User Equipment (UE) Identifier Request

Abstract

A method is provided that is performed by an application function (AF) associated with a communication network. The method includes sending a key request to a network function (NF) of the communication network for a security key (KAF) associated with an application session between the AF and a user equipment (UE), the key request including one of a request for a first identifier of the UE or a second identifier of the UE. The method further includes receiving a response from the NF including the security key (KAF) and one of the first identifier or a response code associated with the second identifier or the first identifier. The method further includes authenticating the UE for the application session based on the response.

Description

[Technical field]

[0001] The present application relates generally to wireless communication networks, and more particularly to improved techniques for authenticating user equipment (UE) in communication networks. [Background technology]

[0002] Currently, the fifth generation of cellular systems ("5G"), also known as New Radio (NR), is being standardized within the Third Generation Partnership Project (3GPP). NR is being developed for maximum flexibility to support multiple, widely differing use cases. Besides the usual mobile broadband use cases, there is also Machine Type Communication (MTC), Ultra-low Latency Critical Communications (URLCC), sidelink Device-to-Device (D2D), and several other use cases.

[0003] The 3GPP Security Working Group SA3 specified security-related features for Release 15 (Rel-15) of 5G systems (5GS) in 3GPP TS 33.501 (v15.11.0). In particular, 5GS includes many new features that require the introduction of new security mechanisms (e.g., compared to previous 4G / LTE systems). For example, 5GS seamlessly integrates non-3GPP access (e.g., via WLAN) with 3GPP access (e.g., NR and / or LTE). Thus, in 5GS, user equipment (UE, e.g., wireless device) can access services independently of the underlying radio access technology (RAT).

[0004] 3GPP Rel-16 introduces a new feature called authentication and key management for application (AKMA) based on 3GPP user credentials in 5G, including Internet of Things (IoT) use cases. More specifically, AKMA leverages the user's Authentication and Key Agreement (AKA) credentials to bootstrap security between the UE and the Application Function (AF), which allows the UE to securely exchange data with the application server. The AKMA architecture can be considered as an evolution of the Generic Bootstrapping Architecture (GBA) specified for 5GC in Rel-15 and further specified in 3GPP TS 33.535 (v.16.2.0).

[0005] As further specified in 3GPP TS33.535, the network and the UE AKMA The key and associated A-KID, and K AF Derive the key. K AF is used to support security of communication between the UE and the application function (AF), and A-KID is AF The root key (i.e., K AKMA ) AKMA Key Identifier (IDentifier). More specifically, the A-KID includes an AKMA Temporary UE Identifier (A-TID) and routing information related to the UE's Home Network (HPLMN).

[0006] The 3GPP Rel-17 study item on "Security aspects of enhanced support for edge computing in 5GC" includes requirements for authentication of UE identity to edge computing servers. 3GPP TS 23.558 (v1.2.0) specifies various interactions between an edge enabler client (EEC) and an edge enabler server (EES) or edge configuration server (ECS) that use the UE ID to identify the UE. The UE ID is specified in 3GPP TS 23.558 clause 7.2.6, and the only example of it is the generic public subscription identifier (GPSI).

[0007] In the context of AKMA, another possible UE ID is the A-KID described above, which may be considered a temporary UE ID, however, there are various issues, challenges, and / or difficulties with using the A-KID for UE authentication as described for Rel-17. Summary of the Invention

[0008] Accordingly, example embodiments of the present disclosure address these and other issues, challenges, and / or difficulties associated with authenticating UEs for application sessions, thereby facilitating advantageous deployment of secure SBA for 5G.

[0009] Some embodiments of the present disclosure include example methods (e.g., procedures) performed by an Application Function (AF) associated with a communications network. These example methods may be performed by any suitable type of AF.

[0010] These exemplary methods include having a network function (NF) of a communications network provide a security key (K) associated with an application session between an AF and a user equipment (UE). AFThe key request may include a request for a first identifier of the UE or a second identifier of the UE. These example methods include transmitting a key request for a security key (K AF ) and the first identifier or one of the second identifier or a response code associated with the first identifier from the NF. These example methods may also include authenticating the UE for the application session based on the response.

[0011] In some embodiments, authentication of a UE for an application session may be based on one of the following: · Determining a match between the second identifier in the key request and the first identifier in the response. The response code indicates that the second identifier matches an identifier of the UE stored in the communications network. The key request includes a second identifier and there is no response code in the response.

[0012] In some embodiments, the example methods may also include receiving an application session establishment request from the UE. In some of these embodiments, the second identifier may be included in the key request, and any of the following apply: The second identifier is received in the establishment request. The second identifier is stored locally in the AF.

[0013] In some of these embodiments, the second identifier may be a Universal Public Subscription Identifier (GPSI) of the UE, and the first identifier received in the response may be a GPSI stored in the communications network. In some of these embodiments, the second identifier may be a Subscription Persistent Identifier (SUPI) of the UE, and the first identifier received in the response may be a SUPI stored in the communications network. In some of these embodiments, the establishment request and the key request may include a security key (K) associated with the UE. AKMA) (A-KID). In some embodiments, the key request may include an identifier of the AF (e.g., AF_ID).

[0014] In some embodiments, the AF may be part of the communication network. In such embodiments, the key request may be sent to an anchor function for authentication and key management for an application (AAnF) in the communication network, and a response may be received from the AAnF. In other embodiments, the AF may be outside the communication network. In such embodiments, the key request may be sent to a network publishing function (NEF) in the communication network, and a response may be received from the NEF. Other embodiments include exemplary methods (e.g., procedures) performed by a network publishing function (NEF) of the communication network.

[0015] These exemplary methods involve transmitting from an application function (AF) outside the communications network a security key (K) associated with an application session between the AF and a user equipment (UE). AF The key request may include a request for a first identifier of the UE or a second identifier of the UE. These example methods include receiving a security key (K AF ) and the first identifier, or one of a response code associated with the second identifier or the first identifier, to the AF.

[0016] In some embodiments, these example methods may also include determining whether the first identifier of the UE is locally stored at the NEF. In such embodiments, these example methods may also include determining whether the second identifier received from the AF matches the locally stored first identifier based on determining that the first identifier of the UE is locally stored. In such cases, the response code sent to the AF may indicate whether the second identifier received from the AF matches the locally stored first identifier.

[0017] In some of these embodiments, based on a determination that the first identifier is not locally stored, the example method may include providing an AAnF in the communication network (e.g., selected by the NEF) with a security key (K AF ). A request for a first identifier of the UE A first identifier retrieved from the Unified Data Management (UDM) of the communications network. The second identifier received from the AF In such an embodiment, these exemplary methods use a security key (K AF ) and the first identifier, or one of a response code associated with the second identifier or the first identifier. In some embodiments, the information received from the AAnF may be forwarded as a response to the AF.

[0018] In some of these embodiments, the response code may indicate that one of the following matches the UE's identifier stored in the AAnF: - First identifier, if the first identifier is included in the key request to the AAnF - Second identifier, if included in the key request to AAnF In these other embodiments, the response code may indicate that the first identifier is unavailable to the AF, for example due to lack of access privileges.

[0019] In some embodiments, the second identifier in the key request may be a Universal Public Subscription Identifier (GPSI) of the UE, and the response sent to the AF may include one of a GPSI stored in the communication network or a response code indicating that the second identifier matches a GPSI stored in the communication network.

[0020] In some embodiments, when the key request includes a second identifier, the absence of a response code in the response indicates that the second identifier matches an identifier of the UE stored in the communications network.

[0021] In some embodiments, the key request includes a security key (K AKMA ) identifier (A-KID). Other embodiments include exemplary methods (e.g., procedures) performed by an anchor function for authentication and key management of applications in a communication network (AAnF).

[0022] These exemplary methods involve obtaining a security key (K) associated with an application session between an application function (AF) and a user equipment (UE). AF The key request may include a request for a first identifier of the UE or a second identifier of the UE. These example methods include receiving a security key (K AF ) and the first identifier, or one of the second identifier or a response code associated with the first identifier, to the AF. In some embodiments, the second identifier may be a Universal Public Subscription Identifier (GPSI) of the UE.

[0023] In some embodiments, these example methods may also include determining whether the second identifier received in the key request matches an identifier of the UE stored in the communications network. In such cases, the response code sent to the AF may indicate whether the second identifier received in the key request matches the first identifier stored in the communications network.

[0024] In some embodiments, when the key request includes a second identifier, the absence of a response code in the response may indicate that the second identifier matches an identifier of the UE stored in the communications network.

[0025] In some embodiments, these example methods may also include determining whether the first identifier is available to the AF in response to the request for the first identifier in the key request. In such cases, the response code sent to the AF may indicate whether the first identifier is available to the AF.

[0026] In some embodiments, the first identifier and the second identifier are Universal Public Subscription Identifiers (GPSIs) or Subscription Persistent Identifiers (SUPIs).

[0027] In some embodiments, the key request includes a security key (K AKMA In such an embodiment, the exemplary methods may include determining a security key (K) associated with the UE based on the identifier (A-KID). AKMA ) to obtain the security key (K AF ) can be included.

[0028] In some embodiments, the key request may include an identifier for the AF (eg, an AF_ID).

[0029] In some embodiments, the AF may be part of the communication network. In such embodiments, the key request may be received from the AF and sent to the AF. In other embodiments, the AF may be outside the communication network. In such embodiments, the key request may be received from a Network Publish Function (NEF) in the communication network and the response may be sent to the NEF.

[0030] Other embodiments include AFs, AAnFs, and NEFs (or network nodes hosting them) configured to perform operations corresponding to any of the example methods described herein. Other embodiments include a non-transitory computer-readable medium storing computer-executable instructions that, when executed by a processing circuit, configure such AFs, AAnFs, and NEFs to perform operations corresponding to any of the example methods described herein.

[0031] These and other objects, features and advantages of the present disclosure will become apparent from the following detailed description taken in conjunction with the drawings, which are briefly described below. [Brief description of the drawings]

[0032] [Figure 1] FIG. 1 illustrates various aspects of an exemplary 5G network architecture. [Diagram 2] FIG. 1 illustrates various aspects of an exemplary 5G network architecture. [Diagram 3] FIG. 1 illustrates an exemplary hierarchy of security keys in a 5G network. [Figure 4] FIG. 1 is a signal flow diagram of an exemplary authentication / authorization procedure between an edge enabler client (EEC) and an edge configuration server (ECS) in a 5G network. [Diagram 5] FIG. 4 is a signal flow diagram of an exemplary key generation procedure. [Figure 6] 5A-5C are signal flow diagrams of various exemplary procedures for generating and / or authenticating security keys, according to various embodiments of the present disclosure. [Figure 7] 5A-5C are signal flow diagrams of various exemplary procedures for generating and / or authenticating security keys, according to various embodiments of the present disclosure. [Figure 8] 5A-5C are signal flow diagrams of various exemplary procedures for generating and / or authenticating security keys, according to various embodiments of the present disclosure. [Figure 9]5A-5C are signal flow diagrams of various exemplary procedures for generating and / or authenticating security keys, according to various embodiments of the present disclosure. [Figure 10] FIG. 1 illustrates an example method (e.g., procedure) for an application function (AF) associated with a communication network, in accordance with various exemplary embodiments of the present disclosure. [Figure 11] FIG. 1 illustrates an example method (e.g., procedure) for a Network Exposure Function (NEF) of a communication network, in accordance with various example embodiments of the present disclosure. [Figure 12] FIG. 1 illustrates an example method (e.g., procedure) for an anchor function for authentication and key management (AAnF) for applications in a communication network, according to various example embodiments of the present disclosure. [Figure 13] FIG. 1 illustrates a wireless network in accordance with various exemplary embodiments of the present disclosure. [Figure 14] FIG. 1 illustrates an example embodiment of a UE in accordance with various aspects described herein. [Figure 15] FIG. 1 is a block diagram illustrating an example virtualization environment that can be used to implement various embodiments of a network node or NF described herein. [Figure 16] 1A-1D are block diagrams of various example communication systems and / or networks, in accordance with various example embodiments of the present disclosure. [Figure 17] 1A-1D are block diagrams of various example communication systems and / or networks, in accordance with various example embodiments of the present disclosure. [Figure 18] 1 is a flow diagram of an example method (eg, procedure) for transmitting and / or receiving user data, in accordance with various example embodiments of the present disclosure. [Figure 19] 1 is a flow diagram of an example method (eg, procedure) for transmitting and / or receiving user data, in accordance with various example embodiments of the present disclosure. [Figure 20]1 is a flow diagram of an example method (eg, procedure) for transmitting and / or receiving user data, in accordance with various example embodiments of the present disclosure. [Figure 21] 1 is a flow diagram of an example method (eg, procedure) for transmitting and / or receiving user data, in accordance with various example embodiments of the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0033] The exemplary embodiments briefly summarized above will now be described more fully with reference to the accompanying drawings. These descriptions are provided as examples to explain the subject matter to those skilled in the art, and should not be construed as limiting the scope of the subject matter to only the embodiments described herein. More specifically, examples illustrating the operation of various embodiments in accordance with the advantages described above are provided below.

[0034] In general, all terms used herein should be interpreted according to their ordinary meaning in the relevant technical field, unless a different meaning is clearly given and / or suggested by the context of use. All references to elements, apparatus, components, means, steps, etc. should be openly interpreted as referring to at least one instance of the element, apparatus, component, means, step, etc., unless expressly stated otherwise. The steps of any method and / or procedure disclosed herein need not be performed in the strict order of disclosure, unless expressly stated that one step follows or precedes another step and / or implied that one step must follow or precede another step. Any feature of any of the embodiments disclosed herein can be applied to any other embodiment, as appropriate. Similarly, any advantage of any of the embodiments can be applied to any other embodiment, and vice versa. Other objects, features, and advantages of the disclosed embodiments will become apparent from the following description.

[0035] Additionally, the following terminology is used throughout the description provided below: Radio Access Node: As used herein, a "radio access node" (or equivalently, a "radio network node", "radio access network node", or "RAN node") may be any node in a radio access network (RAN) of a cellular communications network that operates to transmit and / or receive signals wirelessly. Some examples of radio access nodes include, but are not limited to, base stations (e.g., a new radio (NR) base station (gNB) in a 3GPP fifth generation (5G) NR network, or an enhanced or evolved Node B (eNB) in a 3GPP LTE network), base station distributed components (e.g., CU and DU), high power or macro base stations, low power base stations (e.g., a micro base station, a pico base station, a femto base station, or a home base station, etc.), integrated access backhaul (IAB) nodes (or components of an IAB node, such as a MT or DU), transmission points, remote radio units (RRUs or RRHs), and relay nodes. Core Network Node: As used herein, a "core network node" is any type of node in a core network. Some examples of core network nodes include, for example, a Mobility Management Entity (MME), a Serving Gateway (SGW), a Packet Data Network Gateway (P-GW), etc. A core network node may also be a node that implements a specific Core Network Function (NF), such as an Access and Mobility Management Function (AMF), a Session Management Function (AMF), a User Plane Function (UPF), a Service Capability Exposure Function (SCEF), etc. Wireless Device: As used herein, a "wireless device" (or "WD" for short) is any type of device that can access (i.e., be served by) a cellular communications network by communicating wirelessly with network nodes and / or other wireless devices. Wireless communication can involve the transmission and / or reception of radio signals using electromagnetic, radio, infrared waves, and / or other types of signals suitable for conveying information through the air. Unless otherwise noted, the term "wireless device" is used interchangeably herein with "user equipment" (or "UE" for short). Some examples of wireless devices include, but are not limited to, smartphones, mobile phones, cell phones, voice over IP (VoIP) phones, wireless local loop phones, desktop computers, personal digital assistants (PDAs), wireless cameras, gaming consoles or devices, music storage devices, playback appliances, wearable devices, wireless endpoints, mobile stations, tablets, laptop computers, laptop embedded equipment (LEE), laptop mounted equipment (LME), smart devices, wireless customer premises equipment (CPE), mobile telecommunications (MTC) devices, Internet of Things (IoT) devices, vehicle mounted wireless terminal devices, mobile terminals (MT), and the like. Wireless Node: As used herein, a "wireless node" may be either a "wireless access node" (or an equivalent term) or a "wireless device." Network Node: As used herein, a "network node" is any node that is part of either the radio access network (e.g., radio access node or equivalent terminology) or the core network (e.g., core network node as described above) of a cellular communications network. Functionally, a network node is equipment that is configured, arranged, and / or operable to directly or indirectly communicate with wireless devices and / or other network nodes or equipment in the cellular communications network, to enable and / or provide wireless access to wireless devices, and / or to perform other functions (e.g., management) in the cellular communications network. Node: As used herein, the term “node” (without any prefix) may be any type of node capable of operating within or with a wireless network (including a RAN and / or a core network), including a radio access node (or equivalent term), a core network node, or a wireless device. Service: As used herein, the term "service" generally refers to a set of data associated with one or more applications and transmitted over a network along with specific delivery requirements that must be met for the applications to be successful. Component: As used herein, the term “component” generally refers to any component required for the delivery of a service. Examples of components are the RAN (e.g., E-UTRAN, NG-RAN, or parts thereof such as eNB, gNB, base station (BS)), the CN (e.g., EPC, 5GC, or parts thereof, including any type of link between the RAN and CN entities), and a cloud infrastructure with associated resources such as computation, storage, etc. In general, each component can have a “manager”, which is an entity that can collect historical information about resource usage and provide information about the current and predicted future availability of resources associated with that component (e.g., RAN manager).

[0036] It should be noted that the description given herein focuses on 3GPP cellular communication systems, and thus 3GPP terminology or terminology similar to 3GPP terminology is generally used. However, the concepts disclosed herein are not limited to 3GPP systems. Other wireless systems, including but not limited to Wideband Code Division Multiple Access (WCDMA), Worldwide Interoperability for Microwave Access (WiMax), Ultra Mobile Broadband (UMB), and Global System for Mobile Communications (GSM), may also benefit from the concepts, principles, and / or embodiments described in this disclosure.

[0037] Additionally, functions and / or operations described herein as being performed by a wireless device or network node may be distributed over multiple wireless devices and / or network nodes. Additionally, although the term "cell" is used herein, it should be understood that a beam may be used instead of a cell (particularly for 5G NR), and thus the concepts described herein apply equally to both cells and beams.

[0038] At a high level, the 5G system (5GS) is broadly composed of an Access Network (AN) and a Core Network (CN). The AN provides connectivity to the UEs to the CN, for example via base stations such as gNBs or ng-eNBs, which are described below. The CN contains various Network Functions (NFs) that provide a range of different functions such as session management, connection management, charging, authentication, etc.

[0039] The communication links between the UE and the 5G network (AN and CN) can be grouped into two different hierarchical layers. The UE communicates with the CN over the Non-Access Stratum (NAS) and with the AN over the Access Stratum (AS). All NAS communication is between the UE and the AMF via the NAS protocol. Security for communication on these layers is provided by the NAS protocol (for NAS) and PDCP (for AS).

[0040] FIG. 1 illustrates a high-level view of an exemplary 5G network architecture consisting of a Next Generation RAN (NG-RAN) 199 and a 5G Core (5GC) 198. The NG-RAN 199 may include one or more g Node Bs (gNBs) connected to the 5GC via one or more NG interfaces, such as gNBs 100, 150 connected via interfaces 102, 152, respectively. More specifically, the gNBs 100, 150 may be connected to one or more Access and Mobility Management Functions (AMFs) in the 5GC 198 via respective NG-C interfaces. Similarly, the gNBs 100, 150 may be connected to one or more User Plane Functions (UPFs) in the 5GC 198 via respective NG-U interfaces. As described in more detail below, the 5GC 198 may include various other Network Functions (NFs).

[0041] Further, the gNBs may be connected to each other via one or more Xn interfaces, such as Xn interface 140 between gNB 100 and gNB 150. The radio technology for NG-RAN is often referred to as "New Radio" (NR). With respect to the NR interface to the UE, each gNB may support Frequency Division Duplex (FDD), Time Division Duplex (TDD), or a combination thereof. Each gNB may serve a geographic coverage area that includes one more cell, and in some instances may provide coverage to each cell using various directional beams.

[0042] The NG-RAN 199 is layered into a Radio Network Layer (RNL) and a Transport Network Layer (TNL). The NG-RAN architecture, i.e. the NG-RAN logical nodes and the interfaces between the NG-RAN logical nodes, are specified as part of the RNL. For each of the NG-RAN interfaces (NG, Xn, F1), the associated TNL protocols and functions are specified. The TNL provides services for user plane transport and signaling transport. In some example configurations, each gNB is connected to all 5GC nodes within the "AMF domain", which is specified in 3GPP TS 23.501 (v15.5.0). If security protection for CP data and UP data on the TNL of the NG-RAN interface is supported, NDS / IP (3GPP TS 33.401 (v15.8.0)) shall be applied.

[0043] The NG RAN logical node shown in FIG. 1 (and described in 3GPP TS38.401 (v15.6.0) and 3GPP TR38.801 (v14.0.0)) includes a central unit (CU or gNB-CU) and one or more distributed units (DU or gNB-DU). For example, gNB 100 includes gNB-CU 110 and gNB-DU 120 and 130. The CU (e.g., gNB-CU 110) is a logical node that hosts higher layer protocols and performs various gNB functions such as controlling the operation of the DU. The DU (e.g., gNB-DU 120, 130) is a distributed logical node that hosts lower layer protocols and can include various subsets of gNB functions depending on the functional separation option. Thus, the CU and DU can each include various circuits necessary to perform their respective functions, including processing circuits, transceiver circuits (e.g., for communication), and power supply circuits.

[0044] The gNB-CU connects to one or more gNB-DUs over respective F1 logical interfaces, such as interfaces 122 and 132 shown in FIG. 1. However, a gNB-DU can only be connected to a single gNB-CU. The gNB-CU and connected gNB-DU only appear as a gNB to other gNBs and 5GC. In other words, the F1 interface is invisible outside the range of the gNB-CU.

[0045] Another change in 5GS (e.g., in 5GC) is that the traditional peer-to-peer interfaces and protocols found in previous generation networks are modified and / or replaced by a service-based architecture (SBA) in which a network function (NF) offers one or more services to one or more service consumers. This may be done, for example, by a HyperText Transfer Protocol / Representational State Transfer (HTTP / REST) ​​application programming interface (API). In general, various services are self-contained functions that can be changed and modified in an independent manner without affecting other services. This SBA model may also employ principles such as modularity, reusability, and self-containment of NFs to enable deployment leveraging modern virtualization and software technologies.

[0046] Services in 5GC can be stateless, where business logic and data context are separated. For example, a service can store its context externally in its own database. This can facilitate various cloud infrastructure features like auto-scaling or auto-healing. Furthermore, 5GC services can be composed of various "service operations", which are finer divisions of the overall functionality of the service. The interaction between the service consumer and the producer can be of the type of "request / response" or "subscribe / notify" interaction.

[0047] 2 illustrates an example non-roaming 5G reference architecture with service-based interfaces in the Control Plane (CP) and various 3GPP-defined NFs, including the following NFs, with further details provided for those most relevant to this disclosure: · The Application Function (AF, with Naf interface) interacts with the 5GC to provision information to the network operator and to subscribe to certain events occurring in the operator's network. The AF provides the application with services provided at a layer (i.e. the transport layer) different from the layer where the service is requested (i.e. the signaling layer) and the control of flow resources is subject to what is negotiated with the network. The AF communicates dynamic session information to the PCF (through the N5 interface), including a description of the media delivered by the transport layer. ·The Policy Control Function (PCF, with Npcf interface) supports a unified policy framework governing network behavior by providing PCC rules (e.g. regarding the treatment of each service data flow under PCC control) to the SMF via the N7 reference point. The PCF provides policy control decisions and flow-based charging control to the SMF, including service data flow discovery, gating, QoS, and flow-based charging (except credit control). The PCF receives session and media related information from the AF and notifies the AF of traffic (or user) plane events. · User Plane Function (UPF) - Supports handling of user plane traffic based on rules received from the SMF, including packet inspection and various enforcement actions (e.g., event detection and reporting). The UPF communicates with the RAN (e.g., NG-RNA) via the N3 reference point, with the SMF (described below) via the N4 reference point, and with the external Packet Data Network (PDN) via the N6 reference point. The N9 reference point is for communication between two UPFs. · The Session Management Function (SMF, with Nsmf interface) interacts with the separated traffic (or user) plane, including creating, updating and deleting Protocol Data Unit (PDU) sessions, as well as managing session context with the User Plane Function (UPF), e.g. for event reporting. For example, the SMF performs data flow detection (based on filter specifications contained in the PCC rules), online and offline charging interactions, and policy enforcement. · The Charging Function (CHF, with Nchf interface) is responsible for the aggregated online and offline charging functions. It provides quota management (for online charging), reauthorization triggers, evaluation conditions etc. and is informed about usage reports by the SMF. Quota management involves granting a specific number of units (e.g. bytes, seconds) to a service. The CHF also interacts with the billing system. · The Access and Mobility Management Function (AMF, with Namf interface) terminates the RAN CP interface and handles all mobility and attachment management for the UE (similar to the MME in the EPC). The AMF communicates with the UE via the N1 reference point and with the RAN (e.g. NG-RAN) via the N2 reference point. · Network Exposure Function (NEF) with Nnef Interface - acts as an entry point into the operator's network by securely exposing network capabilities and events offered by 3GPP NFs to the AF and by providing a way for the AF to securely provide information to the 3GPP network. For example, the NEF provides services that allow the AF to provision specific subscription data (e.g. expected UE behavior) for various UEs. · Network Repository Function (NRF) with Nnrf interface - provides service registration and discovery, and allows NFs to identify suitable services available from other NFs. Network Slice Selection Function (NSSF) with Nnssf interface - A "network slice" is a logical partition of a 5G network that provides specific network capabilities and characteristics, e.g. in support of a specific service. A network slice instance is a set of NF instances and the required network resources (e.g. computation, storage, communication) that provide the network slice capabilities and characteristics. The NSSF enables other NFs (e.g. AMF) to identify a network slice instance suitable for a UE's desired service. · Authentication Server Function with Nausf Interface (AUSF) - performs user authentication based on the user's Home Network (HPLMN) and calculates security keying material for various purposes. · Network Data Analysis Function (NWDAF) with Nnwdaf Interface - Provides network analysis information (e.g., statistics and / or forecast information of past events) to other NFs at the network slice instance level. · Location Management Function (LMF) with Nlmf interface - Supports various functions related to determining the UE position including determining the UE's position and obtaining either DL position measurements or estimates from the UE, UL position measurements from the NG RAN, and non-UE related assistance data from the NG RAN.

[0048] The Unified Data Management (UDM) function supports the generation of 3GPP authentication credentials, handling of user identification, access authorization based on subscription data, and other subscriber-related functions. To provide this functionality, the UDM uses subscription data (including authentication data) stored in the 5GC Unified Data Repository (UDR). In addition to the UDM, the UDR supports the storage and retrieval of policy data by the PCF and the storage and retrieval of application data by the NEF.

[0049] The NRF allows all NFs to discover services offered by other NFs, and the Data Storage Function (DSF) allows all NFs to store their context. In addition, the NEF exposes 5GC capabilities and events to AFs inside and outside the 5GC. For example, the NEF provides a service that allows the AF to provision specific subscription data (e.g., expected UE behavior) for various UEs.

[0050] As mentioned above, 3GPP Rel-16 introduces new AKMA features based on 3GPP user credentials in 5G, including IoT use cases. More specifically, AKMA leverages the user's AKA credentials to bootstrap security between the UE and the AF, which allows the UE to securely exchange data with application servers. The AKMA architecture can be considered an evolution of the Generic Bootstrapping Architecture (GBA) specified for 5GC in Rel-15 and further specified in 3GPP TS 33.535 (v.16.2.0).

[0051] In addition to the NEF, AUSF, and AF shown in Figure 2 and described above, the AKMA also utilizes an Anchor Function (AAnF) for authentication and key management for applications. This function is shown in Figure 2 with the Naanf interface. In general, the AAnF interacts with the AUSF and maintains the UE AKMA context that is used, for example, for subsequent bootstrap requests by application functions. At a high level, the AAnF is similar to the Bootstrapping Server Function (BSF) specified for Rel-15 GBA.

[0052] In general, AKMA reuses the results of the 5G primary authentication procedure used to authenticate the UE during network registration (also called "implicit bootstrapping"). In this procedure, the AUSF is responsible for generating and storing keying material. In particular, the AKMA key hierarchy includes the following, which is further described in Figure 3: ·K AUSF : Root key. It is the output of the primary authentication procedure and is stored in the UE (i.e., the mobile equipment, ME, part) and the AUSF. Furthermore, the AUSF stores K as the result and the output of the primary authentication result in the UDM as specified in 3GPP TS33.501. AUSF It is possible to report the specific AUSF instance that generates the ·K AKMA :K by ME and AUSF AUSF A key identifier A-KID is an anchor key derived from K and used by the AAnF to generate further AKMA keying material. AKMA The A-KID is the AKMA Key Identifier for the UE. The A-KID contains the AKMA Temporary UE Identifier (A-TID) and routing information related to the UE's Home Network (HPLMN). ·K AF :K by ME and AAnF AKMA An application key derived from and used by the UE and the application to securely exchange application data.

[0053] When the UE wants to use AKMA, the UE AF and constructs an A-KID and transmits the A-KID to the AF, which may be located inside or outside the operator's network. The AF receives the K associated with the A-KID from the AAnF by transmitting the A-KID to the AAnF via the NEF when the AF is located outside the operator's network, or directly when the AF is located inside the operator's network. AF After authentication of the AF by the operator network, the AAnF, possibly via the NEF, requests the corresponding K AFThis sends the shared key material K AF is made available in the UE and the AF to support security of communications between the UE and the AF.

[0054] The 3GPP Rel-17 study item on "Security aspects of enhanced support for edge computing in 5GC" includes requirements for authentication of UE identity to edge computing servers. 3GPP TS 23.558 (v1.2.0) specifies various interactions between an Edge Enabler Client (EEC) and an Edge Enabler Server (EES) or Edge Configuration Server (ECS) that use a UE ID to identify the UE. The UE ID is specified in 3GPP TS 23.558, clause 7.2.6, and an example of this is the Generic Public Subscription Identifier (GPSI).

[0055] The EES / ECS needs to authenticate the GPSI of the UE, which is provided by the EEC running on the UE. One possible solution is the AKMA as described in 3GPP TR33.839 (v0.3.0). Figure 4 shows a signal flow diagram of an exemplary authentication / authorization procedure between the EEC and the ECS. In addition, the procedure shown in Figure 4 includes the UDM / AAnF and the NEF. Although some of the operations shown in Figure 4 are numbered, these are intended for ease of explanation and do not imply a strict chronological order of the operations, unless otherwise specified.

[0056] The prerequisites for the numbered actions are shown in boxes and include: The EEC and ECS communicate with the A-KID and K-KID via the AKMA (as specified in 3GPP TS33.535). AF are shared. ·ECS or 5GC will be configured to have edge computing related profiles of EEC. ·ECS and 5GC share the UE identifier (i.e. GPSI) to identify the EEC. The ECS stores the association between the EEC ID and the UE identifier, which is pre-configured in the ECS by the ECS administrator.

[0057] In operation 1, the UE initiates a service provisioning procedure including the EEC ID (as further specified in section 8.3 of 3GPP TS23.558). In operation 2, the ECS searches for the GPSI based on the association with the pre-configured EEC ID. In operation 3, to prove the authenticity of the UE's GPSI, the ECS sends an association confirmation request including the GPSI and the A-KID to the UDM. If the ECS is located outside the 5GC, the request should be sent via the NEF. In operation 4, to verify the association of the GPSI and the A-KID, the UDM first contacts the AUSF to obtain the corresponding SUPI of the A-KID. Then, the UDM verifies the association of the GPSI and the A-KID based on the association between the SUPI and the GPSI.

[0058] In operation 5, the UDM sends an association validation response back to the ECS. In operation 6, if the validation is successful, the ECS retrieves the edge computing related profile of the EEC from the 5GC or its local database. The ECS can then determine the authorization of the EEC based on the EEC's profile. In operation 7, the ECS sends a provisioning response to the EEC.

[0059] In the current AKMA solution described above, the AAnF is the K corresponding to the received A-KID. AF AF simply returns K AF It is not possible to authenticate the identity of a UE based on the A-KID associated with it, but rather requires a genuine persistent identifier.

[0060] 3GPP technical document S3-203191 proposes modifications to the AKMA procedure to allow for optional provision of a UE identity to the AKMA AF. According to this proposal, the AAnF may provide the UE identity (e.g., SUPI or GPSI, if available) to the AKMA AF based on the AAnF local policy for the AF. AF The AF may then transmit the AF with the AF ID along with the AF ID. Figure 5 shows a signal flow diagram of an exemplary key generation procedure according to this proposal. Although some of the operations shown in Figure 5 are numbered, these are for ease of explanation and do not imply a strict chronological order of the operations unless otherwise stated.

[0061] Similar to Fig. 4, primary authentication between the UE and the AAnF is a prerequisite. In action 1, the UE sends an application establishment request including the A-KID to the AF. The UE must obtain the KID before starting communication with the AF. AUSF From K AKMA Before or after sending a message, the UE generates K AF may be derived.

[0062] In operation 2, if the AF does not have an active context associated with the received A-KID, the AF sends a Naanf_AKMA_ApplicationKey_Get request to the AAnF, including the received A-KID and an AF identifier (AF_ID). The AF ID consists of the fully qualified domain name (FQDN) of the AF and a Ua* security protocol identifier that identifies the security protocol that the AF uses with the UE. When the AAnF receives this request, it checks whether the AAnF can provide services to the AF based on the configured local policy or based on the authorization information or policy provided by the NRF using the AF ID. If unsuccessful, the AAnF rejects the request and the procedure ends. The AAnF obtains the UE-specific KID identified by the A-KID. AKMAverifies whether the subscriber is authorized to use AKMA based on the presence or absence of K AKMA If present, the AAnF continues with action 3, otherwise the AAnF skips action 3 and performs action 4 with the error response.

[0063] In action 3, AAnF is required. AF If AAnF does not already have K AKMA From AF key (K AF The key derivation procedure is described in 3GPP TS38.535 (v17.0.0) Annex A.4. In operation 4, the AAnF derives K AF And, K. AF The AF sends a Naanf_AKMA_ApplicationKey_Get response to the AF, including an expiration time and optionally a UE identifier (UE_ID). The UE identifier may be the UE's SUPI or GPSI (if available), as determined by the AAnF based on the AF's local policy. In operation 5, the AF sends an application session establishment response to the UE. If the information received in operation 4 indicates a failure of the AKMA key request, the AF rejects the application session establishment by including a cause of failure. The UE may then trigger a new application session establishment request to the AKMA AF using the latest A-KID.

[0064] According to the solution proposed by S3-203191, returning the UE_ID in operation 4 is optional, and the conditions for returning the UE_ID are not specified. Therefore, the AF has no control over when and how to authenticate the UE identity. Not being able to authenticate the UE when needed and / or providing services to an unauthenticated UE may cause various problems, challenges, and / or difficulties for the AF.

[0065] Embodiments of the present disclosure address these and other problems, challenges, and / or difficulties by providing novel, flexible, and efficient techniques for improving existing AKMA-type procedures to enable an AF to perform UE authentication with low and / or minimal complexity.

[0066] At a high level, in some embodiments, the AF may send an indicator (e.g., to the AAnF or NEF) to request a UE identifier. Other embodiments include a UE identifier (e.g., GPSI) confirmation mechanism in the AKMA AF. These embodiments are described in more detail below, using various figures for illustration purposes. Although some of the operations shown in these figures are numbered, these labels are intended for ease of explanation and do not imply a strict chronological order of the operations, unless otherwise specified.

[0067] Figure 6 illustrates a signal flow diagram of an exemplary key generation procedure according to some embodiments of the present disclosure. Many operations in Figure 6 are substantially similar to those illustrated in Figure 5, so only the differences are described below.

[0068] In operation 2, the AF includes in the Naanf_AKMA_ApplicationKey_Get request an indicator to request a UE identifier. In operation 3, upon receiving this indicator, the AAnF determines the UE identifier (e.g., SUPI and / or GPSI) to send and grants the AF access to the requested identifier based on local policy or UE subscription information. If the requested GPSI is not available locally, the AAnF may fetch the GPSI from another NF, for example from UDM by a Nudm identifier translation service operation.

[0069] In operation 4, if an indicator requesting a UE identifier was present in the request but neither a SUPI nor a GPSI is sent back to the AF (e.g. access is not authorized per local policy), the AAnF may include in the response an indication that the UE identifier is not available or an error. Otherwise, the AAnF returns a UE_ID as described above for FIG. 5.

[0070] 7 illustrates a signal flow diagram of an exemplary application key request procedure according to some embodiments of the present disclosure. Specifically, FIG. 7 illustrates a signal flow diagram of an application key request procedure according to an embodiment of the present disclosure, in which the AF requests a K from the AAnF via the NEF when the AF is located outside the operator's network. AF 1 illustrates an exemplary procedure that may be used to request

[0071] In operation 1, when the AF is going to request an AKMA application key for the UE from the AAnF (e.g., when the UE initiates an application session establishment request as in operation 1 in Figure 5), the AF discovers the HPLMN of the UE based on the A-KID and sends a request to the AAnF via the NEF service API. The request includes the A-KID and AF ID, as well as an indicator to request the UE identifier, similar to operation 2 in Figure 6.

[0072] In operation 2, AF AF If the NEF is authorized by the NEF to request K, the NEF discovers and selects an AAnF based on local configuration or via the NRF in a manner similar to how the AF selects an AAnF in operation 1 of Figures 5-6. In operation 3, the NEF notifies the selected AAnF of K. AF If neither SUPI nor GPSI is available locally at the NEF to fulfill the AF request, the NEF may include an indicator in the request requesting a UE identifier.

[0073] In operation 4, AAnF calculates K AF Generate K AF And, K. AFExpiration date (K AF _exptime) and, if available, the GPSI or SUPI of the UE to the NEF. If an indicator requesting a UE identifier is present in the request of action 3 but neither a SUPI nor a GPSI is provided to the NEF (e.g. access is not authorized per local policy), the AAnF may include in the response of action 4 an indication of an error or that the UE identifier is unavailable.

[0074] In operation 5, the NEF forwards the response to the AF including the GPSI or SUPI of the UE if available (for simplicity, only the GPSI is shown in FIG. 7). In some embodiments, if neither the SUPI nor the GPSI to fulfill the AF's request is available locally at the NEF or available from the AAnF, the NEF may fetch the GPSI from another NF, for example from the UDM by a Nudm identifier translation service operation. If an indicator requesting a UE identifier is present in the request of operation 1, but neither the SUPI nor the GPSI is provided to the AF, the NEF may include an error or an indication that the UE identifier is unavailable in the response of operation 5.

[0075] In any of the embodiments shown in Figures 6-7, the AF may perform various other operations to validate the GPSI received from the AAnF (Figure 6) or NEF (Figure 7). In such an embodiment, if the AF already has a UE identifier available locally (e.g., GPSI1 obtained through pre-provisioning or from the UE), the AF may first AFThe AF may then verify (e.g., in an application protocol dependent manner) that the UE also has GPSI1 and then check GPSI1 against the UE identifier (e.g., GPSI2) obtained from the AAnF or NEF. If the AF verifies that these two UE identifiers are the same (e.g., GPSI1=GPSI2), the UE is authenticated and the AF proceeds with normal application specific logic. Otherwise (e.g., GPSI1!=GPSI2), the AF may consider the UE authentication to be unsuccessful and not provide the UE with an application session.

[0076] FIG. 8 illustrates a signal flow diagram of another exemplary key generation procedure according to some embodiments of the present disclosure. In the scenario illustrated in FIG. 8, an AF located inside an operator's network requests an AF-specific AKMA key from an AAnF. In this scenario, the AF already has a UE identifier, which may be obtained from the UE through pre-provisioning or from a previous interaction with the network. Many operations in FIG. 8 are substantially similar to those illustrated in FIG. 5, so only the differences are described below.

[0077] In operation 2, the AF includes a UE identifier (e.g., GPSI or SUPI) in a Naanf_AKMA_ApplicationKey_Get request to the AAnF. In operation 3, the AAnF verifies that the UE identifier from the AF matches a locally available UE identifier, e.g., SUPI or GPSI. If the GPSI is not locally available at the AAnF, the AAnF may fetch the GPSI from another NF, e.g., from UDM by a Nudm Identifier Translation Service operation. In operation 4, the AAnF retrieves the K AF And, K. AFSend a Naanf_AKMA_ApplicationKey_Get response to the AF, including the expiration date and, optionally, a response code. If a match is determined in operation 3, this may be indicated by the response code, or the absence of a response code in combination with other provided parameters (which may imply a match). If a match is not determined in operation 3, the response code may indicate an error, a lack of a match, etc.

[0078] 9 illustrates a signal flow diagram of another exemplary application key request procedure according to some embodiments of the present disclosure. Specifically, FIG. 9 illustrates a signal flow diagram of an application key request procedure in which an AF requests a K from an AAnF via an NEF when the AF is located inside an operator's network. AF 9 illustrates an exemplary procedure that may be used to request a . Many of the operations in Figure 9 are substantially similar to those illustrated in Figure 7, so only the differences are described below.

[0079] In operation 1, when the AF wants to request an AKMA application key for the UE from the AAnF, the AF sends a request to the AAnF via the NEF service API. The request includes the A-KID, the AF ID, and a UE identifier already available at the AF, as described above in connection with operation 2 of Figure 8. In some cases, including the UE identifier may be optional.

[0080] In operation 3, the NEF verifies that the UE identifier from the AF matches a locally available UE identifier, e.g., SUPI or GPSI. If they do not match, the NEF may send a response with an error code. If the GPSI is not available locally but the SUPI is available in the NEF, the NEF may fetch the GPSI from another NF (e.g., from the UDM by a Nudm identifier translation service operation). After selecting an AAnF, the NEF forwards the request to the selected AAnF and includes the UE identifier. If neither the SUPI nor the GPSI is available locally in the NEF (or can be fetched from the UDM), the NEF may include the UE identifier received in operation 1 in the request sent in operation 3.

[0081] Any of the above-mentioned embodiments may be equally applied to edge computing use cases where the EEC plays the role of the UE and the EES / ECS plays the role of the AF. In such a scenario, AKMA is a shared key K between the UE and the EES / ECS. ECUEID =K AF In this case, the EEC and EES / ECS can be used to generate the K for the validation of GPSI. ECUEID The GPSI can be used to authenticate the shared K ECUEID A challenge-response protocol may be employed to use the cipher suite. For example, if HTTP is used as the application protocol, then HTTP Digest, specified in IETF RFC 7616, may be used for this purpose.

[0082] Further, based on using the A-KID as a temporary identifier, the GPSI may be verified based on the following operations: 1. EEC transmits GPSI in addition to A-KID to EES / ECS. 2. The EES / ECS transmits the A-KID and an indicator requesting GPSI together with the AF_ID or the GPSI obtained from the EEC to the AAnF via the NEF or directly depending on the position of the EEC / ECS. 3. The AAnF fetches the GPSI from the UDM based on the SUPI that is part of the AAnF AKMA context. 4. The AAnF authorizes the AF to acquire the GPSI or to verify that the GPSI sent by the AF matches the GPSI available in the network. If the verification is successful, the AAnF provides the KAF and GPSI to the EES / ECS. Otherwise, the AAnF sends an appropriate failure message. 5. The EES / ECS checks whether the GPSI sent by the EEC and the GPSI received by the AAnF are the same, or checks the response code of the UE identifier verification from the network. If the verification is successful, it will send the K for authentication as described above. ECUEID may be used.

[0083] The above-described embodiments may be further described with reference to FIGS. 10-12, which illustrate exemplary methods (e.g., procedures) for AF, NEF, and AAnF, respectively. In other words, various features of the operations described below correspond to the various embodiments described above. The exemplary methods illustrated in FIGS. 10-12 may be complementary to each other such that they may be used cooperatively to provide benefits, advantages, and / or solutions to problems described herein. Although the exemplary methods are illustrated in FIGS. 10-12 by certain blocks in a particular order, the operations corresponding to the blocks may be performed in a different order than illustrated and may be combined and / or divided into operations having different functionality than illustrated. Optional blocks and / or operations are indicated by dashed lines.

[0084] More specifically, Figure 10 illustrates an example method (e.g., procedure) for an application function (AF) associated with a communications network, in accordance with various example embodiments of the present disclosure. The example method illustrated in Figure 6 may be performed by any suitable type of AF, such as those described herein with reference to other figures.

[0085] The example method may include the operation of block 1020, where the AF transmits to a network function (NF) of the communication network a security key (K) associated with an application session between the AF and a user equipment (UE). AF The AF may transmit a key request for a security key (K). The key request may include a request for a first identifier of the UE (e.g., as shown in FIGS. 6-7) or a second identifier of the UE (e.g., as shown in FIGS. 8-9). The example method may also include the operation of block 1030, where the AF transmits a security key (K). AF ) and the first identifier or one of the second identifier or a response code associated with the first identifier from the NF. The example method may also include the operation of block 1040, where the AF may authenticate the UE for the application session based on the response.

[0086] In some embodiments, authorization of the UE for the application session (eg, at block 1040) may be based on one of the following: · Determining a match between the second identifier in the key request and the first identifier in the response. The response code indicates that the second identifier matches an identifier of the UE stored in the communications network. The key request includes a second identifier and there is no response code in the response.

[0087] In some embodiments, the example method may also include the operation of block 1010, where the AF may receive a request to establish an application session from the UE. In some of these embodiments, the second identifier may be included in the key request, and any of the following apply: The second identifier is received in the establishment request. The second identifier is stored locally in the AF.

[0088] In some of these embodiments, the second identifier may be a Universal Public Subscription Identifier (GPSI) of the UE, and the first identifier received in the response may be a GPSI stored in the communications network. In some of these embodiments, the establishment request and key request may include a security key (K) associated with the UE. AKMA ) identifier (A-KID).

[0089] In some embodiments, the key request may include an identifier for the AF (eg, an AF_ID).

[0090] In some embodiments, the AF may be part of the communication network. In such embodiments, the key request may be sent to an anchor function for authentication and key management for applications in the communication network (AAnF) and a response may be received from the AAnF. Figures 6 and 8 show examples of such embodiments. In other embodiments, the AF may be outside the communication network. In such embodiments, the key request may be sent to a network publishing function (NEF) in the communication network and a response may be received from the NEF. Figures 7 and 9 show examples of such embodiments.

[0091] In addition, Figure 11 illustrates an example method (e.g., procedure) for a Network Exposure Function (NEF) of a communications network, in accordance with various example embodiments of the present disclosure. The example method illustrated in Figure 11 may be performed by an NF, such as those described herein with reference to other figures.

[0092] The exemplary method may include the operation of block 1110, where the NEF receives from an application function (AF) outside the communication network a security key (K) associated with an application session between the AF and a user equipment (UE). AFThe NF may receive a key request for a security key (K). The key request may include a request for a first identifier of the UE (e.g., as shown in FIG. 7) or a second identifier of the UE (e.g., as shown in FIG. 9). The example method may also include the operation of block 1160, where the NF receives a security key (K). AF ) and the first identifier or one of the response codes associated with the second identifier or the first identifier to the AF.

[0093] In some embodiments, the exemplary method may also include the operations of block 1120, where the NEF may determine whether the first identifier of the UE is locally stored at the NEF. In such embodiments, the exemplary method may also include the operations of block 1130, where the NEF may determine, based on the determination that the first identifier of the UE is locally stored, whether the second identifier received from the AF matches the locally stored first identifier. In such cases, the response code sent to the AF (e.g., at block 1160) indicates whether the second identifier received from the AF matches the locally stored first identifier.

[0094] In some of these embodiments, the example method may also include the operation of block 1140, in which the NEF, based on a determination that the first identifier is not locally stored, transmits to an AAnF in the communication network (e.g., selected by the NEF) a security key (K AF ) can be sent as a key request. A request for a first identifier of the UE A first identifier retrieved from the Unified Data Management (UDM) of the communications network. The second identifier received from the AF In such an embodiment, the exemplary method may also include the operation of block 1150, in which the NEF generates a security key (K AF) and the first identifier (e.g., as shown in FIG. 7 ) or one of the response codes associated with the second identifier or the first identifier (e.g., as shown in FIG. 9 ). In some embodiments, the information received in block 1150 may be forwarded to the AF in block 1160.

[0095] In some of these embodiments, the response code may indicate that one of the following matches the UE's identifier stored in the AAnF: - First identifier, if the first identifier is included in the key request to the AAnF - Second identifier, if included in the key request to AAnF In these other embodiments, the response code may indicate that the first identifier is unavailable to the AF, for example due to lack of access privileges.

[0096] In some embodiments, the second identifier in the key request (e.g., at block 1110) may be a Universal Public Subscription Identifier (GPSI) of the UE, and the response sent to the AF (e.g., at block 1160) may include one of a GPSI stored in the communications network or a response code indicating that the second identifier matches a GPSI stored in the communications network.

[0097] In some embodiments, when the key request (e.g., at block 1110) includes a second identifier, the absence of a response code in the response (e.g., at block 1160) indicates that the second identifier matches an identifier of the UE stored in the communications network.

[0098] In some embodiments, the key request includes a security key (K AKMA ) identifier (A-KID).

[0099] In addition, Figure 12 illustrates an example method (e.g., procedure) for an anchor function (AAnF) for authentication and key management for applications in a communication network, according to various example embodiments of the present disclosure. The example method illustrated in Figure 12 may be performed by an AAnF, such as those described herein with reference to other figures.

[0100] The example method may include the operation of block 1210, where the AAnF acquires a security key (K) associated with an application session between an application function (AF) and a user equipment (UE). AF The AAnF may receive a key request for a security key (K). The key request may include a request for a first identifier of the UE (e.g., as shown in FIGS. 6-7) or a second identifier of the UE (e.g., as shown in FIGS. 8-9). The example method may also include the operations of block 1250, where the AAnF receives a security key (K AF ) and the first identifier, or one of the second identifier or a response code associated with the first identifier, to the AF. In some embodiments, the second identifier may be a Universal Public Subscription Identifier (GPSI) of the UE.

[0101] In some embodiments, the example method may also include the operation of block 1220, where the AAnF may determine whether the second identifier received in the key request matches an identifier of the UE stored in the communications network. In such a case, the response code sent to the AF (e.g., at block 1250) may indicate whether the second identifier received in the key request matches the first identifier stored in the communications network.

[0102] In some embodiments, when the key request (e.g., at block 1210) includes a second identifier, the absence of a response code in the response (e.g., at block 1250) indicates that the second identifier matches an identifier of the UE stored in the communications network.

[0103] In some embodiments, the exemplary method may also include the operation of block 1230, where the AAnF may determine, in response to the request for the first identifier in the key request, whether the first identifier is available to the AF. In such a case, the response code sent to the AF (e.g., at block 1250) may indicate whether the first identifier is available to the AF.

[0104] In some embodiments, the key request includes a security key (K AKMA In such an embodiment, the example method may also include the operation of block 1240, where the AAnF derives a security key (K) associated with the UE based on the identifier (A-KID). AKMA ) to obtain the security key (K AF ) can be derived.

[0105] In some embodiments, the key request (eg, at block 1210) may include an identifier of the AF (eg, AF_ID).

[0106] In some embodiments, the AF may be part of the communication network. In such embodiments, the key request may be received from the AF and sent to the AF. Figures 6 and 8 show examples of such embodiments. In other embodiments, the AF may be outside the communication network. In such embodiments, the key request may be received from a network publishing function (NEF) in the communication network and the response may be sent to the NEF. Figures 7 and 9 show examples of such embodiments.

[0107] Although the subject matter described herein may be implemented in any suitable type of system using any suitable components, the embodiments disclosed herein are described in connection with a wireless network, such as the exemplary wireless network shown in FIG. 13. For simplicity, the wireless network of FIG. 13 illustrates only the network 1306, the network nodes 1360 and 1360b, and the WDs 1310, 1310b, and 1310c. In practice, the wireless network may further include any additional elements suitable for supporting communication between wireless devices, or between a wireless device and another communication device, such as a landline telephone, a service provider, or any other network node or end device. Of the illustrated components, the network node 1360 and the wireless device (WD) 1310 are depicted in further detail. The wireless network may provide communication and other types of services to one or more wireless devices to facilitate the wireless devices accessing and / or using services provided by or via the wireless network.

[0108] A wireless network may include and / or interface with any type of communication, telecommunication, data, cellular, and / or radio network or other similar type of system. In some embodiments, a wireless network may be configured to operate according to a particular standard or other type of predefined rules or procedures. Thus, particular embodiments of a wireless network may implement a communications standard, such as Global System for Mobile Communications (GSM), Universal Mobile Telecommunications System (UMTS), Long Term Evolution (LTE), and / or other suitable 2G, 3G, 4G, or 5G standard, a wireless local area network (WLAN) standard, such as the IEEE 802.11 standard, and / or any other suitable wireless communication standard, such as Worldwide Interoperability for Microwave Access (WiMax), Bluetooth, Z-Wave, and / or ZigBee standards.

[0109] The network 1306 may include one or more backhaul networks, core networks, IP networks, public switched telephone networks (PSTN), packet data networks, optical networks, wide area networks (WANs), local area networks (LANs), wireless local area networks (WLANs), wired networks, wireless networks, metropolitan area networks, and other networks that enable communication between devices.

[0110] The network node 1360 and the WD 1310 comprise various components, which are described in more detail below. These components cooperate to provide the functionality of a network node and / or a wireless device, such as providing wireless connectivity in a wireless network. In different embodiments, a wireless network may include any number of wired or wireless networks, network nodes, base stations, controllers, wireless devices, relay stations, and / or any other components or systems capable of facilitating or participating in the communication of data and / or signals, whether via wired or wireless connections.

[0111] Examples of network nodes include, but are not limited to, access points (APs) (e.g., wireless access points), base stations (BSs) (e.g., radio base stations, Node Bs, evolved Node Bs (eNBs) and NR Node Bs (gNBs)). Base stations may be classified based on the amount of coverage they provide (or in other words, the transmit power level of the base station), in which case they may also be referred to as femto, pico, micro, or macro base stations. A base station may be a relay node, or a relay donor node that controls the relay. A network node may also include one or more (or all) parts of a distributed radio base station, such as a centralized digital unit and / or a remote radio unit (RRU), sometimes referred to as a remote radio head (RRH). Such remote radio units may or may not be integrated with an antenna as an antenna-integrated radio. Parts of a distributed radio base station may also be referred to as nodes in a distributed antenna system (DAS).

[0112] Further examples of network nodes include multi-standard radio (MSR) equipment such as MSR BS, network controllers such as radio network controllers (RNC) or base station controllers (BSC), base transceiver stations (BTS), transmission points, transmitting nodes, multi-cell / multicast coordination entities (MCE), core network nodes (e.g., MSC, MME), O&M nodes, OSS nodes, SON nodes, positioning nodes (e.g., E-SMLC), and / or MDTs. As another example, a network node may be a virtual network node as described in more detail below. However, more generally, a network node may represent any suitable device (or group of devices) configured, arranged, and / or operable to enable wireless devices to access a wireless network and / or provide wireless devices with access to a wireless network or provide some service to wireless devices accessing a wireless network.

[0113] In FIG. 13, the network node 1360 includes a processing circuit 1370, a device readable medium 1380, an interface 1390, ancillary equipment 1384, a power source 1386, a power circuit 1387, and an antenna 1362. Although the network node 1360 shown in the example wireless network of FIG. 13 may represent a device including the illustrated combination of hardware components, other embodiments may include network nodes having different combinations of components. It should be understood that a network node includes any suitable combination of hardware and / or software necessary to perform the tasks, features, functions, and methods and / or procedures disclosed herein. Additionally, while the components of the network node 1360 are shown as a single box located within a larger box or as a single box nested within multiple boxes, in reality the network node may comprise multiple different physical components that make up the single component shown (e.g., the device readable medium 1380 may comprise multiple separate hard drives and multiple RAM modules).

[0114] Similarly, the network node 1360 may be comprised of multiple physically separate components (e.g., a Node B component and an RNC component, or a BTS component and a BSC component, etc.), each of which may have its own respective components. In certain scenarios in which the network node 1360 comprises multiple separate components (e.g., a BTS component and a BSC component), one or more of the separate components may be shared among several network nodes. For example, a single RNC may control multiple Node Bs. In such scenarios, each unique Node B and RNC pair may possibly be considered as a single separate network node. In some embodiments, the network node 1360 may be configured to support multiple radio access technologies (RATs). In such embodiments, some components may be duplicated (e.g., separate device-readable media 1380 for different RATs) and some components may be reused (e.g., the same antenna 1362 may be shared by the RATs). Network node 1360 may also include multiple sets of the various illustrated components for different wireless technologies, such as, for example, GSM, WCDMA, LTE, NR, WiFi, or Bluetooth wireless technologies, integrated into network node 1360. These wireless technologies may be integrated in the same or different chips or sets of chips and other components within network node 1360.

[0115] The processing circuitry 1370 may be configured to perform any decision, calculation, or similar operation (e.g., a particular acquisition operation) described herein as being provided by a network node. These operations performed by the processing circuitry 1370 may include processing information acquired by the processing circuitry 1370, for example, by transforming the acquired information into other information, comparing the acquired or transformed information to information stored in the network node, and / or performing one or more operations based on the acquired or transformed information, and making a decision as a result of said processing.

[0116] The processing circuitry 1370 may comprise one or more combinations of a microprocessor, controller, microcontroller, central processing unit, digital signal processor, application specific integrated circuit, field programmable gate array, or any other suitable computing device, resources, or combinations of hardware, software, and / or coded logic operable to provide various functions of the network node 1360, alone or in conjunction with other network node 1360 components (e.g., device readable medium 1380). Such functionality may include any of the various wireless features, functions, or benefits described herein.

[0117] For example, the processing circuit 1370 may execute instructions stored on the device-readable medium 1380 or in a memory within the processing circuit 1370. In some embodiments, the processing circuit 1370 may include a system on a chip (SOC). As a more specific example, the instructions (also referred to as a computer program product) stored on the medium 1380 may include instructions that, when executed by the processing circuit 1370, can configure the network node 1360 to perform operations corresponding to various example methods (e.g., procedures) described herein.

[0118] In some embodiments, the processing circuitry 1370 may include one or more of a radio frequency (RF) transceiver circuitry 1372 and a baseband processing circuitry 1374. In some embodiments, the radio frequency (RF) transceiver circuitry 1372 and the baseband processing circuitry 1374 may be on separate chips (or sets of chips), boards, or units, such as a radio unit and a digital unit. In alternative embodiments, some or all of the RF transceiver circuitry 1372 and the baseband processing circuitry 1374 may be on the same chip or set of chips, board, or unit.

[0119] In particular embodiments, some or all of the functionality described herein as being provided by a network node, base station, eNB, or other such network device may be performed by the processing circuitry 1370 executing instructions stored in the device-readable medium 1380 or memory within the processing circuitry 1370. In alternative embodiments, some or all of the functionality may be provided by the processing circuitry 1370 without executing instructions stored in a separate or distinct device-readable medium, such as in a hardwired manner. In any of those embodiments, the processing circuitry 1370 may be configured to perform the described functionality, whether or not it executes instructions stored in a device-readable storage medium. Benefits provided by such functionality are not limited to the processing circuitry 1370 alone or to other components of the network node 1360, but are enjoyed by the network node 1360 as a whole, and / or by end users and wireless networks generally.

[0120] The device readable medium 1380 may comprise any form of volatile or non-volatile computer readable memory, including, but not limited to, persistent storage, solid state memory, remote mounted memory, magnetic media, optical media, random access memory (RAM), read only memory (ROM), mass storage media (e.g., hard disk), removable storage media (e.g., flash drive, compact disk (CD), or digital video disk (DVD)), and / or any other volatile or non-volatile non-transitory device readable and / or computer executable memory device that stores information, data, and / or instructions that may be used by the processing circuit 1370. The device readable medium 1380 may store any suitable instructions, data, or information, including applications including one or more of computer programs, software, logic, rules, codes, tables, etc., and / or other instructions that may be executed by the processing circuit 1370 and utilized by the network node 1360. The device readable medium 1380 may be used to store any calculations performed by the processing circuit 1370 and / or any data received via the interface 1390. In some embodiments, the processing circuit 1370 and the device readable medium 1380 may be considered to be integrated.

[0121] The interface 1390 is used in wired or wireless communication of signaling and / or data between the network node 1360, the network 1306, and / or the WD 1310. As shown, the interface 1390 comprises a port / terminal 1394 for transmitting and receiving data to and from the network 1306, for example, via a wired connection. The interface 1390 also includes a radio front-end circuit 1392, which may be coupled to the antenna 1362 or may be part of the antenna 1362 in certain embodiments. The radio front-end circuit 1392 comprises a filter 1398 and an amplifier 1396. The radio front-end circuit 1392 may be connected to the antenna 1362 and the processing circuit 1370. The radio front-end circuit may be configured to condition signals communicated between the antenna 1362 and the processing circuit 1370. The radio front-end circuit 1392 may receive digital data to be sent to other network nodes or WDs via a wireless connection. The radio front-end circuitry 1392 can convert the digital data into a radio signal having appropriate channel and bandwidth parameters using a combination of filters 1398 and / or amplifiers 1396. The radio signal can then be transmitted via the antenna 1362. Similarly, when receiving data, the antenna 1362 can collect the radio signal, which is then converted into digital data by the radio front-end circuitry 1392. The digital data can be passed to the processing circuitry 1370. In other embodiments, the interface can comprise different components and / or different combinations of components.

[0122] In certain alternative embodiments, the network node 1360 may not include a separate radio front-end circuit 1392, and instead the processing circuit 1370 may comprise a radio front-end circuit and be connected to the antenna 1362 without a separate radio front-end circuit 1392. Similarly, in some embodiments, all or a portion of the RF transceiver circuit 1372 may be considered part of the interface 1390. In still other embodiments, the interface 1390 may include one or more ports or terminals 1394, the radio front-end circuit 1392, and the RF transceiver circuit 1372 as part of a radio unit (not shown), and the interface 1390 may communicate with a baseband processing circuit 1374 that is part of a digital unit (not shown).

[0123] The antenna 1362 may include one or more antennas or antenna arrays configured to transmit and / or receive wireless signals. The antenna 1362 may be coupled to the radio front-end circuitry 1390 and may be any type of antenna capable of wirelessly transmitting and receiving data and / or signals. In some embodiments, the antenna 1362 may comprise one or more omni-directional, sector, or panel antennas operable to transmit / receive wireless signals, for example, between 2 GHz and 66 GHz. An omni-directional antenna may be used to transmit / receive wireless signals in any direction, a sector antenna may be used to transmit / receive wireless signals from devices in a particular area, and a panel antenna may be a line-of-sight antenna used to transmit / receive wireless signals in a relatively straight line. In some instances, the use of more than one antenna may be referred to as MIMO. In certain embodiments, the antenna 1362 may be separate from the network node 1360 and may be connectable to the network node 1360 through an interface or port.

[0124] The antenna 1362, the interface 1390, and / or the processing circuit 1370 may be configured to perform any receiving operation and / or a particular acquisition operation described herein as being performed by a network node. Any information, data, and / or signal may be received from a wireless device, another network node, and / or any other network equipment. Similarly, the antenna 1362, the interface 1390, and / or the processing circuit 1370 may be configured to perform any transmitting operation described herein as being performed by a network node. Any information, data, and / or signal may be transmitted to a wireless device, another network node, and / or any other network equipment.

[0125] The power circuit 1387 may comprise or be coupled to a power management circuit and may be configured to provide power to the components of the network node 1360 to perform the functions described herein. The power supply circuit 1387 may receive power from a power source 1386. The power source 1386 and / or the power supply circuit 1387 may be configured to provide power to the various components of the network node 1360 in a form suitable for each component (e.g., at voltage and current levels required for each respective component). The power source 1386 may be included in the power supply circuit 1387 and / or the network node 1360 or may be external thereto. For example, the network node 1360 may be connectable to an external power source (e.g., an electrical outlet) via an input circuit or interface such as an electrical cable, whereby the external power source provides power to the power circuit 1387. As a further example, the power supply 1386 may comprise a power source in the form of a battery or battery pack connected to or integrated with the power supply circuit 1387. The battery may provide backup power in the event that the external power source fails. Other types of power sources may also be used, such as photovoltaic devices.

[0126] Alternate embodiments of network node 1360 may include additional components other than those depicted in FIG. 13 that may be responsible for providing particular aspects of the network node's functionality, including any of the functionality described herein and / or any functionality necessary to support the subject matter described herein. For example, network node 1360 may include user interface devices to enable and / or facilitate input of information into network node 1360 and enable and / or facilitate output of information from network node 1360. This may enable and / or facilitate a user to perform diagnostics, maintenance, repair, and other management functions on network node 1360.

[0127] Additionally, the various network functions (NFs, e.g., UDM, AAnF, NEF, AF, etc.) described herein may be implemented and / or hosted using different variations of the network node 1360, including the variations described above.

[0128] In some embodiments, a wireless device (WD, e.g., WD1310) may be configured to transmit and / or receive information without direct human interaction. For example, a WD may be designed to transmit information to a network on a predefined schedule, triggered by an internal or external event, or in response to a request from the network. Examples of WDs include, but are not limited to, smartphones, mobile phones, cell phones, voice-over-IP (VoIP) phones, wireless local loop phones, desktop computers, personal digital assistants (PDAs), wireless cameras, gaming consoles or devices, music storage devices, playback appliances, wearable devices, wireless endpoints, mobile stations, tablets, laptop computers, laptop embedded equipment (LEE), laptop mounted equipment (LME), smart devices, wireless customer premises equipment (CPE), mobile telecommunications (MTC) devices, Internet of Things (IoT) devices, vehicle-mounted wireless terminal devices, and the like.

[0129] The WD may support device-to-device (D2D) communication, for example by implementing 3GPP standards for sidelink communication, vehicle-to-vehicle (V2V), vehicle-to-infrastructure (V2I), and vehicle-to-everything (V2X), in which case it may be referred to as a D2D communication device. As yet another specific example, in an Internet of Things (IoT) scenario, the WD may represent a machine or other device that performs monitoring and / or measurements and transmits results of such monitoring and / or measurements to another WD and / or a network node. In this case, the WD may be a machine-to-machine (M2M) device, which may be referred to as an MTC device in the 3GPP context. As one specific example, the WD may be a UE that implements the 3GPP Narrowband Internet of Things (NB-IoT) standard. Specific examples of such machines or devices are sensors, metering devices such as power meters, industrial machinery, or household or personal appliances (e.g., refrigerators, televisions, etc.), personal wearables (e.g., watches, fitness trackers, etc.). In other scenarios, the WD may represent a vehicle or other equipment that may monitor and / or report operational status or other functions associated with its operation. The above-mentioned WD may represent an endpoint of a wireless connection, in which case the device may be referred to as a wireless terminal. Furthermore, the above-mentioned WD may be portable, in which case the WD may be referred to as a mobile device or mobile terminal.

[0130] As shown, wireless device 1310 includes antenna 1311, interface 1314, processing circuitry 1320, device readable medium 1330, user interface equipment 1332, auxiliary equipment 1334, power source 1336, and power circuitry 1337. WD 1310 may include multiple sets of one or more of the illustrated components for different wireless technologies supported by WD 1310, such as GSM, WCDMA, LTE, NR, WiFi, WiMAX, or Bluetooth wireless technologies, to name a few. These wireless technologies may be integrated on the same or different chips or sets of chips as other components in WD 1310.

[0131] The antenna 1311 may include one or more antennas or antenna arrays configured to transmit and / or receive wireless signals and is connected to the interface 1314. In certain alternative embodiments, the antenna 1311 may be separate from the WD 1310 and may be connectable to the WD 1310 through an interface or port. The antenna 1311, the interface 1314, and / or the processing circuitry 1320 may be configured to perform any receiving or transmitting operation described herein as being performed by a WD. Any information, data, and / or signal may be received from a network node and / or another WD. In some embodiments, the wireless front-end circuitry and / or the antenna 1311 may be considered an interface.

[0132] As shown, the interface 1314 comprises a radio front-end circuit 1312 and an antenna 1311. The radio front-end circuit 1312 comprises one or more filters 1318 and an amplifier 1316. The radio front-end circuit 1314 may be connected to the antenna 1311 and the processing circuit 1320 and configured to condition signals communicated between the antenna 1311 and the processing circuit 1320. The radio front-end circuit 1312 may be coupled to or part of the antenna 1311. In some embodiments, the WD 1310 may not include a separate radio front-end circuit 1312, and instead the processing circuit 1320 may comprise a radio front-end circuit and be connected to the antenna 1311. Similarly, in some embodiments, some or all of the RF transceiver circuit 1322 may be considered part of the interface 1314. The radio front-end circuit 1312 may receive digital data to be sent to other network nodes or WDs via a wireless connection. The radio front-end circuitry 1312 can convert the digital data into a radio signal having appropriate channel and bandwidth parameters using a combination of filters 1318 and / or amplifiers 1316. The radio signal can then be transmitted via the antenna 1311. Similarly, when receiving data, the antenna 1311 can collect the radio signal, which is then converted into digital data by the radio front-end circuitry 1312. The digital data can be passed to the processing circuitry 1320. In other embodiments, the interface can comprise different components and / or different combinations of components.

[0133] The processing circuitry 1320 may comprise one or more combinations of a microprocessor, controller, microcontroller, central processing unit, digital signal processor, application specific integrated circuit, field programmable gate array, or any other suitable computing device, resources, or combination of hardware, software, and / or coded logic operable to provide the functionality of the WD 1310, alone or in conjunction with other WD 1310 components, such as the device readable medium 1330. Such functionality may include any of the various wireless features or benefits described herein.

[0134] For example, the processing circuit 1320 may execute instructions stored on the device-readable medium 1330 or in a memory within the processing circuit 1320 to provide the functionality disclosed herein. More specifically, the instructions (also referred to as a computer program product) stored on the medium 1330 may include instructions that, when executed by the processor 1320, can configure the wireless device 1310 to perform operations corresponding to various example methods (e.g., procedures) described herein.

[0135] As shown, the processing circuit 1320 includes one or more of an RF transceiver circuit 1322, a baseband processing circuit 1324, and an application processing circuit 1326. In other embodiments, the processing circuit may comprise different components and / or different combinations of components. In a particular embodiment, the processing circuit 1320 of the WD 1310 may comprise a SOC. In some embodiments, the RF transceiver circuit 1322, the baseband processing circuit 1324, and the application processing circuit 1326 may be on separate chips or sets of chips. In alternative embodiments, some or all of the baseband processing circuit 1324 and the application processing circuit 1326 may be combined in one chip or set of chips, and the RF transceiver circuit 1322 may be on a separate chip or set of chips. In further alternative embodiments, some or all of the RF transceiver circuit 1322 and the baseband processing circuit 1324 may be on the same chip or set of chips, and the application processing circuit 1326 may be on a separate chip or set of chips. In yet other alternative embodiments, some or all of the RF transceiver circuitry 1322, the baseband processing circuitry 1324, and the application processing circuitry 1326 may be combined within the same chip or set of chips. In some embodiments, the RF transceiver circuitry 1322 may be part of the interface 1314. The RF transceiver circuitry 1322 may condition RF signals for the processing circuitry 1320.

[0136] In certain embodiments, some or all of the functionality described herein as being performed by the WD may be provided by the processing circuitry 1320 executing instructions stored on a device-readable medium 1330, which in certain embodiments may be a computer-readable storage medium. In alternative embodiments, some or all of the functionality may be provided by the processing circuitry 1320 without executing instructions stored on a separate or distinct device-readable storage medium, such as in a hardwired manner. In any of these particular embodiments, the processing circuitry 1320 may be configured to perform the described functionality, whether or not it executes instructions stored on a device-readable storage medium. Benefits provided by such functionality are not limited to the processing circuitry 1320 alone or to other components of the WD 1310, but are enjoyed by the WD 1310 as a whole, and / or by end users and wireless networks generally.

[0137] The processing circuitry 1320 may be configured to perform any determining, calculating, or similar operation (e.g., a particular acquisition operation) described herein as being performed by a WD. These operations performed by the processing circuitry 1320 may include processing information acquired by the processing circuitry 1320, for example, by converting the acquired information to other information, comparing the acquired or converted information to information stored by the WD 1310, and / or performing one or more operations based on the acquired or converted information, and making a decision as a result of said processing.

[0138] The device-readable medium 1330 may be operable to store applications, including one or more of computer programs, software, logic, rules, codes, tables, etc., and / or other instructions executable by the processing circuit 1320. The device-readable medium 1330 may include computer memory (e.g., random access memory (RAM) or read-only memory (ROM)), mass storage media (e.g., hard disk), removable storage media (e.g., compact disc (CD) or digital video disc (DVD)), and / or any other volatile or non-volatile non-transitory device-readable and / or computer-executable memory device that stores information, data, and / or instructions that may be used by the processing circuit 1320. In some embodiments, the processing circuit 1320 and the device-readable medium 1330 may be considered to be integrated.

[0139] The user interface equipment 1332 may include components that enable and / or facilitate a human user to interact with the WD 1310. Such interaction can be in many forms, such as visual, auditory, tactile, etc. The user interface equipment 1332 may be operable to produce output to the user as well as to enable and / or facilitate the user to provide input to the WD 1310. The type of interaction may vary depending on the type of user interface equipment 1332 installed on the WD 1310. For example, if the WD 1310 is a smartphone, the interaction may be via a touch screen, and if the WD 1310 is a smart meter, the interaction may be through a screen that provides usage (e.g., number of gallons used) or a speaker that provides an audible alarm (e.g., if smoke is detected). The user interface equipment 1332 may include input interfaces, devices, and circuits as well as output interfaces, devices, and circuits. The user interface devices 1332 may be configured to enable and / or facilitate input of information into the WD 1310 and are connected to the processing circuit 1320 to enable and / or facilitate the processing circuit 1320 to process the input information. The user interface devices 1332 may include, for example, a microphone, a proximity or other sensor, keys / buttons, a touch display, one or more cameras, a USB port, or other input circuitry. The user interface devices 1332 are also configured to enable and / or facilitate output of information from the WD 1310 and to enable and / or facilitate the processing circuit 1320 to output information from the WD 1310. The user interface devices 1332 may include, for example, a speaker, a display, a vibration circuit, a USB port, a headphone interface, or other output circuitry.By using one or more input and output interfaces, devices, and circuits of the user interface equipment 1332, the WD 1310 can communicate with end users and / or wireless networks to enable and / or facilitate the end users and / or wireless networks to benefit from the functionality described herein.

[0140] The auxiliary device 1334 is operable to provide more specific functions that may not generally be performed by the WD. It may include dedicated sensors for taking measurements for various purposes, interfaces for additional types of communication such as wired communication, etc. The inclusion and type of components of the auxiliary device 1334 may vary depending on the embodiment and / or scenario.

[0141] In some embodiments, the power source 1336 may be in the form of a battery or battery pack. Other types of power sources, such as an external power source (e.g., an electrical outlet), a photovoltaic device, or a power cell, may also be used. The WD 1310 may further comprise a power circuit 1337 for delivering power from the power source 1336 to various parts of the WD 1310 that require power from the power source 1336 to perform any of the functions described or indicated herein. The power circuit 1337 may comprise a power management circuit in certain embodiments. The power circuit 1337 may additionally or alternatively be operable to receive power from an external power source, in which case the WD 1310 may be connectable to an external power source (such as an electrical outlet) via an input circuit or interface, such as a power cable. The power circuit 1337 may also be operable in certain embodiments to deliver power from the external power source to the power source 1336. This may be for charging the power source 1336, for example. The power circuitry 1337 may perform any conversion or other modification on the power from the power source 1336 to make it suitable for delivery to the respective components of the WD 1310.

[0142] FIG. 14 illustrates an embodiment of a UE according to various aspects described herein. User equipment or UE as used herein does not necessarily have a user in the sense of a human user who owns and / or operates an associated device. Instead, a UE may represent a device (e.g., a smart sprinkler controller) that is intended for sale to or operation by a human user, but may not be associated with or may not initially be associated with a particular human user. Alternatively, a UE may represent a device (e.g., a smart power meter) that is not intended for sale to or operation by an end user, but may be associated with or operated for the benefit of a user. The UE 1400 may be any UE identified by the 3rd Generation Partnership Project (3GPP), including an NB-IoT UE, a machine type communication (MTC) UE, and / or an enhanced MTC (eMTC) UE. The UE 1400 shown in FIG. 14 is an example of a WD configured for communication according to one or more communications standards promulgated by the 3rd Generation Partnership Project (3GPP), such as the 3GPP GSM, UMTS, LTE, and / or 5G standards. As previously mentioned, the terms WD and UE may be used interchangeably. Thus, although FIG. 14 is a UE, the components described herein are equally applicable to a WD and vice versa.

[0143] In FIG. 14, the UE 1400 includes a processing circuit 1401 operatively coupled to an input / output interface 1405, a radio frequency (RF) interface 1409, a network connection interface 1411, memory 1415 including random access memory (RAM) 1417, read only memory (ROM) 1419, storage medium 1421, etc., a communication subsystem 1431, a power source 1433, and / or any other components, or any combination thereof. The storage medium 1421 includes an operating system 1423, application programs 1425, and data 1427. In other embodiments, the storage medium 1421 may include other similar types of information. A particular UE may utilize all of the components shown in FIG. 14, or only a subset of the components. The level of integration between the components may vary from UE to UE. Additionally, a particular UE may include multiple instances of components such as multiple processors, memories, transceivers, transmitters, receivers, etc.

[0144] In FIG. 14, the processing circuit 1401 may be configured to process computer instructions and data. The processing circuit 1401 may be configured to implement any sequential state machine operable to execute machine instructions stored in memory as a machine-readable computer program, such as one or more hardware-implemented state machines (e.g., in discrete logic, FPGA, ASIC, etc.), programmable logic with appropriate firmware, one or more pre-programmed, general-purpose processors, such as a microprocessor or digital signal processor (DSP) with appropriate software, or any combination of the above. For example, the processing circuit 1401 may include two central processing units (CPUs). The data may be information in a form suitable for use by a computer.

[0145] In the illustrated embodiment, the input / output interface 1405 may be configured to provide a communication interface to an input device, an output device, or an input / output device. The UE 1400 may be configured to use an output device via the input / output interface 1405. The output device may use the same type of interface port as the input device. For example, a USB port may be used to provide input to and output from the UE 1400. The output device may be a speaker, a sound card, a video card, a display, a monitor, a printer, an actuator, an emitter, a smart card, another output device, or any combination thereof. The UE 1400 may be configured to enable and / or facilitate a user to capture information within the UE 1400 using an input device via the input / output interface 1405. The input device may include a touch-sensitive or presence-sensitive display, a camera (e.g., a digital camera, a digital video camera, a webcam, etc.), a microphone, a sensor, a mouse, a trackball, a directional pad, a trackpad, a scroll wheel, a smart card, etc. The presence-sensitive display may include a capacitive or resistive touch sensor for sensing input from a user. The sensor may be, for example, an accelerometer, a gyroscope, a tilt sensor, a force sensor, a magnetometer, an optical sensor, a proximity sensor, another like sensor, or any combination thereof. For example, the input device may be an accelerometer, a magnetometer, a digital camera, a microphone, and an optical sensor.

[0146] In FIG. 14, the RF interface 1409 may be configured to provide a communication interface to RF components such as a transmitter, a receiver, and an antenna. The network connection interface 1411 may be configured to provide a communication interface to a network 1443a. The network 1443a may encompass a wired and / or wireless network, such as a local area network (LAN), a wide area network (WAN), a computer network, a wireless network, a communication network, another similar network, or any combination thereof. For example, the network 1443a may include a Wi-Fi network. The network connection interface 1411 may be configured to include a receiver and a transmitter interface used to communicate with one or more other devices over a communication network according to one or more communication protocols, such as Ethernet, TCP / IP, SONET, ATM, etc. The network connection interface 1411 may implement receiver and transmitter functions suitable for a communication network link (e.g., optical link, electrical link, etc.). The transmitter and receiver functions may share circuit components, software or firmware, or may alternatively be implemented separately.

[0147] The RAM 1417 may be configured to interface to the processing circuit 1401 via the bus 1402 to provide storage or caching of data or computer instructions during execution of software programs, such as an operating system, application programs, and device drivers. The ROM 1419 may be configured to provide computer instructions or data to the processing circuit 1401. For example, the ROM 1419 may be configured to store unchanging low-level system code or data for basic system functions, such as basic input / output (I / O), booting, or receiving keystrokes from a keyboard, stored in non-volatile memory. The storage medium 1421 may be configured to include memory, such as RAM, ROM, programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), magnetic disk, optical disk, floppy disk, hard disk, removable cartridge, or flash drive.

[0148] In one example, the storage medium 1421 may be configured to include an operating system 1423, an application program 1425, such as a web browser application, a widget or gadget engine, or another application, and data files 1427. The storage medium 1421 may store any of a wide variety of operating systems or combinations of operating systems for use by the UE 1400. For example, the application program 1425 may include executable program instructions (also referred to as a computer program product) that, when executed by the processor 1401, may configure the UE 1400 to perform operations corresponding to various example methods (e.g., procedures) described herein.

[0149] The storage medium 1421 may be configured to include many physical drive units, such as a redundant array of independent disks (RAID), a floppy disk drive, a flash memory, a USB flash drive, an external hard disk drive, a thumb drive, a pen drive, a key drive, a high density digital versatile disk (HD-DVD) optical disk drive, an internal hard disk drive, a Blu-Ray optical disk drive, a holographic digital data storage (HDDS) optical disk drive, an external mini-Dual In-line Memory Module (DIMM), a synchronous dynamic random access memory (SDRAM), an external micro-DIMM SDRAM, a smart card memory such as a subscriber identity module or a removable user identity module (SIM / RUIM), other memory, or any combination thereof. The storage medium 1421 may enable and / or facilitate the UE 1400 to access, offload data, or upload data, computer executable instructions, application programs, and the like stored in a transient or non-transitory memory medium. An article of manufacture, such as an article of manufacture utilizing the communication system, may be tangibly embodied in a storage medium 1421, which may comprise a device-readable medium.

[0150] In FIG. 14, the processing circuit 1401 may be configured to communicate with the network 1443b using the communication subsystem 1431. The network 1443a and the network 1443b may be one or more of the same network or one or more different networks. The communication subsystem 1431 may be configured to include one or more transceivers used to communicate with the network 1443b. For example, the communication subsystem 1431 may be configured to include one or more transceivers used to communicate with one or more remote transceivers of another device capable of wireless communication, such as another WD, UE, or base station of a radio access network (RAN), according to one or more communication protocols, such as IEEE 802.14, CDMA, WCDMA, GSM, LTE, UTRAN, WiMax, etc. Each transceiver may include a transmitter 1433 and / or a receiver 1435 for respectively implementing a transmitter or receiver function appropriate for a RAN link (e.g., frequency allocation, etc.). Furthermore, the transmitter 1433 and receiver 1435 of each transceiver may share circuit components, software or firmware, or may alternatively be implemented separately.

[0151] In the illustrated embodiment, the communication functions of the communication subsystem 1431 may include data communication, voice communication, multimedia communication, short-range communication such as Bluetooth, short-range communication, location-based communication such as determining location using a global positioning system (GPS), another similar communication function, or any combination thereof. For example, the communication subsystem 1431 may include cellular communication, Wi-Fi communication, Bluetooth communication, and GPS communication. The network 1443b may encompass wired and / or wireless networks, such as a local area network (LAN), a wide area network (WAN), a computer network, a wireless network, a communication network, another similar network, or any combination thereof. For example, the network 1443b may be a cellular network, a Wi-Fi network, and / or a short-range network. The power source 1413 may be configured to provide alternating current (AC) or direct current (DC) power to the components of the UE 1400.

[0152] The features, benefits, and / or functions described herein may be implemented in one of the components of the UE 1400 or split across multiple components of the UE 1400. Furthermore, the features, benefits, and / or functions described herein may be implemented in any combination of hardware, software, or firmware. In one example, the communication subsystem 1431 may be configured to include any of the components described herein. Furthermore, the processing circuit 1401 may be configured to communicate with any of such components over the bus 1402. In another example, any of such components may be represented by program instructions stored in memory that, when executed by the processing circuit 1401, perform the corresponding functions described herein. In another example, the functions of any of such components may be split between the processing circuit 1401 and the communication subsystem 1431. In another example, non-computationally intensive functions of any of such components may be implemented in software or firmware, and computationally intensive functions may be implemented in hardware.

[0153] FIG. 15 is a schematic block diagram illustrating a virtualization environment 1500 in which functions implemented by some embodiments may be virtualized. In this context, virtualization means creating a virtual version of an apparatus or device, which may include a virtualized hardware platform, storage devices, and networking resources. Virtualization as used herein may apply to a node (e.g., a virtualized base station or a virtualized wireless access node) or device (e.g., a UE, a wireless device, or any other type of communication device) or a component thereof, and relates to an implementation in which at least a portion of the functionality is implemented as one or more virtual components (e.g., via one or more applications, components, functions, virtual machines, or containers running on one or more physical processing nodes in one or more networks).

[0154] In some embodiments, some or all of the functionality described herein may be implemented as virtual components executed by one or more virtual machines implemented in one or more virtual environments 1500 hosted by one or more of the hardware nodes 1530. Furthermore, in embodiments where the virtual node is not a wireless access node or does not require wireless connectivity (e.g., a core network node), the network node may be fully virtualized.

[0155] The functionality may be implemented by one or more applications 1520 (which may alternatively be referred to as software instances, virtual appliances, network functions, virtual nodes, virtual network functions, etc.) operable to implement some of the features, functions, and / or advantages of some embodiments disclosed herein. The applications 1520 are run in a virtualization environment 1500 providing hardware 1530 comprising a processing circuit 1560 and a memory 1590. The memory 1590 includes instructions 1595 executable by the processing circuit 1560 such that the applications 1520 are operable to provide one or more of the features, advantages, and / or functions disclosed herein.

[0156] The virtualization environment 1500 may include general-purpose or dedicated network hardware devices (or nodes) 1530 with a set of one or more processors or processing circuitry 1560, which may be commercial off-the-shelf (COTS) processors, dedicated application specific integrated circuits (ASICs), or any other type of processing circuitry including digital or analog hardware components or dedicated processors. Each hardware device may include a memory 1590-1, which may be a non-persistent memory for temporarily storing instructions 1595 or software executed by the processing circuitry 1560. For example, the instructions 1595 may include program instructions (also referred to as computer program products) that, when executed by the processing circuitry 1560, may configure the hardware node 1520 to perform operations corresponding to various example methods (e.g., procedures) described herein. Such operations may in turn be attributed to the virtual nodes 1520 hosted by the hardware node 1530.

[0157] Each hardware device may include one or more network interface controllers (NICs) 1570, also known as network interface cards, that include a physical network interface 1580. Each hardware device may also include a non-transitory persistent machine-readable storage medium 1590-2 having stored thereon software 1595 and / or instructions executable by the processing circuitry 1560. The software 1595 may include any type of software, including software for instantiating one or more virtualization layers 1550 (also referred to as hypervisors), software for running virtual machines 1540, and software that enables the implementation of the functions, features, and / or benefits described in connection with some embodiments described herein.

[0158] The virtual machines 1540 may comprise virtual processing, virtual memory, virtual networking or interfaces, and virtual storage, and may be run by a corresponding virtualization layer 1550 or hypervisor. Different embodiments of an instance of a virtual appliance 1520 may be implemented on one or more of the virtual machines 1540, and the implementations may be performed in different ways.

[0159] During operation, the processing circuitry 1560 executes software 1595 to instantiate a hypervisor or virtualization layer 1550, sometimes referred to as a virtual machine monitor (VMM), which can present to the virtual machines 1540 a virtual operating platform that looks like networking hardware.

[0160] As shown in Figure 15, the hardware 1530 may be a standalone network node having general purpose or specific components. The hardware 1530 may be equipped with an antenna 15225 and may implement some functions via virtualization. Alternatively, the hardware 1530 may be part of a larger hardware collection (e.g., in a data center or customer premises equipment (CPE) etc.) where many hardware nodes work together and are managed via a management and orchestration (MANO) 15100 that oversees, among other things, the lifecycle management of the applications 1520.

[0161] Hardware virtualization is referred to in some contexts as network function virtualization (NFV), which can be used to aggregate many network equipment types onto industry-standard high-volume server hardware, physical switches, and physical storage that can be located in data centers and customer premises equipment.

[0162] In the context of NFV, a virtual machine 1540 may be a software implementation of a physical machine running programs as if they were running on a physical, non-virtualized machine. Each virtual machine 1540 and the portion of the hardware 1530 on which it runs, whether the hardware is dedicated to that virtual machine and / or that virtual machine shares with other virtual machines 1540, forms a separate Virtual Network Element (VNE).

[0163] Further, in the context of NFV, a virtual network function (VNF) is responsible for handling a specific network function running on one or more virtual machines 1540 on top of the hardware networking infrastructure 1530 and corresponds to application 1520 in FIG. 15.

[0164] In some embodiments, one or more radio units 15200, each including one or more transmitters 15220 and one or more receivers 15210, may be coupled to one or more antennas 15225. The radio units 15200 may communicate directly with a hardware node 1530 via one or more suitable network interfaces, or may be used in combination with a virtualization component to provide a virtualization node with radio capabilities, such as a radio access node or base station. A node configured in this manner may also communicate with one or more UEs, as described elsewhere herein.

[0165] In some embodiments, some signaling may be performed via the control system 15230, which may alternatively be used for communication between the hardware node 1530 and the wireless unit 15200.

[0166] Additionally, the various network functions (NFs, e.g., UDM, AAnF, NEF, AF, etc.) described herein may be implemented and / or hosted using different variations of hardware 1530, including the variations described above.

[0167] Referring to FIG. 16, according to one embodiment, a communication system includes a communication network 1610, such as a 3GPP type cellular network, comprising an access network 1611, such as a wireless access network, and a core network 1614. The access network 1611 comprises a number of base stations 1612a, 1612b, 1612c, such as NBs, eNBs, gNBs, or other types of wireless access points, each defining a corresponding coverage area 1613a, 1613b, 1613c. Each base station 1612a, 1612b, 1612c can be connected to the core network 1614 over a wired or wireless connection 1615. A first UE 1691 located within the coverage area 1613c can be configured to wirelessly connect to the corresponding base station 1612c or be paged by the corresponding base station 1612c. A second UE 1692 within the coverage area 1613a can be wirelessly connected to the corresponding base station 1612a. Although multiple UEs 1691, 1692 are shown in this example, embodiments of the present disclosure are equally applicable to situations where only a single UE is within a coverage area or connected.

[0168] The communication network 1610 itself is connected to a host computer 1630, which may be embodied in hardware and / or software of a standalone server, a cloud-implemented server, a distributed server, or as a processing resource in a server farm. The host computer 1630 may be under the ownership or control of a service provider, or may be operated by or on behalf of the service provider. The connections 1621 and 1622 between the communication network 1610 and the host computer 1630 may extend directly from the core network 1614 to the host computer 1630, or may proceed via an optional intermediate network 1620. The intermediate network 1620 may be one of a public network, a private network, or a hosted network, or a combination of two or more of them, and the intermediate network 1620, if present, may be a backbone network or the Internet, and in particular the intermediate network 1620 may comprise two or more sub-networks (not shown).

[0169] The communication system of FIG. 16 as a whole enables connectivity between connected UEs 1691, 1692 and a host computer 1630. This connectivity may be described as an over-the-top (OTT) connection 1650. The host computer 1630 and connected UEs 1691, 1692 are configured to communicate data and / or signaling via the OTT connection 1650 using the access network 1611, the core network 1614, any intermediate networks 1620, and possible further infrastructure (not shown) as intermediaries. The OTT connection 1650 may be transparent in the sense that the involved communication devices through which the OTT connection 1650 passes are unaware of the routing of the uplink and downlink communications. For example, the base station 1612 may not be or need not be informed of the past routing of incoming downlink communications involving data originating from the host computer 1630 to be forwarded (e.g., handed over) to the connected UE 1691. Similarly, the base station 1612 does not need to be aware of the future routing of outgoing uplink communications originating from the UE 1691 and destined for the host computer 1630 .

[0170] An exemplary implementation of a UE, a base station, and a host computer according to an embodiment described in the previous paragraph will now be described with reference to FIG. 17. In the communication system 1700, the host computer 1710 comprises hardware 1715 including a communication interface 1716 configured to set up and maintain a wired or wireless connection with interfaces of different communication devices of the communication system 1700. The host computer 1710 further comprises a processing circuit 1718, which may have storage and / or processing capabilities. In particular, the processing circuit 1718 may comprise one or more programmable processors, application specific integrated circuits, field programmable gate arrays, or combinations thereof (not shown) adapted to execute instructions. The host computer 1710 further comprises software 1711, which is stored in or accessible by the host computer 1710 and executable by the processing circuit 1718. The software 1711 includes a host application 1712. The host application 1712 may be operable to provide services to a remote user, such as the UE 1730, that connects via an OTT connection 1750 that terminates at the UE 1730 and the host computer 1710. In providing services to the remote user, the host application 1712 may provide user data that is transmitted using the OTT connection 1750.

[0171] The communication system 1700 may also include a base station 1720 provided within the communication system, the base station 1720 comprising hardware 1725 that enables the base station 1720 to communicate with the host computer 1710 and the UE 1730. The hardware 1725 may include a communication interface 1726 for setting up and maintaining wired or wireless connections with interfaces of different communication devices of the communication system 1700, and a wireless interface 1727 for setting up and maintaining at least a wireless connection 1770 with a UE 1730 located within a coverage area (not shown in FIG. 17) served by the base station 1720. The communication interface 1726 may be configured to facilitate a connection 1760 to the host computer 1710. The connection 1760 may be direct or the connection 1760 may pass through a core network (not shown in FIG. 17) of the communication system and / or one or more intermediate networks external to the communication system. In the illustrated embodiment, the hardware 1725 of the base station 1720 may also include processing circuitry 1728, which may comprise one or more programmable processors, application specific integrated circuits, field programmable gate arrays, or combinations thereof (not shown), adapted to execute instructions.

[0172] Base station 1720 also includes software 1721 stored internally or accessible via an external connection. For example, software 1721 may include program instructions (also referred to as a computer program product) that, when executed by processing circuitry 1728, can configure base station 1720 to perform operations corresponding to various example methods (e.g., procedures) described herein.

[0173] The communications system 1700 may also include the previously mentioned UE 1730, whose hardware 1735 may include a wireless interface 1737 configured to set up and maintain a wireless connection 1770 with a base station serving a coverage area in which the UE 1730 is currently located. The hardware 1735 of the UE 1730 may also include processing circuitry 1738, which may comprise one or more programmable processors, application specific integrated circuits, field programmable gate arrays, or combinations thereof (not shown), adapted to execute instructions.

[0174] The UE 1730 also includes software 1731, which is stored in or accessible by the UE 1730 and executable by the processing circuitry 1738. The software 1731 includes a client application 1732. The client application 1732, with the support of the host computer 1710, may be operable to provide services to a human or non-human user via the UE 1730. At the host computer 1710, an executing host application 1712 may communicate with an executing client application 1732 via an OTT connection 1750 that terminates at the UE 1730 and the host computer 1710. In providing services to the user, the client application 1732 may receive request data from the host application 1712 and provide user data in response to the request data. The OTT connection 1750 may transfer both the request data and the user data. The client application 1732 may interact with the user to generate the user data that the client application 1732 provides. The software 1731 may also include program instructions (also referred to as a computer program product) that, when executed by the processing circuitry 1738, can configure the UE 1730 to perform operations corresponding to various example methods (e.g., procedures) described herein.

[0175] As an example, the host computer 1710, base station 1720, and UE 1730 shown in Figure 17 may be similar to or identical to the host computer 1630, one of the base stations 1612a-1612c, and one of the UEs 1691-1692, respectively, of Figure 16. That is, the internal workings of these entities may be as shown in Figure 17, and alternatively, the surrounding network topology may be as shown in Figure 16.

[0176] 17, the OTT connection 1750 is depicted abstractly to show communication between the host computer 1710 and the UE 1730 via the base station 1720, without explicit reference to intermediate devices and the exact routing of messages through these devices. The network infrastructure may determine the routing, and the network infrastructure may be configured to hide the routing from the UE 1730, or from the service provider operating the host computer 1710, or both. The network infrastructure may also decide to dynamically change the routing while the OTT connection 1750 is active (e.g., based on load balancing considerations or network reconfiguration).

[0177] The radio connection 1770 between the UE 1730 and the base station 1720 follows the teachings of the embodiments described throughout this disclosure. One or more of the various embodiments improve the performance of the OTT service provided to the UE 1730 using the OTT connection 1750 of which the radio connection 1770 forms the last segment. More precisely, the exemplary embodiments disclosed herein can improve the flexibility for the network to monitor the end-to-end quality of service (QoS) of data flows, including their respective corresponding radio bearers, associated with a data session between a user equipment (UE) and another entity, such as an OTT data application or service, external to the 5G network. These and other advantages can facilitate more timely design, implementation, and deployment of 5G / NR solutions. Moreover, such embodiments can facilitate flexible and timely control of data session QoS, which can lead to improvements in capacity, throughput, latency, and the like, envisioned by 5G / NR and critical to the growth of OTT services.

[0178] Measurement procedures may be provided for the purpose of monitoring data rates, latencies, and other aspects of network operation that one or more embodiments improve. There may further be optional network functionality for reconfiguring the OTT connection 1750 between the host computer 1710 and the UE 1730 in response to fluctuations in the measurement results. The measurement procedures and / or network functionality for reconfiguring the OTT connection 1750 may be implemented in the software 1711 and hardware 1715 of the host computer 1710, or in the software 1731 and hardware 1735 of the UE 1730, or both. In an embodiment, sensors (not shown) may be deployed in or associated with the communication devices through which the OTT connection 1750 passes, and the sensors may participate in the measurement procedures by providing values ​​of the monitored quantities exemplified above, or by providing values ​​of other physical quantities from which the software 1711, 1731 can calculate or estimate the monitored quantities. The reconfiguration of the OTT connection 1750 may include message formats, retransmission settings, preferred routing, etc., and the reconfiguration need not impact the base station 1720, and the reconfiguration may be unknown or unknowable to the base station 1720. Such procedures and functions are known and may be practiced in the art. In certain embodiments, the measurements may involve proprietary UE signaling that facilitates the host computer 1710 measurements of throughput, propagation time, latency, etc. The measurements may be implemented in that the OTT connection 1750 is used to send messages, specifically empty or "dummy" messages, while the software 1711 and 1731 monitor propagation times, errors, etc.

[0179] FIG. 18 is a flow diagram illustrating an example method and / or procedure implemented in a communication system, according to one embodiment. The communication system includes a host computer, a base station, and a UE, which may be as described with reference to other figures herein in some example embodiments. To simplify the disclosure, only drawing references to FIG. 18 are included in this section. In step 1810, the host computer provides user data. In sub-step 1811 (which may be optional) of step 1810, the host computer provides the user data by executing a host application. In step 1820, the host computer initiates a transmission carrying the user data to the UE. In step 1830 (which may be optional), the base station transmits the user data carried in the host computer initiated transmission to the UE, in accordance with the teachings of the embodiments described throughout this disclosure. In step 1840 (which may also be optional), the UE executes a client application associated with the host application executed by the host computer.

[0180] FIG. 19 is a flow diagram illustrating an example method and / or procedure implemented in a communication system, according to one embodiment. The communication system includes a host computer, a base station, and a UE, which may be as described with reference to other figures herein. To simplify the disclosure, only drawing references to FIG. 19 are included in this section. In step 1910 of the method, the host computer provides user data. In an optional sub-step (not shown), the host computer provides the user data by executing a host application. In step 1920, the host computer initiates a transmission carrying the user data to the UE. The transmission may be routed through a base station in accordance with the teachings of the embodiments described throughout this disclosure. In step 1930 (which may be optional), the UE receives the user data carried in the transmission.

[0181] FIG. 20 is a flow diagram illustrating an exemplary method and / or procedure implemented in a communication system according to one embodiment. The communication system includes a host computer, a base station, and a UE, which may be as described with reference to other figures herein. To simplify the disclosure, only drawing references to FIG. 20 are included in this section. In step 2010 (which may be optional), the UE receives input data provided by the host computer. Additionally or alternatively, in step 2020, the UE provides user data. In sub-step 2021 (which may be optional) of step 2020, the UE provides the user data by executing a client application. In sub-step 2011 (which may be optional) of step 2010, the UE executes a client application that provides user data in response to the received input data provided by the host computer. In providing the user data, the executed client application may further take into account user input received from the user. Regardless of the particular manner in which the user data is provided, the UE begins transmitting the user data to the host computer in sub-step 2030 (which may be optional). In method step 2040, the host computer receives user data transmitted from the UE, in accordance with the teachings of the embodiments described throughout this disclosure.

[0182] FIG. 21 is a flow diagram illustrating an example method and / or procedure implemented in a communication system according to one embodiment. The communication system includes a host computer, a base station, and a UE, which may be as described with reference to other figures herein. To simplify the disclosure, only drawing references to FIG. 21 are included in this section. In step 2110 (which may be optional), the base station receives user data from the UE, according to the teachings of the embodiments described throughout this disclosure. In step 2120 (which may be optional), the base station initiates transmission of the received user data to the host computer. In step 2130 (which may be optional), the host computer receives the user data carried in the transmission initiated by the base station.

[0183] As described herein, the devices and / or apparatus may be represented by semiconductor chips, chipsets, or (hardware) modules comprising such chips or chipsets, but this does not exclude the possibility that the functionality of the device or apparatus may not be implemented in hardware but as a software module, such as a computer program or computer program product including executable software code portions for execution or running on a processor. Furthermore, the functionality of the device or apparatus may be implemented by any combination of hardware and software. A device or apparatus may also be considered as an assembly of multiple devices and / or apparatus, regardless of whether they cooperate with each other functionally or are independent. Furthermore, the devices and apparatus may be implemented in a distributed manner throughout the system, as long as the functionality of the device or apparatus is preserved. Such principles and similar principles are believed to be known to those skilled in the art.

[0184] Additionally, functionality described herein as being performed by a wireless device or network node may be distributed across multiple wireless devices and / or network nodes. In other words, it is contemplated that the functionality of the network nodes and wireless devices described herein is not limited to being performed by a single physical device, but may in fact be distributed among several physical devices.

[0185] Unless otherwise specified, all terms used herein (including technical and scientific terms) have the same meaning as those commonly understood by those skilled in the art to which this disclosure belongs. It will be further understood that the terms used herein should be interpreted as having a meaning consistent with their meaning in the context of this specification and related art, and are not to be interpreted in an idealized or overly formal sense unless expressly so defined herein.

[0186] In addition, certain terms used in this disclosure, including the specification, drawings, and exemplary embodiments thereof, may be used synonymously in certain instances, including, but not limited to, data and information. It should be understood that these and / or other words that may be synonymous with each other may be used synonymously herein, and that there may be instances where such words are not intended to be used synonymously. Furthermore, to the extent that prior art knowledge has not been expressly incorporated herein by reference above, the prior art knowledge is expressly incorporated herein in its entirety. All publications referenced are incorporated herein by reference in their entirety.

[0187] The above merely illustrates the principles of the present disclosure. Various modifications and alternatives to the described embodiments will be apparent to those skilled in the art in view of the teachings herein. Thus, those skilled in the art will recognize that numerous systems, arrangements, and procedures can be devised that, although not explicitly shown or described herein, embody the principles of the present disclosure and thus may be within the spirit and scope of the present disclosure. As will be appreciated by those skilled in the art, the various exemplary embodiments can be used in combination with and interchangeably with one another.

Claims

1. 1. A method performed by an Application Function (AF) associated with a communications network, comprising: A network function (NF) of the communication network is provided with a security key (K) associated with an application session between the AF and a user equipment (UE). ＡＦ sending a key request for a first identifier of the UE, the first identifier being a Universal Public Subscription Identifier (GPSI) or a Subscription Persistent Identifier (SUPI); The security key (K ＡＦ receiving a response including the first identifier and the first based on the response, authorizing the UE for the application session; A method comprising:

2. The method of claim 1, further comprising receiving a request to establish the application session from the UE prior to sending the key request.

3. The establishment request and the key request include a security key (K ＡＫＭＡ 3. The method of claim 2, further comprising:

4. The method of claim 1 , wherein the key request includes an identifier of the AF.

5. the AF is part of the communication network; 5. The method according to claim 1, wherein the key request is sent to an Anchor Function for Authentication and Key Management for an application in the communication network (AAnF) and the response is received from the AAnF.

6. the AF is outside the communication network; The method according to claim 1 , wherein the key request is sent to a Network Published Function (NEF) in the communication network and the response is received from the NEF.

7. 1. A method performed by a Network Exposure Function (NEF) of a communications network, comprising: From an application function (AF) outside the communication network, a security key (K) associated with an application session between the AF and a user equipment (UE) is transmitted. ＡＦ receiving a key request for a first identifier of the UE, the first identifier being a Universal Public Subscription Identifier (GPSI) or a Subscription Persistent Identifier (SUPI); The AF is provided with a security key (K ＡＦ ) and the first identifier. A method comprising:

8. determining whether the first identifier of the UE is stored locally in the NEF; sending a request for the first identifier of the UE to an Anchor Function for Authentication and Key Management for Applications (AAnF) in the communications network based on a determination that the first identifier is not locally stored at the NEF; receiving the first identifier of the UE from the AAnF; The method of claim 7, wherein the first identifier included in the response to the AF is a first identifier of the UE received from the AAnF.

9. The key request includes a security key (K ＡＫＭＡ 9. The method according to claim 7 or 8, further comprising an identifier (A-KID) of the authentication information.

10. 1. A method performed by an Anchor Function for Authentication and Key Management (AAnF) for applications in a communication network, comprising: A security key (K) associated with an application session between an application function (AF) and a user equipment (UE). ＡＦ receiving a key request for a first identifier of the UE, the first identifier being a Universal Public Subscription Identifier (GPSI) or a Subscription Persistent Identifier (SUPI); The AF receives the security key (K ＡＦ ) and the first identifier. A method comprising:

11. The method further comprises: determining, in response to a request for the first identifier in the key request, whether the first identifier is available to the AF; sending a response code to the AF indicating whether the first identifier is available to the AF; The method of claim 10, comprising:

12. The key request includes a security key (K ＡＫＭＡ ) identifier (A-KID), The method further comprises: determining, based on the identifier (A-KID), the security key (K ＡＫＭＡ ) to the security key (K ＡＦ 12. The method of claim 10 or 11, further comprising deriving:

13. The method of claim 10 , wherein the key request includes an identifier of the AF.

14. said application function (AF) being outside said communications network; 14. The method of claim 10, wherein the key request is received from a Network Published Function (NEF) in the communication network and the response is sent to the NEF.

15. The method according to any one of claims 10 to 13, wherein the key request is received from the AF located in the communication network and the response is sent to the AF.

16. An Application Function (AF) associated with a communications network, comprising: an interface circuit configured to communicate with a user equipment (UE) and a network publishing function (NEF) and an anchor function for authentication and key management for applications (AAnF) in said communication network; a processing circuit operably coupled to the interface circuit; whereby said processing circuitry and said interface circuitry are configured to perform operations corresponding to any of the methods according to any one of claims 1 to 6.

17. An application function (AF) associated with a communications network, the application function being configured to perform operations corresponding to any of the methods according to claims 1 to 6.

18. A non-transitory computer-readable medium storing computer-executable instructions that, when executed by a processing circuit associated with an Application Function (AF) associated with a communications network, configures the AF to perform operations corresponding to any of the methods recited in claims 1 to 6.

19. 7. A computer program comprising computer executable instructions which, when executed by a processing circuit associated with an Application Function (AF) associated with a communications network, configures said AF to perform operations corresponding to any of the methods claimed in claims 1 to 6.

20. A Network Exposure Function (NEF) of a communication network, comprising: an interface circuit configured to communicate with an anchor function for authentication and key management (AAnF) for applications within said communication network and with an application function (AF) outside said communication network; a processing circuit operably coupled to the interface circuit; whereby said processing circuitry and said interface circuitry are configured to perform operations corresponding to any of the methods according to any one of claims 7 to 9.

21. A Network Publication Function (NEF) of a communications network, the Network Publication Function being configured to perform operations corresponding to any of the methods according to any one of claims 7 to 9.

22. A non-transitory computer-readable medium storing computer-executable instructions that, when executed by a processing circuit associated with a Network Exposure Function (NEF) of a communications network, configures the NEF to perform operations corresponding to any of the methods recited in any one of claims 7 to 9.

23. 10. A computer program comprising computer executable instructions which, when executed by a processing circuit associated with a Network Exposure Function (NEF) of a communications network, configures the NEF to perform operations corresponding to any of the methods according to any one of claims 7 to 9.

24. An anchor function for authentication and key management (AAnF) for applications in a communication network, comprising: an interface circuit configured to communicate with a user equipment (UE) and a network exposure function (NEF) and an application function (AF) in said communication network; a processing circuit operably coupled to the interface circuit; 16. An anchor function for authentication and key management for an application in a communications network, comprising:

25. An anchor function for authentication and key management for applications in a communication network (AAnF), configured to perform operations corresponding to any of the methods according to any one of claims 10 to 15.

26. A non-transitory computer-readable medium storing computer-executable instructions that, when executed by a processing circuit associated with an Anchor Function (AAnF) for authentication and key management for applications in a communications network, configure the AAnF to perform operations corresponding to any of the methods described in any one of claims 10 to 15.

27. 16. A computer program comprising computer executable instructions which, when executed by a processing circuit associated with an Anchor Function (AAnF) for authentication and key management for applications in a communications network, configures the AAnF to perform operations corresponding to any of the methods according to any one of claims 10 to 15.

Images