DNN out of allowed time window", the DNN selection time window rule in the UE policy in the UE3 (e.g., in this disclosure, the "Route Selection Descriptor" of the URSP rule or the "Time Window" in the "Route Selection Descriptor" for the DNN of the URSP rule) is updated, and then the UE3 does not allow the rejected application in the UE3 to start another service in the DNN for which the service is rejected until the updated DNN selection time window policy allows the application to trigger a service in the DNN. The SMF71 may also include a per-application DNN back-off timer (e.g., App_Id, DNN, back-off timer, or any other indication of a back-off timer that is applicable only to a specific application in a specific DNNI) in the Nsmf_PDUSession_CreateSMContext response message. In this case, the UE3 stores the received per-application DNN back-off timer, and the UE3 does not allow a service from the rejected application in the DNN for the duration of the back-off timer for the application in the DNN. SMF71 may calculate a value for the DNN backoff timer such that the DNN backoff timer for a rejected application expires within the allowed time window for that DNN.

[0100] - S-NSSAI out of location (i.e., application with App_Id is not an authorized service for S-NSSAI at this location) or any other indication of the rejection cause to indicate to the UE3 that the application in the UE3 requesting the service in a particular S-NSSAI is not an authorized service in that S-NSSAI at the current location (i.e., the service is requested out of the authorized location for the service in the S-NSSAI) according to the URSP rules in SMF71. If the UE3 receives the rejection cause "S-NSSAI out of location", the UE3 does not allow the rejected application in the UE3 to start another service in the S-NSSAI for which the service was rejected. Alternatively, if the UE 3 receives the rejection cause "S-NSSAI out of location", the UE 3 does not allow the rejected application in the UE 3 to start another service on the S-NSSAI for which the service was rejected until the UE 3 reselects another cell, the UE 3 moves to another Tracking Area (TA), another Registration Area (RA), or another PLMN, or the S-NSSAI selection location rule in the UE policy in the UE 3 (e.g., the "Route Selection Descriptor" of the URSP rule or the "Location Criteria" in the "Route Selection Descriptor" for the S-NSSAI of the URSP rule) is updated, and then the updated S-NSSAI selection location policy allows the application to trigger a service on the S-NSSAI. SMF71 may also include a per-application S-NSSAI backoff timer (e.g., App_Id, DNN, backoff timer, or any other indication of a backoff timer that is applicable only to a particular application in a particular S-NSSAI) in the Nsmf_PDUSession_CreateSMContext response message.In this case, UE3 stores the received S-NSSAI backoff timer for each application, and UE3 does not allow service from a rejected application in the S-NSSAI for the duration of the backoff timer for that application (in the S-NSSAI), unless the UE reselects another cell or the UE moves to another TA, another RA, or another PLMN.

[0101] - Out-of-location DNN (i.e., application with App_Id is not an authorized service in the DNN at this location) or any other indication of the denial cause to indicate to the UE3 that an application in the UE3 requesting a service in a particular DNN is not an authorized service in that DNN at the current location (i.e., the service is requested out of an authorized location for the service in the DNN) according to the URSP rules in SMF71. If the UE3 receives the denial cause "out-of-location DNN", the UE3 will not allow the denied application in the UE3 to start another service in the DNN where the service was denied. Alternatively, if the UE 3 receives the rejection cause "DNN out of location", the UE 3 does not allow the rejected application in the UE 3 to start another service in the DNN where the service is rejected until the UE 3 reselects another cell, the UE 3 moves to another Tracking Area (TA), another Registration Area (RA), or another PLMN, or the DNN selection location rule in the UE policy in the UE 3 (e.g., the "Route Selection Descriptor" of the URSP rule or the "Location Criteria" in the "Route Selection Descriptor" for the DNN in the URSP rule) is updated, and then the updated DNN selection location policy allows the application to trigger a service in the DNN. The SMF 71 may also include a per-application DNN backoff timer (e.g., App_Id, DNN, backoff timer, or any other indication of a backoff timer that is applicable only to a specific application in a specific DNN) in the Nsmf_PDUSession_CreateSMContext response message. In this case, the UE 3 stores the DNN backoff timer for each received application, and the UE 3 does not allow service from the rejected application (in the DNN) for the duration of the backoff timer for that application in the DNN, unless the UE reselects another cell or the UE moves to another TA, another RA, or another PLMN.

[0102] For example, SMF71 may check whether the current time matches the "time window" in the "route selection descriptor" defined in the URSP rules. If SMF71 determines that the current time does not match the "time window" (e.g., if SMF71 determines that the current time is not within the period or time window defined by the "time window"), SMF71 may send a DL NAS transport message with a reject cause set to "S-NSSAI out of time window" or "DNN out of time window".

[0103] When the SMF 71 checks the "time window", it uses the time data provided by the Network Time Protocol (NTP) as defined in Non-Patent Document 6 as the current time.

[0104] For example, SMF71 may check whether the current UE3 location matches the "Location Criteria" in the "Route Selection Descriptor" defined in the URSP rule. If SMF71 determines that the current UE3 location does not match the "Location Criteria" (e.g., if SMF71 determines that the current UE3 location does not match the location or area defined by the "Location Criteria" or that the current UE3 location is not included in the location or area defined by the "Location Criteria"), SMF71 may send a DL NAS transport message including a reject cause set to "S-NSSAI out of location" or "DNN out of location".

[0105] When SMF71 checks the location for UE3 (e.g., the location of US3), SMF71 uses the user location information received from AMF70 in the Nsmf_PDUSession_CreateSMContext request message.

[0106] Step 7: Upon receiving the Nsmf_PDUSession_CreateSMContext response message from the SMF 71, the AMF 70 sends a DL NAS transport message including a SM NAS container including a PDU Session Reject message with a cause parameter to the UE 3. If the UE 3 receives the cause parameter, the UE 3 may perform a process based on the cause parameter as mentioned in step 6.

[0107] The SMF 71 may check whether at least one of the App_Id, DNN, S-NSSAI, current time, and current UE 3 location matches the corresponding parameters in the URSP rule in the same manner as the AMF 70 in the first example of the first aspect. If the SMF 71 determines that at least one of the App_Id, DNN, S-NSSAI, current time, and current UE 3 location does not match the corresponding parameters in the URSP rule, the SMF 71 may send a rejection cause via the AMF 70 as described above.

[0108] For example, the third device corresponding to SMF71 stores policy information regarding the communication terminal from the second device. For example, the communication terminal corresponds to UE3. For example, the second device corresponds to PCF73. The third device receives information regarding applications for the communication terminal from the communication terminal. The third device checks whether the information regarding applications for the communication terminal is consistent with the policy information regarding the communication terminal. If the information regarding applications for the communication terminal is not consistent with the policy information regarding the communication terminal, the third device sends information related to the rejection to the first device corresponding to AMF70.

[0109] According to the second example of the first aspect, for example, the 5GC (e.g., SMF) can recognize whether or not the UE implements the URSP rule. In addition, according to the second example of the first aspect, for example, an action that the 5GS (e.g., SMF) can take after the 5GC recognizes whether the UE implements the URSP rule can be provided. Furthermore, according to the second example of the first aspect, for example, a solution can be provided that can prevent unauthorized applications in the UE.

[0110] <Modification 1 of the second example of the first aspect> When the SMF 71 receives the Nsmf_PDUSession_CreateSMContext request message from the AMF 70 in step 4, the SMF 71 may obtain UE policy information from the PCF 73 via the Npcf_UEPolicyControl service provided by the PCF 73. In this case, the following steps are performed between the SMF 71 and the PCF 73.

[0111] The SMF 71 sends an Npcf_UEPolicyControl_Create message including a user ID to the PCF 73. The user ID may be identification information of the UE 3. The user ID may be a SUPI. The user ID may be a SUPI of the UE 3.

[0112] The PCF 73 finds the UE policy rule based on the received user ID (e.g., the PCF 73 finds the UE policy for the UE 3) and sends an Npcf_UEPolicyControl_UpdateNotify message containing the UE policy to the SMF 71. The UE policy may be represented by a UE policy association ID.

[0113] If the Nsmf_PDUSession_CreateSMContext request message does not include a UE policy, the SMF71 may send an Npcf_UEPolicyControl_Create message to the PCF73.

[0114] Regardless of whether the Nsmf_PDUSession_CreateSMContext request message includes a UE policy, the SMF 71 may send an Npcf_UEPolicyControl_Create message to the PCF 73.

[0115] <Modification 2 of the second example of the first embodiment> In step 3, the UL NAS transport message may be replaced with a service request message. In this case, the UL NAS transport message in step 3 is replaced with a service request message.

[0116] In addition, the DL NAS transport message in step 7 is replaced with a service denial message.

[0117] The Service Request message may contain the same information as the UL NAS Transport message.

[0118] The service denial message may contain the same information as the DL NAS transport message.

[0119] <Third Example of the First Aspect> A third example of the first aspect discloses a method in which the PCF 73 sends a UE policy to the UPF 72 via the AMF 70 and the SMF 71 when a PDU session establishment is requested by the UE 3. The UPF 72 then checks the uplink user data from the UE 3 as to whether the user data from the UE 3 is consistent with the UE policy.

[0120] A detailed process of the third example of the first embodiment is described below with reference to FIG.

[0121] Step 1 is the same as the sequence of steps 1 to 6 in the first example of the first aspect.

[0122] Step 2: The UE policy including the URSP is provided by the PCF 73 to the AMF 70 as specified in steps 4 and 5 of the first example of the first aspect. If the AMF 70 has already received the UE policy from the PCF 73 in step 1, step 2 may be skipped.

[0123] Step 3: At some point, the UE 3 sends a UL NAS Transport message, a Service Request message, or any other NAS message to the AMF 70, including a PDU Session ID, App_Id, DNN, S-NSSAI, and a NAS container including a PDU Session Establishment Request for establishing a PDU session, to establish a new PDU session, or to reuse an already established PDU session or to modify an already established PDU session.

[0124] Step 4: Upon receiving the UL NAS transport message from the UE 3, the AMF 70 sends an Nsmf_PDUSession_CreateSMContext request message to the SMF 71, including a SM NAS container including the PDU Session ID, App_Id, DNN, S-NSSAI, the "URSP observation needed" parameter and the UE policy, as well as the PDU Session Establishment Request message. The UE policy parameter is populated by the AMF 70 from the UE context of the UE 3. The UE policy may be the one received from the PCF 73 in step 1 or step 2. The "URSP observation needed" parameter is populated or created by the AMF 70 to indicate to the SMF 71 that user data validation at the UPF 72 is requested. The "URSP observation needed" parameter may be referred to as information indicating that validation of the data of the UE 3 or data related to the UE 3 is required.

[0125] Step 5: Upon receiving the Nsmf_PDUSession_CreateSMContext request message from the AMF 70, the SMF 71 sends an N4 Session Establishment Request message including the "Required URSP Observation" parameters and the UE policy to the UPF 72. The "Required URSP Observation" parameters and the UE policy may be input by copying from the parameters received in the Nsmf_PDUSession_CreateSMContext request message from the AMF 70. The "Required URSP Observation" parameters and the UE policy may be those received in the Nsmf_PDUSession_CreateSMContext request message from the AMF 70.

[0126] Step 6: UPF 72 sends an N4 session establishment response message to SMF 71. If UPF 72 receives an N4 session establishment request message from SMF 71, UPF 72 may send an N4 session establishment response message.

[0127] Step 7: The PDU session establishment procedure continues from step 11 of section 4.3.2.2.1 in Non-Patent Document 4.

[0128] Step 8: The UPF 72 receives uplink user data from the UE 3 through the RAN 5. The uplink user data may include an App_ID.

[0129] Step 9: Upon receiving uplink user data from UE 3 via RAN 5, UPF 72 checks whether the received uplink user data is consistent with the UE policy received from PCF 73 via AMF 70 and SMF 71 (e.g., whether the received application identity (i.e., App_Id) does not match any route descriptor rule defined in the NSSP corresponding to the application identity, whether the received App_Id matches any application identity in the URSP rule, or whether the received App_Id matches any application identity in the “application descriptor” of the URSP rule).

[0130] Step 10: If the UPF 72 finds that the received uplink user data is not consistent with the UE policy (e.g., the received application identity (i.e., App_Id) does not match any route descriptor rule defined in the NSSP corresponding to the application identity, the received App_Id does not match any application identity in the URSP rule, or the received App_Id does not match any application identity in the "application descriptor" of the URSP rule), the UPF 72 requests the SMF 71 to initiate a CN-initiated selective deactivation of the existing PDU session procedure for the UP connection as described in clause 4.3.7 in 3GPP TS 21.2013-010661. The UPF 72 may indicate a cause value (or a cause parameter) to the SMF 71, asking it to set it as the SM cause value. For example, the UPF 72 may send the cause value to the SMF 71. If the SMF 71 receives the cause value, the SMF 71 may send the cause value to the UE 3. For example, the SMF 71 may send a cause value for the UE 3 to the UE 3 by using a DL NAS transport message. When the UE 3 receives the cause value, the UE 3 may stop sending uplink user data to the UPF 72.

[0131] Requesting the SMF 71 to initiate a CN-initiated selective deactivation of the existing PDU session procedure for the UP connection may be referred to as deactivating data-related communications of the UE 3.

[0132] For example, if the UPF 72 finds that the received uplink user data is consistent with the UE policy, the UPF 72 may process the received uplink user data for communication with the UE 3. For example, if the UPF 72 finds that the received uplink user data is consistent with the UE policy, the user data exchange (e.g., the exchange of uplink user data) may not be interrupted or may be appropriately processed.

[0133] The cause parameter can have one or more values ​​from the causes listed below. They can be all SM causes. -IP descriptors do not match. -Destination IP address is out of range as defined in the IP descriptors. -The IPv6 prefix is ​​out of range as defined in the IP descriptors. -Port number is out of range as defined in the IP descriptors. -Protocol ID is out of range as defined in the IP descriptors. -The FQDN does not match with the ones defined in the Domain descriptors. -Out of Time windows

[0134] For example, the UPF 72 may check whether the current time (e.g., the current time when the UPF 72 receives or confirms uplink user data; information indicating the current time may be included in the uplink user data) matches the "time window" in the "route selection descriptor" defined in the URSP rule. If the UPF 72 determines that the current time does not match the "time window" (e.g., if the UPF 72 determines that the current time is not within the period or time window defined by the "time window"), the UPF 72 may request the SMF 71 to initiate CN-initiated selective deactivation of the existing PDU session procedure for the UP connection. In addition, the UPF 72 may send a cause parameter set to "out of time window" to the SMF 71, and the SMF 71 may send the cause parameter to the UE 3.

[0135] When the UPF 72 checks the "time window", the UPF 72 may use the time data provided by the Network Time Protocol (NTP) as defined in Non-Patent Document 6 as the current time.

[0136] For example, the uplink user data may include at least one of information regarding an IP address (eg, a destination IP address, an IPv6 prefix, a port number, a protocol ID) and information regarding a domain name (eg, an FQDN).

[0137] For example, the UPF 72 may check whether at least one of the information about the IP address and the information about the domain name matches the corresponding information in the URSP rule.

[0138] -Whether the destination IP address of the uplink user data matches the "IP Descriptor" in the URSP rule;

[0139] -Whether the IPv6 prefix of the uplink user data matches the "IP Descriptor" in the URSP rule, or whether the IPv6 prefix of the uplink user data is within the range defined by the "IP Descriptor" in the URSP rule;

[0140] -Whether the port number of the uplink user data matches the "IP Descriptor" in the URSP rule, or whether the port number of the uplink user data is within the range defined by the "IP Descriptor" in the URSP rule;

[0141] Whether the protocol ID of the uplink user data matches the "IP Descriptor" in the URSP rule, or whether the protocol ID of the uplink user data is within the range defined by the "IP Descriptor" in the URSP rule; and

[0142] -Whether the FQDN of the uplink user data matches the FQDN defined by the "domain descriptor" in the URSP rule.

[0143] If UPF 72 determines that the destination IP address of the uplink user data does not match the "IP descriptor" in the URSP rule, UPF 72 may request SMF 71 to initiate CN-initiated selective deactivation of the existing PDU session procedure for the UP connection. In addition, UPF 72 may send a cause parameter set to "IP descriptors does not match" or "destination IP address is outside the range defined by IP descriptor" to SMF 71, and SMF 71 may send the cause parameter to UE 3.

[0144] If UPF 72 determines that the IPv6 prefix of the uplink user data does not match the "IP Descriptor" in the URSP rule or that the IPv6 prefix of the uplink user data is out of the range defined by the "IP Descriptor" in the URSP rule, UPF 72 may request SMF 71 to initiate CN-initiated selective deactivation of the existing PDU session procedure for the UP connection. In addition, UPF 72 may send a cause parameter set to "IP Descriptor does not match" or "IPv6 prefix is ​​out of the range defined by IP Descriptor" to SMF 71, and SMF 71 may send the cause parameter to UE 3.

[0145] If UPF 72 determines that the port number of the uplink user data does not match the "IP Descriptor" in the URSP rule or that the port number of the uplink user data is outside the range defined by the "IP Descriptor" in the URSP rule, UPF 72 may request SMF 71 to initiate CN-initiated selective deactivation of the existing PDU session procedure UP connection. In addition, UPF 72 may send a cause parameter set to "IP Descriptor does not match" or "Port number is outside the range defined by IP Descriptor" to SMF 71, and SMF 71 may send the cause parameter to UE 3.

[0146] If UPF 72 determines that the protocol ID of the uplink user data does not match the "IP Descriptor" in the URSP rule or that the protocol ID of the uplink user data is out of the range defined by the "IP Descriptor" in the URSP rule, UPF 72 may request SMF 71 to initiate CN-initiated selective deactivation of the existing PDU session procedure for the UP connection. In addition, UPF 72 may send a cause parameter set to "IP Descriptor does not match" or "Protocol ID is out of the range defined by IP Descriptor" to SMF 71, and SMF 71 may send the cause parameter to UE 3.

[0147] If UPF 72 determines that the FQDN of the uplink user data does not match the FQDN defined by the "domain descriptor" in the URSP rule, UPF 72 may request SMF 71 to initiate CN-initiated selective deactivation of the existing PDU session procedure for the UP connection. In addition, UPF 72 may send a cause parameter set to "FQDN does not match that defined in domain descriptor" to SMF 71, and SMF 71 may send the cause parameter to UE 3.

[0148] The UPF 72 may check whether at least one of the App_Id, the current time, the information about the IP address, and the information about the domain name matches the corresponding parameters in the URSP rule as described above. If the UPF 72 determines that at least one of the App_Id, the current time, the information about the IP address, and the information about the domain name does not match the corresponding parameters in the URSP rule, the UPF 72 may send a cause parameter requesting the SMF 71 to initiate a CN-initiated selective deactivation of the existing PDU session procedure for the UP connection as described above.

[0149] According to the third example of the first aspect, for example, the 5GC (e.g., UPF) can recognize whether or when the UE implements the URSP rule. In addition, according to the third example of the first aspect, for example, an action that the 5GS (e.g., UPF) can take after the 5GC recognizes whether the UE implements the URSP rule can be provided. Furthermore, according to the third example of the first aspect, for example, a solution can be provided that can prevent an unauthorized application in the UE from routing traffic through an existing PDU session.

[0150] For example, the fourth device corresponding to UPF72 stores policy information on the communication terminal from the second device. For example, the communication terminal corresponds to UE3. For example, the second device corresponds to PCF73. The fourth device receives information on applications on the communication terminal from the third device. For example, the third device corresponds to SMF71. The fourth device receives information indicating that verification of data related to the communication terminal is required from the third device. The fourth device verifies whether the information on applications on the communication terminal is consistent with the policy information on the communication terminal based on the information indicating that verification of data related to the communication terminal is required. If the information on applications on the communication terminal is not consistent with the policy information on the communication terminal, the fourth device transmits information related to rejection.

[0151] <Modification 1 of the third example of the first embodiment> In step 8, the UPF 72 may verify the user location as to whether the UE 3 is in an authorized location as defined in the URSP rules. To enable the UPF 72 to verify the location, whenever the RAN 5 sends GTP-U data to the UPF 72, the RAN 5 will input the cell ID to which the UE 3 is connected in the RAN container or NR RAN container in the GTP-U header. The UPF 72 will verify the cell ID in the GTP-U as to whether the received cell ID is within an authorized location or within an authorized area as defined in the URSP rules.

[0152] If the UPF 72 finds that the received cell ID is out of the range defined by the URSP rules (e.g., if the UPF 72 determines that the received cell ID does not match the cell ID indicated by the URSP rules, or if the UPF 72 determines that the location indicated by the received cell ID does not match the location or area indicated by the URSP rules), the UPF 72 requests the SMF 71 to initiate a CN-initiated selective deactivation of the existing PDU session procedure for the UP connection as described in clause 4.3.7 of 3GPP TS 21.21.22. The UPF 72 may indicate a cause value to the SMF 71 asking it to set it as the SM cause value.

[0153] The causal parameters may be as follows: This may be a SM cause.

[0154] -Out of Location

[0155] The UPF 72 may convert the location indicated by the URSP rule to a cell ID. The UPF 72 may convert the received cell ID to location information that can be used for location verification. The UPF 72 may perform the conversion based on local configuration or operator policy stored at the UPF 72. The UPF 72 may receive information for the conversion from another network node. The UPF 72 may pre-store information for the conversion.

[0156] <Fourth Example of the First Aspect> A fourth example of the first aspect discloses a method in which UE3 sends a service request message to AMF70 when the NAS layer 362 of UE3 receives uplink data from a new application in UE3, even if UE3 is CM connected and a PDU session indicated by UE3 is already activated.

[0157] When the AMF 70 receives a service request message from the UE 3 including an application identifier (e.g., App_Id), the AMF 70 verifies the application identifier as to whether it is consistent with the UE policy downloaded from the PCF 73 for use of the PDU session.

[0158] A detailed process of the fourth example of the first embodiment is described below with reference to FIG.

[0159] Step 1: The UE policy including the URSP rule is provided to the AMF 70 by the PCF 73 as specified in steps 4 and 5 of the first example of the first aspect. The UE policy including the URSP rule may be provided to the AMF 70 by the PCF 73 as specified in steps 3 to 5 of the first example of the first aspect. The AMF 70 may provide the UE policy to the UE 3 as specified in step 6 of the first example of the first aspect.

[0160] Step 2: A PDU session (PDU session ID #1 is assigned to this PDU session) is established for APP1 36301, and a DRB is established for APP1 36301. That is, UE3 is in CM-connected state. A PDU session can be established for APP1 36301 with S-NSSAI. APP1 36301 is an application in UE3.

[0161] Step 3: At some point, APP2 36302 sends uplink data with the APP_id of APP2 36302 to the NAS layer 362. APP2 36302 is an application in UE3.

[0162] It should be noted that the NAS layer 362 may be one of the functions of the communications control module 362 in the schematic block diagram for UE3.

[0163] Step 4: The NAS layer 362 checks the URSP rules in the UE3 for whether the App_Id received from APP2 36302 matches an existing PDU session (PDU session ID #1) used for APP2 36302. For example, the NAS layer 362 may check whether a URSP rule corresponding to the received App_Id exists. For example, the NAS layer 362 may check whether a URSP rule including a traffic descriptor corresponding to the received App_Id exists. If the NAS layer 362 finds a URSP rule corresponding to the received App_Id, the NAS layer 362 selects a route selection descriptor within the found URSP rule. The NAS layer 362 then determines whether the existing PDU session (PDU session ID #1) matches the elements in the selected route selection descriptor. For example, the NAS layer 362 may determine whether information about the existing PDU session (PDU session ID #1) matches information about the PDU session in the selected route selection descriptor. If it matches (e.g., if the existing PDU session (PDU session ID #1) matches the components in the selected route selection descriptor), the NAS layer 362 proceeds with the following steps in the fourth example of the first aspect. If not, the NAS layer 362 may initiate a UE-requested PDU session establishment procedure to establish a new PDU session for APP2 36302 as described in section 4.3.2.2 of 3GPP TS 2011-0103611.

[0164] Step 5: The NAS layer 362 in the UE 3 sends a service request message to the AMF 70, including the PDU session ID #1 (PDU session identification information 1) and the App_Id (application identification information) of APP2 36302.

[0165] Step 6: Upon receiving a service request message from UE3, AMF70 verifies whether the App_Id provided by UE3 is consistent with the UE policy in the UE context of UE3 (e.g., AMF70 verifies whether the received application identification information (i.e., the received App_Id) matches any root descriptor rule defined in the NSSP corresponding to the application identification information, whether the received App_Id matches any application identification information in the URSP rule, or whether the received App_Id matches any application identification information in the "application descriptor" of the URSP rule).

[0166] When AMF70 checks whether the App_Id provided by UE3 is consistent with a UE policy, AMF70 may check the UE policy or URSP rule corresponding to PDU session ID#1.

[0167] If it matches the UE policy (e.g., if the received application identity (i.e., the received App_Id) matches one of the route descriptor rules defined in the NSSP corresponding to the application identity, or if the received App_Id matches one of the application identities in the URSP rule, or if the received App_Id matches one of the application identities in the "application descriptor" of the URSP rule), steps 7a and 8a are performed, and if not (e.g., if the received application identity (i.e., the received App_Id) does not match any route descriptor rule defined in the NSSP corresponding to the application identity, or if the received App_Id does not match any application identities in the URSP rule, or if the received App_Id does not match any application identities in the "application descriptor" of the URSP rule), steps 7b and 8b are performed.

[0168] Step 7a: The AMF sends a service approval message to the UE3.

[0169] Step 8a: Upon receiving the service accept message, the NAS layer 362 forwards the uplink data received from APP2 36302 in step 3 to the UPF 72 via the RAN.

[0170] After step 8a, subsequent uplink data from APP2 36302 is forwarded by the NAS layer 362 via the RAN to the UPF 72 using the PDU session identified by PDU session ID #1. Similarly, downlink data from the UPF 72 via the RAN is forwarded by the NAS layer 362 to APP2 36302 if the downlink data is destined for APP2 36302.

[0171] Step 7b: The AMF 70 sends a service reject message to the UE 3. The service reject message includes the SM cause value set to “App_Id is not allowed” indicating that the PDU Session ID#1 cannot be used by APP2 36302, which is indicated as the App_Id in the service request message in step 5.

[0172] Step 8b: Upon receiving the service denial message with the SM cause value, the NAS layer 362 discards the uplink data received from APP2 36302 in step 3 and sends a message to APP2 36302 indicating that the App_Id defined in step 3 is not valid.

[0173] Upon receiving the message from the NAS layer 362, the APP2 36302 stops sending uplink data to the NAS layer 362 and initiates a checking program (e.g., a virus checking program). The abandonment of the uplink data and / or the stop of sending the uplink data may be referred to as a stop of use of the APP2 36302.

[0174] According to the fourth example of the first aspect, for example, the 5GC (e.g., AMF) can recognize whether or when the UE implements the URSP rule. In addition, according to the fourth example of the first aspect, for example, an operation that the 5GS (e.g., AMF) can perform after the 5GC recognizes whether the UE implements the URSP rule can be provided. Furthermore, according to the fourth example of the first aspect, for example, a solution can be provided that can prevent an unauthorized application in the UE from routing traffic through an existing PDU session.

[0175] For example, a communication terminal corresponding to UE3 sends a service request message including information about an application for the communication terminal to a first device. For example, the first device corresponds to AMF70. The first device stores policy information about the communication terminal from a second device. For example, the second device corresponds to PCF73. The first device checks whether the information about the application for the communication terminal is consistent with the policy information about the communication terminal. If the information about the application for the communication terminal is not consistent with the policy information about the communication terminal, the first device sends information related to rejection to the communication terminal.

[0176] For example, a communication terminal corresponding to UE3 sends a service request message including information about an application for the communication terminal to a first device. For example, the first device corresponds to AMF70. The first device stores policy information about the communication terminal from a second device. For example, the second device corresponds to PCF73. The first device checks whether the information about the application for the communication terminal is consistent with the policy information about the communication terminal. If the information about the application for the communication terminal is consistent with the policy information about the communication terminal, the first device sends information related to the authorization to the communication terminal.

[0177] For example, the first device corresponding to AMF70 stores policy information on the communication terminal from the second device. For example, the communication terminal corresponds to UE3. For example, the second device corresponds to PCF73. The first device receives a service request message from the communication terminal, including information on an application on the communication terminal. The first device checks whether the information on the application on the communication terminal is consistent with the policy information on the communication terminal. If the information on the application on the communication terminal is not consistent with the policy information on the communication terminal, the first device sends information related to a rejection to the communication terminal.

[0178] For example, the first device corresponding to AMF70 stores policy information regarding the communication terminal from the second device. For example, the communication terminal corresponds to UE3. For example, the second device corresponds to PCF73. The first device receives a service request message from the communication terminal, including information regarding an application for the communication terminal. The first device checks whether the information regarding the application for the communication terminal is consistent with the policy information regarding the communication terminal. If the information regarding the application for the communication terminal is consistent with the policy information regarding the communication terminal, the first device sends information related to the authorization to the communication terminal.

[0179] <Fifth Example of the First Aspect> A fifth example of the first aspect discloses a method in which the AMF 70 sends a first NAS message to the UE 3 requesting a list of application identifiers associated with an indicated PDU session. When the AMF 70 receives a second NAS message including the list of application identifiers associated with the PDU session, the AMF 70 checks each application as to whether it is consistent with a UE policy downloaded from the PCF 73 for use of the PDU session.

[0180] A detailed process of the fifth example of the first embodiment is described below with reference to FIG.

[0181] Step 1: The UE policy including the URSP rule is provided to the AMF 70 by the PCF 73 as specified in steps 4 and 5 of the first example of the first aspect. The UE policy including the URSP rule may be provided to the AMF 70 by the PCF 73 as specified in steps 3 to 5 of the first example of the first aspect.

[0182] Step 2: A PDU session (PDU session ID #1 is assigned to this PDU session) is established for APP1 36301, and a DRB is established for APP1 36301. That is, UE3 is in CM-connected state. A PDU session can be established for APP1 36301 with S-NSSAI. APP1 36301 is an application in UE3.

[0183] Step 3: At some point, APP2 36302 starts using the PDU session identified by PDU session ID #1 based on the URSP rules in UE3. APP2 36302 is an application in UE3.

[0184] In this example, the PDU session identified by PDU session ID #1 is used by two applications, such as APP1 36301 and APP2 36302.

[0185] Step 4: The AMF 70 sends a first NAS message to the UE 3, including a flag and a PDU Session ID. The flag indicates that a list of applications using the PDU session is requested. If the PDU Session ID is not specified or is not explicitly indicated by another parameter, the first NAS message may apply to all PDU sessions established in the UE 3. The flag may be referred to as an APP ID request.

[0186] For example, the first NAS message may be a DL NAS transport message, an identity request message, a notification message, a 5GMM status message, or another existing NAS message or a new NAS message.

[0187] The triggers for AMF 70 to send the first NAS message may be listed as follows: - Periodic activation, for example, once each day for each PDU session. When the AMF 70 receives an indication from the SMF 71 or UPF 72 that the UE 3 needs to be checked for use of the PDU session when the user data traffic monitored at the UPF 72 is abnormal. An example of abnormal traffic monitored is too much data in a short period of time. -When AMF70 receives an indication from another node, such as NWDAF76, that UE3 needs to be checked for PDU session use when PDU session use is suspicious in UE behavior.

[0188] Step 5: Upon receiving the first NAS message, the UE 3 sends a second NAS message to the AMF 70, the second NAS message including a list of App_Ids and a PDU Session ID. The list of App_Ids indicates that the application identified by the App_Id uses the PDU session indicated by the PDU Session ID. If the PDU Session ID is not specified or is not explicitly indicated by another parameter in the first NAS message, the second NAS message includes a list of parameters, where the parameters include the list of App_Ids and the PDU Session ID.

[0189] For example, the second NAS message may be a UL NAS transport message, an identity response message, a notification response message, a 5GMM status message, or another existing NAS message or a new NAS message.

[0190] For example, if a PDU session identified by PDU Session ID #1 is used by two applications, such as APP1 36301 and APP2 36302 in UE3, and UE3 receives a first NAS message including a flag and PDU Session ID #1, UE3 may send a second NAS message including a list of App_Ids and PDU Session IDs. In this case, the list may include the App_Id of APP1 36301, the App_Id of APP2 36302, and PDU Session ID #1. The list may indicate that PDU Session ID #1 (or the PDU session identified by PDU Session ID #1) is used by APP1 36301, identified by App_Id1, and APP2 36302, identified by App_Id2.

[0191] Step 6: Upon receiving the second NAS message from UE3, AMF70 checks whether the App_Id provided by UE3 is consistent with the UE policy in the UE context of UE3 (e.g., AMF70 checks whether the received application identification information (i.e., the received App_Id) matches any root descriptor rule defined in the NSSP corresponding to the application identification information, or whether the received App_Id matches any application identification information in the "application descriptor" of the URSP rule).

[0192] When the AMF 70 checks whether the App_Id provided by the UE 3 is consistent with a UE policy, the AMF 70 may check the UE policy or URSP rule corresponding to the PDU session ID received in step 5.

[0193] If it does not match the UE policy (for example, if the received application identity (i.e., the received App_Id) does not match any of the route descriptor rules defined in the NSSP corresponding to the application identity, if the received App_Id does not match any of the application identities in the URSP rules, or if the received App_Id does not match any of the application identities in the "application descriptor" of the URSP rule), steps 7 and 8 are performed, otherwise (for example, if the received application identity (i.e., the received App_Id) matches one of the route descriptor rules defined in the NSSP corresponding to the application identity, if the received App_Id matches one of the application identities in the URSP rules, or if the received App_Id matches one of the application identities in the "application descriptor" of the URSP rule), AMF70 does nothing.

[0194] If the AMF 70 receives two or more App_Ids, the AMF 70 may determine whether each of the App_Ids matches the URSP rules. If at least one of the App_Ids does not match the URSP rules, steps 7 and 8 may be performed.

[0195] Step 7: The AMF 70 sends a third NAS message to the UE 3, including a list of allowed APP_Ids, a list of not allowed APP_Ids, and a PDU Session ID. If the PDU Session ID is not specified or is not explicitly indicated by another parameter in the first NAS message, the third NAS message includes a list of parameters, where the parameters include the list of allowed APP_Ids, the list of not allowed APP_Ids, and the PDU Session ID.

[0196] For example, the third NAS message may be a DL NAS transport message, an identity request message, a notification message, a 5GMM status message, or another existing NAS message or a new NAS message.

[0197] For example, assume that a PDU session identified by PDU session ID #1 is used by two applications, such as APP1 36301 and APP2 36302, in UE3. In this example, if App_Id1 of APP1 36301 matches the URSP rule and App_Id2 of APP2 36302 does not match the URSP rule, the third NAS message may include a list of allowed APP_Ids including App_Id1, a list of not allowed APP_Ids including App_Id2, and PDU session ID #1. If App_Id1 and App_Id2 match the URSP rule, the third NAS message may include a list of allowed APP_Ids including App_Id1 and App_Id2, and PDU session ID #1. If App_Id1 and App_Id2 do not match the URSP rules, the third NAS message may include a list of disallowed APP_Ids including App_Id1 and App_Id2, and PDU Session ID #1.

[0198] Step 8: Upon receiving the third NAS message, the NAS layer 362 acts as follows.

[0199] If the third NAS message includes a list of disallowed APP_Ids, the NAS layer 362 generates and sends a service termination indication message to the application identified by the App_Id included in the list of disallowed APP_Ids. The service termination indication message may indicate that the PDU session being used is not appropriate.

[0200] For example, if the third NAS message includes a list of disallowed APP_Ids that includes App_Id2 of APP2 36302, the NAS layer 362 may send a service termination indication message to APP2 36302.

[0201] Upon receiving the service end indication message from the NAS layer 362, the APP2 36302 stops sending uplink data to the NAS layer 362 and initiates a checking program (eg, a virus checking program).

[0202] If the third NAS message indicates that multiple applications are to be stopped (e.g., if the list of disallowed APP_Ids in the third NAS message includes multiple App_Ids), the NAS layer 362 sends multiple service termination indication messages to each of the applications based on the parameters (e.g., App_Id) received in the third NAS message.

[0203] At least one of generating a service termination indication message, transmitting a service termination indication message, and ceasing to transmit uplink data may be referred to as ceasing use of APP2 36302.

[0204] If the application does not receive a service termination indication message, the application may continue to send uplink data to the NAS layer 362.

[0205] When the NAS layer 362 receives the list of allowed APP_Ids, the NAS layer 362 may generate and send a service continuity indication message to the application identified by the App_Id included in the list of allowed APP_Ids. The service continuity indication message may indicate that the PDU session being used is appropriate.

[0206] Upon receiving a service continuation indication message from the NAS layer 362, the application may continue to send uplink data to the NAS layer 362.

[0207] According to the fifth example of the first aspect, for example, the 5GC (e.g., AMF) may recognize whether or when the UE implements the URSP rule. In addition, according to the fifth example of the first aspect, for example, an operation that the 5GS (e.g., AMF) may perform after the 5GC recognizes whether the UE implements the URSP rule may be provided. Furthermore, according to the fifth example of the first aspect, for example, a solution may be provided that may prevent an unauthorized application in the UE from routing traffic through an existing PDU session.

[0208] For example, a first device corresponding to AMF70 stores policy information regarding the communication terminal from a second device. For example, the communication terminal corresponds to UE3. For example, the second device corresponds to PCF72. The first device sends a request message to the communication terminal for information regarding applications for the communication terminal. The first device receives information regarding applications for the communication terminal from the communication terminal. The first device checks whether the information regarding applications for the communication terminal is consistent with the policy information regarding the communication terminal. If the information regarding applications for the communication terminal is not consistent with the policy information regarding the communication terminal, the first device sends information related to rejection to the communication terminal.

[0209] For example, a first device corresponding to AMF70 stores policy information regarding the communication terminal from a second device. For example, the communication terminal corresponds to UE3. For example, the second device corresponds to PCF72. The first device sends a request message to the communication terminal for information regarding applications for the communication terminal. The first device receives information regarding applications for the communication terminal from the communication terminal. The first device checks whether the information regarding applications for the communication terminal is consistent with the policy information regarding the communication terminal. If the information regarding applications for the communication terminal is consistent with the policy information regarding the communication terminal, the first device sends information related to the authorization to the communication terminal.

[0210] <Modification 1 of the fifth example of the first aspect> In one example, steps 4-7 are also performed by the SMF 71 or the UPF 72. For example, as defined in one of the above aspects, the UPF 72 or the SMF 71 may determine whether the data (e.g., App_Id) being transmitted in the PDU session matches the URSP rules that the UPF 72 or the SMF 71 receives.

[0211] <System Overview> FIG. 6 illustrates diagrammatically a mobile (cellular or wireless) telecommunications system 1 to which the above aspects are applicable.

[0212] The telecommunication system 1 represents a system overview capable of end-to-end communication, e.g., UEs 3 (or user equipment, "mobile devices" 3) communicating with other UEs 3 or service servers in a data network 20 via respective (R)AN nodes 5 and a core network 7.

[0213] The (R)AN node 5 supports any radio access, including 5G radio access technology (RAT), E-UTRA radio access technology, Beyond 5G RAT, 6G RAT, and non-3GPP RAT including wireless local area network (WLAN) technologies as defined by the Institute of Electrical and Electronics Engineers (IEEE).

[0214] The (R)AN node 5 may be separated into a Radio Unit (RU), a Distributed Unit (DU), and a Centralized Unit (CU). In some aspects, each of the units may be connected to each other to build the (R)AN node 5 by adopting an architecture as defined by the Open RAN (O-RAN) Alliance, and the above units are referred to as O-RU, O-DU, and O-CU, respectively.

[0215] The (R)AN node 5 may be separated into a control plane function and a user plane function. Furthermore, multiple user plane functions may be allocated to support communications. In some aspects, user traffic may be distributed across multiple user plane functions, with user traffic in each user plane function being aggregated at both the UE 3 and the (R)AN node 5. This separated architecture may be referred to as "dual connectivity" or "multi-connectivity."

[0216] The (R)AN node 5 may also support communications using satellite access. In some aspects, the (R)AN node 5 may support satellite and terrestrial access.

[0217] In addition, the (R)AN node 5 may also be referred to as an access node for non-wireless access, including fixed access as defined by the Broadband Forum (BBF) and optical access as defined by the Innovative Optical and Wireless Network (IOWN).

[0218] The core network 7 may include logical nodes (or "functions") that support communications in the telecommunications system 1. For example, the core network 7 may be a 5G Core Network (5GC) that includes control plane functions and user plane functions, among other functions. Each function in a logical node may be considered a network function. A network function may be provided to another node by adapting a Service Based Architecture (SBA).

[0219] By applying network virtualization technologies such as those defined by the European Telecommunications Standards Institute, Network Functions Virtualization (ETSI NFV), network functions can be deployed as distributed, redundant, stateless, and scalable, providing services from several locations and providing several execution instances at each location.

[0220] The core network 7 may support a Non-Public Network (NPN), which may be a Stand-alone Non-Public Network (SNPN) or a Public Network Integrated NPN (PNI-NPN).

[0221] As is known, when the UE 3 is moving around the geographic area covered by the telecommunication system 1, the UE 3 may move in and out of areas (i.e., radio cells) served by the (R)AN nodes 5. To keep track of the UE 3 and facilitate movement between the various (R)AN nodes 5, the core network 7 comprises at least one access and mobility management function (AMF) 70. The AMF 70 communicates with the (R)AN nodes 5 connected to the core network 7. In some core networks, a mobility management entity (MME) or mobility management node for Beyond 5G or a mobility management node for 6G may be used instead of the AMF 70.

[0222] The core network 7 also includes, among others, a Session Management Function (SMF) 71, a User Plane Function (UPF) 72, a Policy Control Function (PCF) 73, an Authentication Server Function (AUSF) 74, a Unified Data Management (UDM) 75, and a Network Data Analytics Function (NWDAF) 76. When a UE 3 roams into a visited Public Land Mobile Network (VPLMN), the home Public Land Mobile Network (HPLMN) of the UE 3 provides the UDM 75 and at least some of the functions of the SMF 71, UPF 72, and PCF 73 to the roaming-out UE 3.

[0223] The UE 3 and the respective serving (R)AN node 5 are connected via an appropriate air interface (e.g., the so-called "Uu" interface and / or the like). Neighboring (R)AN nodes 5 are connected to each other via appropriate (R)AN node 5 to (R)AN node interfaces (such as the so-called "Xn" interface and / or the like). Each (R)AN node 5 is also connected to nodes in the core network 7 (such as the so-called core network nodes) via appropriate interfaces (such as the so-called "N2" / "N3" interfaces and / or the like). From the core network 7, a connection is also provided to a data network 20. The data network 20 may be the Internet, a public network, an external network, a private network, or an internal network of the PLMN. If the data network 20 is provided by a PLMN operator or a Mobile Virtual Network Operator (MVNO), IP Multimedia Subsystem (IMS) services may be provided by that data network 20. The UE 3 may be connected to the data network 20 using IPv4, IPv6, IPv4v6, Ethernet, or unstructured data types.

[0224] The "Uu" interface may include a control plane of the Uu interface and a user plane of the Uu interface.

[0225] The user plane of the Uu interface is responsible for carrying user traffic between the UE 3 and the serving (R)AN node 5. The user plane of the Uu interface may have a hierarchical structure with SDAP, PDCP, RLC and MAC sub-layers over physical connections.

[0226] The control plane of the Uu interface is responsible for establishing, modifying and releasing the connection between the UE 3 and the serving (R)AN node 5. The control plane of the Uu interface may have a hierarchical structure with RRC, PDCP, RLC and MAC sub-layers over the physical connections.

[0227] For example, the following messages are communicated in the RRC layer to support AS signaling:

[0228] - RRC SETUP REQUEST message: This message is sent from the UE 3 to the (R)AN node 5. In addition to the parameters disclosed by aspects of the present disclosure, the following parameters may be included together in the RRC SETUP REQUEST message: --establishmentCause and ue-Identity. The ue-Identity may have the value of ng-5G-S-TMSI-Part1 or a random value.

[0229] - RRC SETUP message: This message is sent from the (R)AN node 5 to the UE 3. In addition to the parameters disclosed by aspects of the present disclosure, the following parameters may be included together in the RRC SETUP message: --Master cell group (masterCellGroup) and radio bearer config (radioBearerConfig)

[0230] - RRC Setup Complete message: This message is sent from the UE 3 to the (R)AN node 5. In addition to the parameters disclosed by aspects of the present disclosure, the following parameters may be included together in the RRC Setup Complete message: --guami type, iab node indication, idleMeasAvailable, mobilityState, ng-5G-S-TMSI-Part2, registered AMF, selectedPLMN-Identity

[0231] The UE 3 and the AMF 70 are connected via a suitable interface (e.g., a so-called N1 interface and / or the like). The N1 interface is responsible for providing communication between the UE 3 and the AMF 70 to support NAS signaling. The N1 interface can be established in 3GPP access and non-3GPP access. For example, the following messages are communicated in the N1 interface:

[0232] - Registration Request Message: This message is sent from the UE 3 to the AMF 70. In addition to the parameters disclosed by the aspects of the present disclosure, the following parameters may be included together in the Registration Request message: --5GS registration type, ngKSI, 5GS mobile identity, Non-current native NAS key set identifier, 5GMM capability, UE security capability, Requested NSSAI, Last visited registered TAI, S1 UE network capability, Uplink data status, PDU session status, MICO indication, UE status, Additional GUTI, Allowed PDU session status, UE's usage setting, Requested DRX parameters, EPS NAS message container, LADN indication, Payload container type, Payload container container, Network slicing indication, 5GS update type, Mobile station classmark 2, Supported codecs, NAS message container, EPS bearer context status, Requested extended DRX parameters, T3324 value, UE radio capability IDThe requested NB-N1 mode DRX parameters include: Requested NB-N1 mode Routing Information Requested ID, Requested mapped NSSAI, Additional information requested, Requested WUS assistance information, N5GC indication, and Requested NB-N1 mode DRX parameters.

[0233] - Registration Accept Message: This message is sent from the AMF 70 to the UE 3. In addition to the parameters disclosed by the aspects of the present disclosure, the following parameters may be included together in the Registration Accept Message: --5GS registration result, 5G-GUTI, Equivalent PLMNs, TAI list, Allowed NSSAI, Rejected NSSAI, Configured NSSAI, 5GS network feature support, PDU session status, PDU session reactivation result, PDU session reactivation result error cause, LADN information, MICO indication, Network slicing indication, Service area list, T3512 value, Non-3GPP de-registration timer value, T3502 value, Emergency number list list, Extended emergency number list, SOR transparent container, EAP message, NSSAI inclusion mode, Operator-defined access category definitions, Negotiated DRX parameters, Non-3GPP NW policies, EPS bearer context status, Negotiated extended DRX parameters, T3447 value, T3448 valueThe following are the received 5G-S-TMSI status information: T3324 value, T3324 value, UE radio capability ID, UE radio capability ID deletion indication, Pending NSSAI, Ciphering key data, CAG information list, Truncated 5G-S-TMSI configuration, Negotiated WUS assistance information, Negotiated NB-N1 mode DRX parameters, and Extended rejected NSSAI.

[0234] - Registration Complete Message: This message is sent from the UE 3 to the AMF 70. In addition to the parameters disclosed by the aspects of the present disclosure, the following parameters may be included together in the registration complete message: --SOR transparent container.

[0235] -Authentication Request Message: This message is sent from the AMF 70 to the UE 3. In addition to the parameters disclosed by the aspects of the present disclosure, the following parameters may be included together in the Authentication Request message: --ngKSI, ABBA, Authentication parameter RAND (5G authentication challenge), Authentication parameter AUTN (5G authentication challenge), and EAP message.

[0236] -Authentication Response Message: This message is sent from the UE 3 to the AMF 70. In addition to the parameters disclosed by the aspects of the present disclosure, the following parameters may be present together in the authentication response message: --Authentication response message identity, Authentication response parameter, and EAP message.

[0237] -Authentication Result Message: This message is sent from the AMF 70 to the UE 3. In addition to the parameters disclosed by the aspects of the present disclosure, the following parameters may be present together in the Authentication Result message: --ngKSI, EAP message, and ABBA.

[0238] -Authentication Failure Message: This message is sent from the UE 3 to the AMF 70. In addition to the parameters disclosed by the aspects of the present disclosure, the following parameters may be present together in the Authentication Failure Message: --Authentication failure message identity, 5GMM cause, and Authentication failure parameter.

[0239] -Authentication Rejection Message: This message is sent from the AMF 70 to the UE 3. In addition to the parameters disclosed by the aspects of the present disclosure, the following parameters may be present together in the Authentication Rejection message: --EAP message.

[0240] - Service Request Message: This message is sent from the UE 3 to the AMF 70. In addition to the parameters disclosed by the aspects of the present disclosure, the following parameters may be present together in the service request message: --ngKSI, Service type, 5G-S-TMSI, Uplink data status, PDU session status, Allowed PDU session status, NAS message container.

[0241] - Service Authorization Message: This message is sent from the AMF 70 to the UE 3. In addition to the parameters disclosed by the aspects of the present disclosure, the following parameters may be present together in the Service Authorization Message: --PDU session status, PDU session reactivation result, PDU session reactivation result error cause, EAP message, and T3448 value.

[0242] - Service Rejection Message: This message is sent from the AMF 70 to the UE 3. In addition to the parameters disclosed by the aspects of the present disclosure, the following parameters may be present together in the Service Rejection message: --5GMM cause, PDU session status, T3346 value, EAP message, T3448 value, and CAG information list.

[0243] -Configuration Update Command Message: This message is sent from the AMF 70 to the UE 3. In addition to the parameters disclosed by the aspects of the present disclosure, the following parameters may be present together in the Configuration Update Command message: --Configuration update indication, 5G-GUTI, TAI list, Allowed NSSAI, Service area list, Full name for network, Short name for network, Local time zone, Universal time and local time zone, Network daylight saving time, LADN information, MICO indication, Network slicing indication, Configured NSSAI, Rejected NSSAI, Operator-defined access category definitions, SMS indication, T3447 value, CAG information list, UE radio capability ID, UE radio capability ID deletion indication, 5GS registration result, Truncated 5G-S-TMSI configuration, Additional configuration indication, and Extended rejected NSSAI.

[0244] -Configuration Update Complete message: This message is sent from the UE 3 to the AMF 70. In addition to the parameters disclosed by the aspects of the present disclosure, the following parameters may be present together in the configuration update complete message: --Configuration update complete message identity.

[0245] <User equipment (UE)> FIG. 7 is a block diagram showing the main components of a UE 3 (mobile device 3). As shown, the UE 3 includes a transceiver circuit 31 operable to transmit signals to and receive signals from a connection node via one or more antennas 32. In addition, the UE 3 may include a user interface 34 for inputting information from the outside or outputting information to the outside. Although not necessarily shown in the figure, the UE 3 may have all the usual functions of a conventional mobile device, which may be provided by any one or any combination of hardware, software, and firmware, as appropriate. For example, the software may be pre-installed in the memory and / or downloaded via a telecommunications network or from a removable data storage device (RMD). The controller 33 controls the operation of the UE 3 according to the software stored in the memory 36. The software includes, among others, an operating system 361, an application 363, and a communication control module 362 having at least a transceiver control module 3621. The application 363 is an application that provides a service to a user of the UE 3 and / or provides a machine-type service. The application 363 generates an uplink data packet and transmits the uplink data packet via the antenna 32 by communicating with the communication control module 362. In contrast, if a downlink data packet received by the antenna 32 is destined for the application 363, the application 363 receives the downlink data packet from the communication control module 362. One or more applications 363 may be present in the memory 36. The applications 363 may include an APP1 (application 1) 36301 and an APP2 (application 2) 36302.The communication control module 362 (using its transceiver control module 3621) is responsible for handling (generating / sending / receiving) signaling and uplink / downlink data packets between the UE 3 and other nodes such as the (R)AN node 5 and the AMF 70. Such signaling may include, for example, appropriately formatted signaling messages (e.g., registration request messages and associated response messages) related to access and mobility management procedures (for the UE 3). The controller 33 interacts with one or more Universal Subscriber Identity Modules (USIMs) 35. In case of multiple USIMs 35, the controller 33 may activate only one USIM 35 or may activate multiple USIMs 35 simultaneously.

[0246] The UE 3 may, for example, support a Non-Public Network (NPN), which may be a Stand-alone Non-Public Network (SNPN) or a Public Network Integrated NPN (PNI-NPN).

[0247] UE3 may be, for example, an item of production or manufacturing equipment and / or an item of energy-related machinery (e.g., equipment or machines such as boilers, engines, turbines, solar panels, wind turbines, hydroelectric generators, thermal generators, nuclear generators, batteries, nuclear systems and / or related equipment, heavy electrical machinery, pumps including vacuum pumps, compressors, fans, blowers, hydraulic equipment, pneumatic equipment, metal processing machines, manipulators, robots and / or application systems thereof, tools, moulds or dies, rolls, conveying equipment, lifting equipment, material handling equipment, textile machinery, sewing machines, printing machines and / or related machines, paper converting machines, chemical machinery, mining machinery and / or construction machinery and / or related equipment, agricultural, forestry and / or fishing machinery and / or implements, safety and / or environmental protection equipment, tractors, precision bearings, chains, gears, power transmission equipment, lubrication equipment, valves, fittings, and / or application systems for any of the foregoing equipment or machines).

[0248] UE 3 may be, for example, an item of transportation equipment (e.g., vehicles, automobiles, motorbikes, bicycles, trains, buses, carts, rickshaws, ships and other watercraft, aircraft, rockets, satellites, drones, balloons, etc.).

[0249] UE 3 may be, for example, an item of information and communications equipment (eg, information and communications equipment such as electronic computers and related equipment, communications and related equipment, electronic components, etc.).

[0250] The UE3 may be, for example, a refrigeration machine, a refrigeration machine application product, an item of commercial and / or service industry equipment, a vending machine, an automated service machine, an office machine or equipment, consumer electronic devices and appliances (e.g., consumer electronic appliances such as audio equipment, video equipment, loudspeakers, radios, televisions, microwave ovens, rice cookers, coffee machines, dishwashers, washing machines, dryers, electronic fans or related appliances, vacuum cleaners, etc.).

[0251] The UE 3 may be, for example, an electrical application system or device (eg, an electrical application system or device such as an x-ray system, a particle accelerator, a radioisotope device, a sonic device, an electromagnetic application device, a power application device, etc.).

[0252] UE3 may be, for example, an electronic lamp, a lighting fixture, a measuring instrument, an analyzer, a tester, or a surveying or detecting device (e.g., a smoke alarm, a occupancy alarm sensor, a motion sensor, a radio tag, or other surveying or detecting device), a watch or clock, laboratory equipment, optical equipment, medical equipment and / or systems, a weapon, an item of cutlery, a hand tool, or the like.

[0253] UE 3 may be, for example, a wireless-equipped personal digital assistant or related equipment (such as a wireless card or module designed to be attached to or inserted into another electronic device (eg, a personal computer, electrical measurement machine)).

[0254] The UE 3 may be part of a device or system that uses various wired and / or wireless communication technologies to provide the applications, services, and solutions described below with respect to the "Internet of Things" (IoT).

[0255] Internet of Things devices (or "Things") may be equipped with appropriate electronics, software, sensors, network connectivity, and / or the like, allowing them to collect and exchange data with each other and with other communicating devices. IoT devices may comprise automated machines that follow software instructions stored in internal memory. IoT devices may operate without the need for human supervision or interaction. IoT devices may also remain stationary and / or stopped for long periods of time. IoT devices may be implemented as part of a (generally) stationary apparatus. IoT devices may also be incorporated into non-stationary apparatus (e.g., vehicles) or attached to animals or people being monitored / tracked.

[0256] It will be understood that IoT technology may be implemented on any communication device that can connect to a communication network to transmit / receive data, regardless of whether such communication device is controlled by human input or by software instructions stored in memory.

[0257] It will be appreciated that an IoT device is sometimes also referred to as a Machine-Type Communication (MTC) device or a Machine-to-Machine (M2M) communication device, or a Narrow Band-IoT UE (NB-IoT UE). It will be appreciated that a UE 3 may support one or more IoT or MTC applications.

[0258] The UE 3 may be a smartphone or a wearable device (e.g., smart glasses, a smart watch, a smart ring, or a hearable device).

[0259] The UE3 may be a car, a connected car, an autonomous vehicle, a vehicular device, a motorcycle, or a Vehicle to Everything (V2X) communication module (e.g., a vehicle-to-vehicle communication module, a vehicle-to-infrastructure communication module, a vehicle-to-person communication module, and a vehicle-to-network communication module).

[0260] <(R)AN node> FIG. 8 is a block diagram illustrating the main components of an exemplary (R)AN node 5, e.g., a base station ("eNB" in LTE, "gNB" in 5G, base station for Beyond 5G, base station for 6G). As shown, the (R)AN node 5 includes a transceiver circuit 51 operable to transmit signals to and receive signals from an attached UE 3 via one or more antennas 52, and to transmit signals to and receive signals from other network nodes via a network interface 53 (directly or indirectly). A controller 54 controls the operation of the (R)AN node 5 according to software stored in a memory 55. For example, the software may be pre-installed in the memory and / or downloaded via a telecommunications network or from a removable data storage device (RMD). The software includes, among other things, an operating system 551 and a communication control module 552 having at least a transceiver control module 5521.

[0261] The communication control module 552 (using its transceiver control sub-module) is responsible for processing (generating / sending / receiving) signaling between the (R)AN node 5 and other nodes such as the UE 3, another (R)AN node 5, the AMF 70, and the UPF 72, either directly or indirectly. The signaling may include, for example, properly formatted signaling messages regarding the radio connection and connection to the core network 7 for a specific UE 3, particularly regarding connection establishment and maintenance, such as RRC connection establishment messages and other RRC messages, NG Application Protocol (NGAP) messages (i.e., messages at the N2 reference point), Xn application protocol (XnAP) messages (i.e., messages at the Xn reference point), etc. Such signaling may also include, in the case of transmission, for example, broadcast information (such as master information and system information).

[0262] When implemented, the controller 54 is also configured (either by software or hardware) to handle related tasks such as UE mobility estimation and / or movement trajectory estimation.

[0263] The (R)AN node 5 may support a Non-Public Network (NPN). The NPN may be a Stand-alone Non-Public Network (SNPN) or a Public Network Integrated NPN (PNI-NPN). The Master Node (MN) 501 and the Secondary Node (SN) 502 may have the same components as the (R)AN node 5.

[0264] <System Overview of the (R)AN Node 5 Based on the O-RAN Architecture> FIG. 9 illustrates diagrammatically an (R)AN node 5 based on an O-RAN architecture to which (R)AN node 5 aspects are applicable.

[0265] The (R)AN node 5 based on the O-RAN architecture represents a system overview in which the (R)AN node is separated into a Radio Unit (RU) 60, a Distributed Unit (DU) 61, and a Centralized Unit (CU) 62. In some aspects, each unit may be combined. For example, the RU 60 may be combined / combined with the DU 61 as a combined / combined unit, and the DU 61 may be combined / combined with the CU 62 as another combined / combined unit. Any functionality in the description of a unit (e.g., one of the RU 60, DU 61, and CU 62) may be implemented in the combined / combined unit above. Furthermore, the CU 62 may be separated into two functional units, such as a CU Control plane (CP) and a CU User plane (UP). The CU CP has a control plane function in the (R)AN node 5. The CU UP has a user plane function in the (R)AN node 5. Each CU CP is connected to a CU UP via a suitable interface (such as a so-called "E1" interface and / or the like).

[0266] The UE 3 and the respective serving RU 60 are connected via a suitable air interface (e.g., a so-called "Uu" interface and / or the like). Each RU 60 is connected to a DU 61 via a suitable interface (such as a so-called "fronthaul", "open fronthaul", "F1" interface and / or the like). Each DU 61 is connected to a CU 62 via a suitable interface (such as a so-called "midhaul", "open midhaul", "E2" interface and / or the like). Each CU 62 is also connected to a node in the core network 7 (such as a so-called core network node) via a suitable interface (such as a so-called "backhaul", "open backhaul", "N2" / "N3" interface and / or the like). In addition, the user plane part of the DU 61 may also be connected to the core network node 7 via a suitable interface (such as a so-called "N3" interface and / or the like).

[0267] Depending on the functionality split between the RU 60, DU 61, and CU 62, each unit provides a portion of the functionality provided by the (R)AN node 5. For example, the RU 60 may provide functionality for communicating with the UE 3 over the air interface, the DU 61 may provide functionality supporting the MAC and RLC layers, and the CU 62 may provide functionality supporting the PDCP, SDAP, and RRC layers.

[0268] <Radio Unit (RU)> FIG. 10 is a block diagram illustrating the main components of an exemplary RU 60, e.g., the RU portion of a base station (eNB in ​​LTE, gNB in ​​5G, base station for Beyond 5G, base station for 6G). As shown, the RU 60 includes a transceiver circuit 601 operable to transmit signals to and receive signals from an attached UE 3 via one or more antennas 602, and to transmit and receive signals to and from other network nodes or parts via a network interface 603 (directly or indirectly). A controller 604 controls the operation of the RU 60 according to software stored in a memory 605. For example, the software may be pre-installed in the memory and / or downloaded via a telecommunications network or from a removable data storage device (RMD). The software includes, among other things, an operating system 6051 and a communication control module 6052 having at least a transceiver control module 60521.

[0269] The communication control module 6052 (using its transceiver control sub-module) is responsible for handling (generating / sending / receiving) signaling between (e.g., directly or indirectly) the RU 60 and other nodes or units, such as the UE 3, another RU 60, and the DU 61. The signaling may include, for example, appropriately formatted signaling messages related to the radio connection and connectivity with the RU 60 (for a particular UE 3), in particular the MAC and RLC layers.

[0270] When implemented, the controller 604 is also configured (by software or hardware) to handle related tasks such as UE mobility estimation and / or motion trajectory estimation.

[0271] The RU 60 may support a Non-Public Network (NPN), which may be a Stand-alone Non-Public Network (SNPN) or a Public Network Integrated NPN (PNI-NPN).

[0272] As described above, the RU 60 may be integrated / combined with the DU 61 as an integrated / combined unit. Any function described for the RU 60 may be implemented in the integrated / combined unit.

[0273] <Distributed Unit (DU)> FIG. 11 is a block diagram illustrating the main components of an exemplary DU 61, e.g., the DU portion of a base station (eNB in ​​LTE, gNB in ​​5G, base station for Beyond 5G, base station for 6G). As shown, the device includes a transceiver circuit 611 operable to transmit signals to and receive signals from other nodes or units (including RU 60) via a network interface 612. A controller 613 controls the operation of the DU 61 according to software stored in memory 614. For example, the software may be pre-installed in memory 614 and / or downloaded via a telecommunications network or from a removable data storage device (RMD). The software includes, among other things, an operating system 6141 and a communication control module 6142 having at least a transceiver control module 61421. The communication control module 6142 (using its transceiver control module 61421) is responsible for handling (generating / sending / receiving) signaling between the DU 61 and other nodes or units, such as the RU 60 and other nodes and units.

[0274] The DU 61 may support a Non-Public Network (NPN), which may be a Stand-alone Non-Public Network (SNPN) or a Public Network Integrated NPN (PNI-NPN).

[0275] As mentioned above, the RU 60 may be integrated / combined with the DU 61 or the CU 62 as an integrated / combined unit. Any functionality in the description of the DU 61 may be implemented in one of the integrated / combined units.

[0276] <Centralized Unit (CU)> FIG. 12 is a block diagram illustrating the main components of an exemplary CU 62, e.g., a CU portion of a base station (eNB in ​​LTE, gNB in ​​5G, base station for Beyond 5G, base station for 6G). As shown, the device includes a transceiver circuit 621 operable to transmit signals to and receive signals from other nodes or units (including DU 61) via a network interface 622. A controller 623 controls the operation of the CU 62 according to software stored in a memory 624. For example, the software may be pre-installed in the memory 624 and / or downloaded via a telecommunications network or from a removable data storage device (RMD). The software includes, among other things, an operating system 6241 and a communication control module 6242 having at least a transceiver control module 62421. The communication control module 6242 (using its transceiver control module 62421) is responsible for handling (generating / sending / receiving) signaling between the CU 62 and other nodes or units, such as the DU 61 and other nodes and units.

[0277] The CU 62 may support a Non-Public Network (NPN), which may be a Stand-alone Non-Public Network (SNPN) or a Public Network Integrated NPN (PNI-NPN).

[0278] As described above, the CU 62 may be integrated / combined with the DU 61 as an integrated / combined unit. Any functionality in the description of the CU 62 may be implemented in the integrated / combined unit.

[0279] <amf> 13 is a block diagram illustrating the main components of the AMF 70. As shown, the device includes a transceiver circuit 701 operable to transmit signals to and receive signals from other nodes (including UE 3, RAN 5, SMF 71) via a network interface 702. A controller 703 controls the operation of the AMF 70 according to software stored in a memory 704. For example, the software may be pre-installed in the memory 704 and / or downloaded via a telecommunications network or from a removable data storage device (RMD). The software includes, among other things, an operating system 7041 and a communication control module 7042 having at least a transceiver control module 70421. The communications control module 7042 (using its transceiver control module 70421) is responsible for handling (generating / sending / receiving) signaling between the AMF 70 and the UE 3 (e.g., via (R)AN node 5) and other nodes, such as other core network nodes (including core network nodes in the UE 3's HPLMN when the UE 3 is roaming in). Such signaling may include, for example, appropriately formatted signaling messages (e.g., registration request messages and associated response messages) relating to access and mobility management procedures (for the UE 3).

[0280] The AMF 70 may support a Non-Public Network (NPN). The NPN may be a Stand-alone Non-Public Network (SNPN) or a Public Network Integrated NPN (PNI-NPN). The AMF 7001 and AMF 7002 may have the same components as the AMF 70.

[0281] <smf> 14 is a block diagram illustrating the main components of the SMF 71. As shown, the device includes a transceiver circuit 711 operable to transmit signals to and receive signals from other nodes (including the AMF 70, the UPF 72) via a network interface 712. A controller 713 controls the operation of the SMF 71 according to software stored in a memory 714. For example, the software may be pre-installed in the memory 714 and / or downloaded via a telecommunications network or from a removable data storage device (RMD). The software includes, among other things, an operating system 7141 and a communication control module 7142 having at least a transceiver control module 71421. The communications control module 7142 (using its transceiver control module 71421) is responsible for handling (generating / sending / receiving) signaling between the SMF 71 and other nodes, such as the UPF 72 and other core network nodes, including core network nodes in the UE 3's HPLMN when the UE 3 is roaming in. Such signaling may include, for example, appropriately formatted signaling messages (e.g., Hypertext Transfer Protocol (HTTP) RESTful methods based on a service-based interface) relating to session management procedures (for the UE 3).

[0282] SMF 71 may support a Non-Public Network (NPN), which may be a Stand-alone Non-Public Network (SNPN) or a Public Network Integrated NPN (PNI-NPN).

[0283] <upf> 15 is a block diagram illustrating the main components of the UPF 72. As shown, the device includes a transceiver circuit 721 operable to transmit signals to and receive signals from other nodes (including the SMF 71) via a network interface 722. A controller 723 controls the operation of the UPF 72 according to software stored in a memory 724. For example, the software may be pre-installed in the memory 724 and / or downloaded via a telecommunications network or from a removable data storage device (e.g., a removable memory device (RMD)). The software includes, among other things, an operating system 7241 and a communication control module 7242 having at least a transceiver control module 72421. The communications control module 7242 (using its transceiver control module 72421) is responsible for handling (generating / sending / receiving) signaling between the UPF 72 and other nodes, such as the SMF 71 and other core network nodes (including core network nodes in the HPLMN of the UE 3 when the UE 3 is roaming in). Such signaling may include, for example, appropriately formatted signaling messages (e.g., GPRS Tunneling Protocol (GTP) for the user plane) relating to user data processing (for the UE 3).

[0284] The UPF 72 may support a Non-Public Network (NPN), which may be a Stand-alone Non-Public Network (SNPN) or a Public Network Integrated NPN (PNI-NPN).

[0285] A communication device performing the functions of collocated gNB-CU-UP and UPF, or collocated gNB-CU-UP and UPF, or a communication device performing the functions of gNB-CU-UP and UPF, may have the same components as UPF72.

[0286] <pcf> 16 is a block diagram illustrating the main components of the PCF 73. As shown, the device includes a transceiver circuit 731 operable to transmit signals to and receive signals from other nodes (including the AMF 70) via a network interface 732. A controller 733 controls the operation of the PCF 73 according to software stored in a memory 734. For example, the software may be pre-installed in the memory 734 and / or downloaded via a telecommunications network or from a removable data storage device (e.g., a removable memory device (RMD)). The software includes, among other things, an operating system 7341 and a communication control module 7342 having at least a transceiver control module 73421. The communications control module 7342 (using its transceiver control module 73421) is responsible for handling (generating / sending / receiving) signaling between the PCF 73 and other nodes, such as the AMF 70 and other core network nodes (including core network nodes in the UE 3's HPLMN when the UE 3 is roaming in). Such signaling may include, for example, appropriately formatted signaling messages (e.g. HTTP RESTful methods based on service-based interfaces) relating to policy management procedures (for the UE 3).

[0287] The PCF 73 may support a Non-Public Network (NPN). The NPN may be a Stand-alone Non-Public Network (SNPN) or a Public Network Integrated NPN (PNI-NPN). The PCF 7301 and PCF 7302 may have the same components as the PCF 73.

[0288] <ausf> 17 is a block diagram illustrating the main components of the AUSF 74. As shown, the device includes a transceiver circuit 741 operable to transmit signals to and receive signals from other nodes (including UDMs 75) via a network interface 742. A controller 743 controls the operation of the AUSF 74 according to software stored in memory 744. For example, the software may be pre-installed in memory 744 and / or downloaded over a telecommunications network or from a removable data storage device (e.g., a removable memory device (RMD)). The software includes, among other things, an operating system 7441 and a communication control module 7442 having at least a transceiver control module 74421. The communications control module 7442 (using its transceiver control module 74421) is responsible for handling (generating / sending / receiving) signaling between the AUSF 74 and other nodes, such as the AMF 70 and other core network nodes (including core network nodes in the UE 3's HPLMN when the UE 3 is roaming in). Such signaling may include, for example, appropriately formatted signaling messages (e.g., HTTP RESTful methods based on service-based interfaces) relating to policy management procedures (for the UE 3).

[0289] The AUSF 74 may support a Non-Public Network (NPN), which may be a Stand-alone Non-Public Network (SNPN) or a Public Network Integrated NPN (PNI-NPN).

[0290] <udm> 18 is a block diagram illustrating the main components of the UDM 75. As shown, the device includes a transceiver circuit 751 operable to transmit signals to and receive signals from other nodes (including the AMF 70) via a network interface 752. A controller 753 controls the operation of the UDM 75 according to software stored in a memory 754. For example, the software may be pre-installed in the memory 754 and / or downloaded via a telecommunications network or from a removable data storage device (RMD). The software includes, among other things, an operating system 7541 and a communication control module 7542 having at least a transceiver control module 75421. The communications control module 7542 (using its transceiver control module 75421) is responsible for handling (generating / sending / receiving) signaling between the UDM 75 and other nodes, such as the AMF 70 and other core network nodes (including core network nodes in the UE 3's VPLMN when the UE 3 is roaming out). Such signaling may include, for example, appropriately formatted signaling messages (e.g., HTTP RESTful methods based on service-based interfaces) relating to mobility management procedures (for the UE 3).

[0291] The UDM 75 may support a Non-Public Network (NPN), which may be a Stand-alone Non-Public Network (SNPN) or a Public Network Integrated NPN (PNI-NPN).

[0292] All or part of the exemplary aspects of the above disclosure may be described as follows, but are not limited to the following.

[0293] 1 background This contribution proposes a solution to key problem #2, namely, the perception of 5GC regarding URSP implementation.

[0294] 6.X Solution #X: Verifying that the UE's URSP is enforced by the network 6.X.1 Description Editor's Note: This article describes the solution rationale and corresponding architectural assumptions.

[0295] This solution addresses Key Issue #2, namely, the following requirements recognized by the 5GC regarding URSP implementation:

[0296] -The UE can implement URSP rules to route application traffic to a PDU session based on URSP rules provisioned by the 5GC, and whether and how the 5GC can be made aware of this.

[0297] -Whether there are any actions that the 5GS can take after the 5GC knows whether the UE enforces URSP rules for a particular application traffic. If so, what actions should the 5GC take?

[0298] The solution allows the UE implementation to correctly follow the URSP rules for traffic matching. The solution introduces an application identity parameter that is provisioned by the UE to the PCF during the PDU session establishment procedure. The PCF performs a URSP validation check to verify whether the UE correctly implements the traffic matching rules in the URSP for the application requesting the service. If the PCF finds that the UE does not correctly follow the URSP rules, the PDU session is rejected with a new cause indicating that the general or specific URSP rules are not followed. The PCF may also optionally trigger a UE policy update procedure to refresh the URSP rules in the UE with the latest version of the URSP rules.

[0299] 6.X.2 Procedure Editor's Note: This article describes the high-level procedures and information flows for the solution.

[0300] Figure 6.X.2: Verification of UE URSP implementation by the network (see Figure 19)

[0301] 1. An application in the UE requests a service. The UE initiates a PDU Session Establishment Request message, in which the UE includes the UE_ID, PDU Session ID, S-NSSAI, and DNN. The UE selects the S-NSSAI and DNN based on the URSP rules applicable to the application requesting the service. The UE also includes the App_ID of the application in the PDU Session Establishment Request message.

[0302] 2.SMF selection by AMF.

[0303] 3. The AMF executes a Nsmf_PDUSession_CreateSMContext_Request message to the SMF if no association with the SMF exists, or executes a Nsmf_PDUSession_UpdateSMContext_Request message if the AMF is already associated with the SMF. Along with the UE_ID, S-NSSAI, DNN, and user location parameters, the AMF also forwards the App_ID received by the UE to the SMF.

[0304] 4. Continue the PDU session establishment procedure according to TS 23.502 clause 4.3.2.2.1 steps 4 to 7a.

[0305] 5. The SMF initiates the SM policy association establishment procedure, the SMF sends an Npcf_SMPpolicy_Control_Create message to the PCF, and the SMF includes the UE_ID, S-NSSAI, DNN, user location, and App_ID parameters in the Npcf_SMPpolicy_Control_Create message.

[0306] 6. The PCF performs URSP validation for the UE. The PCF obtains the latest version of the URSP rules stored for the UE, and the PCF verifies whether the UE correctly follows the S-NSSAI selection rules, the DNN selector rules, the time window criteria, and the location criteria.

[0307] 7. If the result of the URSP validation by the PCF is that the UE is not correctly following one or more of the traffic matching rules in the latest version of the URSP, the PCF returns a Failure parameter in the Npcf_SMPpolicy_Control_Create response to the SMF. The PCF may also include a reason for the failure, e.g., non-compliance with the URSP rules, or a more specific rejection cause that identifies the specific URSP rule that the UE is not following.

[0308] 8. The SMF forwards the rejection cause to the AMF in the Nsmf_PDUSession_CreateSMContext_Response message.

[0309] 9. The AMF rejects the PDU session establishment request from the UE, and the AMF includes a rejection cause of non-compliance with the URSP rules, or a more specific rejection cause indicating which URSP rule is not followed (e.g., non-compliance with the S-NSSAI selection rule, non-compliance with the DNN selection rule, non-compliance with the time window criterion, or non-compliance with the location criterion).

[0310] 10. If in step 6 the URSP validation by the PCF fails, the PCF may assume that the UE may not have the latest URSP rules, so the PCF may trigger a UE policy update procedure according to clause 4.2.4.3 of TS 23.502 to refresh the UE with the latest URSP rules.

[0311] 11. UE Policy Updates in Accordance with TS 23.502, Clause 4.2.4.3

[0312] 6.X.3 Impact on Services, Entities, and Interfaces Editor's Note: This article describes the impact to existing 3GPP nodes and functional elements.

[0313] UE, AMF, SMF - New App_ID parameter and new PDU session establishment rejection cause.

[0314] PCF-New APP Id parameter and URSP validation function.

[0315] <Modifications and Replacements> Detailed embodiments have been described above. Still, those skilled in the art will appreciate that numerous modifications and alternatives may be made to the above embodiments while having the benefit of the disclosure embodied herein. Merely by way of example, numerous such alternatives and modifications are now described.

[0316] In the above description, the UE 3 and network devices are described for ease of understanding as having a number of separate modules (such as a communications control module). These modules may thus be provided for certain applications, for example where an existing system is modified to implement the present disclosure, and in other applications, for example in a system designed with the inventive features in mind from the beginning, but these modules may not be recognizable as separate entities, as they may be built into an overall operating system or code. These modules may also be implemented in software, hardware, firmware, or a mixture of these.

[0317] Each controller may include any suitable form of processing circuitry, including, but not limited to, one or more hardware-implemented computer processors, microprocessors, central processing units (CPUs), arithmetic logic units (ALUs), input / output (IO) circuitry, internal memory / cache (program and / or data), processing registers, communications buses (e.g., control buses, data buses, and / or address buses), direct memory access (DMA) facilities, hardware or software implemented counters, pointers and / or timers, and / or the like.

[0318] In the above embodiment, a number of software modules have been described. Those skilled in the art will appreciate that the software modules may be provided in compiled or uncompiled form and may be provided to the UE 3 and the network device as a signal in a computer network or on a recording medium. Furthermore, the functions performed by some or all of the software may be performed using one or more dedicated hardware circuits. However, the use of software modules to update the functions of the UE 3 and the network device is preferred because the software modules facilitate the updating of the UE 3 and the network device.

[0319] In the above embodiment, 3GPP wireless communication (radio access) technology is used. However, any other wireless communication technology (e.g., WLAN, Wi-Fi, WiMAX, Bluetooth, etc.) and other fixed line communication technology (e.g., BBF access, cable access, optical access, etc.) can also be used according to the above embodiment.

[0320] Items of user equipment may include communication devices such as, for example, mobile phones, smartphones, user equipment, personal digital assistants, laptop / tablet computers, web browsers, e-book readers, and / or the like. Such mobile (and even generally fixed) devices are typically operated by a user, although so-called "Internet of Things" (IoT) devices and similar machine-type communication (MTC) devices may also be connected to the network. For simplicity, the present application refers to mobile devices (or UEs) in the description, but it will be understood that the described techniques may be implemented on any (mobile and / or generally fixed) communication device that may connect to a communication network to transmit / receive data, regardless of whether such communication device is controlled by human input or by software instructions stored in memory.

[0321] Various other modifications will be apparent to those skilled in the art and will not be described in further detail here.

[0322] As will be appreciated by those skilled in the art, the present disclosure may be embodied as a method and a system. Accordingly, the present disclosure may take the form of an entirely hardware embodiment, a software embodiment, or an embodiment combining software and hardware aspects.

[0323] It will be understood that each block of the block diagrams may be implemented by computer program instructions. The computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to generate a machine, such that the instructions executed by the processor of the computer or other programmable data processing apparatus generate means for implementing the function / act specified in the block or blocks of the flowcharts and / or block diagrams. A general purpose processor may be a microprocessor, but alternatively, the processor may be any conventional processor, controller, microcontroller, or state machine. A processor may also be implemented as a combination of computing devices, e.g., multiple microprocessors, one or more microprocessors, or any other such configuration.

[0324] The methods or algorithms described in connection with the examples disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. The software module may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. The storage medium may be coupled to the processor such that the processor can read information from, and write information to, the storage medium. Alternatively, the storage medium may be integrated into the processor. The processor and the storage medium may reside in an ASIC.

[0325] The previous description of the examples of the present disclosure is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to the examples will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other examples without departing from the spirit or scope of the present disclosure. Thus, the present disclosure is not intended to be limited to the examples set forth herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0326] Although the present disclosure has been shown and described in detail with reference to exemplary embodiments thereof, the present disclosure is not limited to such embodiments. It will be understood by those skilled in the art that various changes in form and details may be made without departing from the spirit and scope of the present disclosure as defined by this specification. For example, the above embodiments are not limited to 5GS, and the embodiments are also applicable to communication systems other than 5GS (e.g., 6G system, Beyond 5G system).

[0327] <Additional Notes> All or a part of the exemplary aspects of the above disclosure may be described as, but are not limited to, the following supplementary notes.

[0328] Appendix 1. receiving a policy for a user equipment (UE); receiving information from the UE relating to an application at the UE; verifying whether said information is consistent with said policy; if the information is inconsistent with the policy, sending a rejection message; Method of communication device.

[0329] Appendix 2. A method for a user equipment (UE), the method comprising: Send the first message, the first message includes first information associated with an application in the UE; receiving a second message after sending the first message; the second message includes second information; the second information indicates that the application is rejected; if the second message is received, stopping use of the application; method.

[0330] Appendix 3. Receive a policy for a user equipment (UE) and information indicating that validation of data of the UE is required; After receiving the information, verify whether the data is consistent with the policy; deactivating communications related to the data if the data is inconsistent with the policy; Method of communication device.

[0331] Appendix 4. receiving a policy for a user equipment (UE); receiving a service request message; the service request message includes an identifier of an application in the UE; determining whether the identifier is consistent with the policy; If the identifier is consistent with the policy, sending an acknowledgement message; If the identifier is not consistent with the policy, sending a rejection message. Method of communication device.

[0332] Appendix 5. A method for a user equipment (UE), the method comprising: If the UE has an established PDU session, sending a service request message; the service request message includes an identifier of an application in the UE; receiving a first message after sending the service request message; If the first message is an acknowledgment message, transmitting data; If the first message is a rejection message, stopping use of the application. method.

[0333] Appendix 6. receiving a policy for a user equipment (UE); Sending a request to transmit an identifier of an application in the UE; receiving the identifier; determining whether the identifier is consistent with the policy; Transmitting a message after verifying whether the identifier is consistent with the policy; the message includes at least one of information indicating permitted applications and information indicating non-permitted applications; Method of communication device.

[0334] Appendix 7. A method for a user equipment (UE), the method comprising: receiving a request to transmit an identifier of an application at the UE; Transmitting said identifier; receiving a message after transmitting the identifier; the message includes at least one of information indicating permitted applications and information indicating non-permitted applications; after receiving the message, ceasing unauthorized use of the application; method.

[0335] Appendix 8. Means for receiving a policy for a user equipment (UE); means for receiving information from the UE relating to an application in the UE; means for verifying whether said information is consistent with said policy; means for sending a rejection message if the information is not consistent with the policy; A communication device comprising:

[0336] Appendix 9. A user equipment (UE), A means for transmitting a first message, comprising: The first message includes first information related to an application in the UE; a means for receiving a second message after transmitting the first message, the means comprising: the second message includes second information; the second information indicating that the application is rejected; and means for suspending use of the application when the second message is received; A UE equipped with the above.

[0337] Appendix 10. means for receiving a policy for a user equipment (UE) and information indicating that validation of data of the UE is required; means for verifying, upon receiving said information, whether said data is consistent with said policy; means for deactivating communications associated with the data if the data is inconsistent with the policy; A communication device comprising:

[0338] Appendix 11. Means for receiving a policy for a user equipment (UE); A means for receiving a service request message, The service request message includes an identifier of an application in the UE. means for verifying whether the identifier is consistent with the policy; means for sending an acknowledgement message if the identifier is consistent with the policy; means for sending a rejection message if the identifier is not consistent with the policy; A communication device comprising:

[0339] Appendix 12. A user equipment (UE), A means for transmitting a service request message when the UE has an established PDU session, comprising: The service request message includes an identifier of an application in the UE. means for receiving a first message after sending the service request message; means for transmitting data if the first message is an acknowledgment message; means for suspending use of the application if the first message is a denial message; A UE equipped with the above.

[0340] Appendix 13. Means for receiving a policy for a user equipment (UE); means for transmitting a request to transmit an identifier of an application in the UE; means for receiving the identifier; means for verifying whether the identifier is consistent with the policy; means for sending a message after verifying whether the identifier is consistent with the policy, comprising: The message includes at least one of information indicating permitted applications and information indicating non-permitted applications; A communication device comprising:

[0341] Appendix 14. A user equipment (UE), means for receiving a request to transmit an identifier of an application in the UE; means for transmitting said identifier; A means for receiving a message after transmitting the identifier, comprising: The message includes at least one of information indicating permitted applications and information indicating non-permitted applications; means for stopping unauthorized use of the application after receiving the message; A UE equipped with the above.

[0342] Appendix 15 receiving policy information relating to the communications terminal from a second device; receiving information about applications for the communication terminal from the communication terminal; determining whether the information regarding an application for the communications terminal is consistent with the policy information regarding the communications terminal; sending information to the communications terminal relating to a rejection if the information relating to the application for the communications terminal does not match the policy information for the communications terminal; The method of the first device.

[0343] Appendix 16 storing policy information regarding the communication terminal from the second device; receiving information about applications for the communication terminal from the communication terminal; determining whether the information regarding an application for the communications terminal is consistent with the policy information regarding the communications terminal; sending information related to a rejection to a first device if the information related to an application for the communication terminal does not match the policy information for the communication terminal; A third device method.

[0344] Appendix 17. storing policy information regarding the communication terminal from the second device; receiving information about applications for the communication terminal from a third device for session management; receiving information from the third device for session management indicating that verification of data related to the communication terminal is required; based on the information indicating that a check is required for data related to the communication terminal, checking whether the information related to an application for the communication terminal is consistent with the policy information related to a communication terminal (UE); sending information relating to a rejection if the information relating to an application for the communication terminal does not match the policy information for the communication terminal; The fourth device method.

[0345] Appendix 18. A method for a communication terminal, comprising: Sending a service request message to a first device, the message including information regarding an application for the communication terminal; The first device stores policy information regarding the communication terminal from the second device; the first device ascertains whether the information regarding an application for the communication terminal is consistent with the policy information regarding the communication terminal; If the information regarding the application for the communication terminal does not match the policy information regarding the communication terminal, the first device transmits information related to a rejection to the communication terminal. method.

[0346] Appendix 19. A method for a communication terminal, comprising: Sending a service request message to a first device, the message including information regarding an application for the communication terminal; The first device stores policy information regarding the communication terminal from the second device; the first device ascertains whether the information regarding an application for the communication terminal is consistent with the policy information regarding the communication terminal; If the information related to the application for the communication terminal is consistent with the policy information for the communication terminal, the first device transmits information related to authorization to the communication terminal. method.

[0347] Appendix 20. storing policy information regarding the communication terminal from the second device; receiving a service request message from the communication terminal, the service request message including information regarding an application for the communication terminal; determining whether the information regarding an application for the communications terminal is consistent with the policy information regarding the communications terminal; sending information to the communications terminal relating to a rejection if the information relating to the application for the communications terminal does not match the policy information for the communications terminal; The method of the first device.

[0348] Appendix 21. 1. A method of a first apparatus, comprising: storing policy information regarding the communication terminal from the second device; receiving a service request message from the communication terminal, the service request message including information regarding an application for the communication terminal; determining whether the information regarding an application for the communications terminal is consistent with the policy information regarding the communications terminal; sending authorization-related information to the communications terminal if the information related to the application for the communications terminal matches the policy information for the communications terminal; The method of the first device.

[0349] Appendix 22. storing policy information regarding the communication terminal from the second device; sending a request message to the communication terminal for information regarding applications for the communication terminal; receiving from the communication terminal the information relating to an application for the communication terminal; determining whether the information regarding an application for the communications terminal is consistent with the policy information for the communications terminal; sending information to the communications terminal relating to a rejection if the information relating to the application for the communications terminal is inconsistent with the policy information for the communications terminal; The method of the first device.

[0350] Appendix 23. storing policy information regarding the communication terminal from the second device; sending a request message to the communication terminal for information regarding applications for the communication terminal; receiving from the communication terminal the information relating to an application for the communication terminal; determining whether the information regarding an application for the communications terminal is consistent with the policy information for the communications terminal; sending authorization-related information to the communications terminal if the information regarding the application for the communications terminal matches the policy information for the communications terminal; The method of the first device.

[0351] <Appendix 2> Appendix 1. receiving at least one of a User Equipment ID (UE ID), a Data Network Name (DNN), a Single-Network Slice Selection Assistance Information (S-NSSAI), and information related to a UE Route Selection Policy (URSP) rule from a core network node; determining whether user data for a User Equipment (UE) using a User Equipment (UE) session with the DNN and S-NSSAI matches the information related to a UE Route Selection Policy (URSP) rule; sending a result of the confirmation to the core network node; User Plane Function (UPF) methods.

[0352] Appendix 2. the information related to the URSP includes time information and location information; The method described in Appendix 1.

[0353] Appendix 3. The information related to the URSP is used by the UPF to verify whether the destination address of the user data matches a descriptor in the URSP rule. The method described in Appendix 1.

[0354] Appendix 4. The information related to the URSP is used by the UPF to verify whether the port number of the user data matches a descriptor in the URSP rule. The method described in Appendix 1.

[0355] Appendix 5. The information related to the URSP is used by the UPF to verify whether the protocol of the user data matches a descriptor in the URSP rule. The method described in Appendix 1.

[0356] Appendix 6. Memory, at least one processor configured to access the memory; Equipped with The at least one processor: receiving at least one of a User Equipment ID (UE ID), a Data Network Name (DNN), a Single-Network Slice Selection Assistance Information (S-NSSAI), and information related to a UE Route Selection Policy (URSP) rule from a core network node; determining whether user data for a User Equipment (UE) using a User Equipment (UE) session with the DNN and S-NSSAI matches the information related to a UE Route Selection Policy (URSP) rule; configured to transmit a result of the checking to the core network node. User Plane Function (UPF).

[0357] Appendix 7. the information related to the URSP includes time information and location information; A User Plane Function (UPF) as described in Supplementary Note 6.

[0358] Appendix 8. The information related to the URSP is used by the UPF to verify whether the destination address of the user data matches a descriptor in the URSP rule. A User Plane Function (UPF) as described in Supplementary Note 6.

[0359] Appendix 9. The information related to the URSP is used by the UPF to verify whether the port number of the user data matches a descriptor in the URSP rule. A User Plane Function (UPF) as described in Supplementary Note 6.

[0360] Appendix 10. The information related to the URSP is used by the UPF to verify whether the protocol of the user data matches a descriptor in the URSP rule. A User Plane Function (UPF) as described in Supplementary Note 6.

[0361] Although the present invention has been described above with reference to the embodiments (and examples), the present invention is not limited to the above-mentioned embodiments (and examples). Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

[0362] This application claims priority to Indian Provisional Patent Application No. 202211016661, filed on March 24, 2022, the disclosure of which is incorporated herein in its entirety. [Explanation of symbols]

[0363] 1. Telecommunications Systems 3. UE 5 (R)AN Nodes 7 Core Network 20 Data Network 31 Transceiver Circuit 32 Antenna 33 Controller 34 User Interface 35 USIM 36 Memory 51 Transceiver Circuit 52 Antenna 53 Network Interface 54 Controller 55 Memory 60RU 61DU 62 CU 70 AMF 71 SMF 72 UPF 73 PCF 74 AUSF 75 UDM 76 NWDAF 361 Operating Systems 362 Communication Control Module 363 Applications 551 Operating Systems 552 Communication Control Module 601 Transceiver Circuit 602 Antenna 603 Network Interface 604 Controller 605 Memory 611 Transceiver Circuit 612 Network Interface 613 Controller 614 Memory 621 Transceiver Circuit 622 Network Interface 623 Controller 624 Memory 701 Transceiver Circuit 702 Network Interface 703 Controller 704 Memory 711 Transceiver Circuit 712 Network Interface 713 Controller 714 Memory 721 Transceiver Circuit 722 Network Interface 723 Controller 724 Memory 731 Transceiver Circuits 732 Network Interface 733 Controller 734 Memory 741 Transceiver Circuit 742 Network Interface 743 Controller 744 Memory 751 Transceiver Circuit 752 Network Interface 753 Controller 754 Memory 3621 Transceiver Control Module 5521 Transceiver Control Module 6051 Operating System 6052 Communication Control Module 6141 Operating Systems 6142 Communication Control Module 6241 Operating Systems 6242 Communication Control Module 7041 Operating Systems 7042 Communication Control Module 7141 Operating Systems 7142 Communication Control Module 7241 Operating Systems 7242 Communication Control Module 7341 Operating Systems 7342 Communication Control Module 7441 Operating Systems 7442 Communication Control Module 7541 Operating Systems 7542 Communication Control Module 36301 APP1 36302 APP2 60521 Transceiver Control Module 61421 Transceiver Control Module 62421 Transceiver Control Module 70421 Transceiver Control Module 71421 Transceiver Control Module 72421 Transceiver Control Module 73421 Transceiver Control Module 74421 Transceiver Control Module 75421 Transceiver Control Module< / udm> < / ausf> < / pcf> < / upf> < / smf> < / amf>

Claims

1. receiving at least one of a User Equipment ID (UE ID), a Data Network Name (DNN), a Single-Network Slice Selection Assistance Information (S-NSSAI), and information related to a UE Route Selection Policy (URSP) rule from a core network node; determining whether user data for a User Equipment (UE) using a User Equipment (UE) session with the DNN and S-NSSAI matches the information related to a UE Route Selection Policy (URSP) rule; sending a result of the confirmation to the core network node; A User Plane Function (UPF) method.

2. The information related to the URSP includes time information and location information. The method of claim 1.

3. The information related to the URSP is used by the UPF to verify whether the destination address of the user data matches a descriptor in the URSP rule. The method of claim 1.

4. The information related to the URSP is used by the UPF to verify whether the port number of the user data matches a descriptor in the URSP rule. The method of claim 1.

5. The information related to the URSP is used by the UPF to verify whether the protocol of the user data matches a descriptor in the URSP rule. The method of claim 1.

6. Memory, at least one processor configured to access the memory; Equipped with The at least one processor receiving at least one of a User Equipment ID (UE ID), a Data Network Name (DNN), a Single-Network Slice Selection Assistance Information (S-NSSAI), and information related to a UE Route Selection Policy (URSP) rule from a core network node; determining whether user data for a User Equipment (UE) using a User Equipment (UE) session with the DNN and S-NSSAI matches the information related to a UE Route Selection Policy (URSP) rule; configured to transmit a result of the checking to the core network node. User Plane Function (UPF).

7. The information related to the URSP includes time information and location information. A User Plane Function (UPF) according to claim 6.

8. The information related to the URSP is used by the UPF to verify whether the destination address of the user data matches a descriptor in the URSP rule. A User Plane Function (UPF) according to claim 6.

9. The information related to the URSP is used by the UPF to verify whether the port number of the user data matches a descriptor in the URSP rule. A User Plane Function (UPF) according to claim 6.

10. The information related to the URSP is used by the UPF to verify whether the protocol of the user data matches a descriptor in the URSP rule. A User Plane Function (UPF) according to claim 6.

Images