Extracting the AKMA routing indicator

Abstract

A method is provided for an authentication server function (AUSF) of a communication network, the method including: sending a second authentication request including a first identifier associated with a user equipment (UE) or a second identifier associated with the UE, receiving a response to the second authentication request, and when the response includes an authentication and key management for application (AKMA) indicator, determining a first security key identifier based on a first field included in the response.

Description

[Technical Field]

[0001] The present application relates generally to the field of wireless communication networks, and more particularly to improved techniques for secure communication between user equipment (UE) and application functions (AF) in communication networks. [Background technology]

[0002] The fifth generation of cellular systems ("5G"), also known as New Radio (NR), is currently being standardized within the Third Generation Partnership Project (3GPP). NR is being developed for maximum flexibility to accommodate several widely different use cases. In addition to the typical mobile broadband use cases, there are also Machine Type Communication (MTC), Ultra-low Latency Critical Communications (URLCC), sidelink Device-to-Device (D2D), and several other use cases.

[0003] The 3GPP Security Working Group SA3 specified security-related features for Release 15 (Rel-15) of 5G Systems (5GS) in 3GPP TS33.501 (v15.11.0). In particular, 5GS includes many new features that require the introduction of new security mechanisms (e.g., compared to previous 4G / LTE systems). For example, 5GS seamlessly integrates non-3GPP access (e.g., via WLAN) with 3GPP access (e.g., NR and / or LTE). Thus, 5GS allows user equipment (UE, e.g., wireless devices) to access services independently of the underlying radio access technology (RAT).

[0004] 3GPP Rel-16 introduces a new feature called authentication and key management for application (AKMA) for 3GPP user credential-based applications in 5G, including Internet of Things (IoT) use cases. More specifically, AKMA leverages the user's authentication and key agreement (AKA) credentials to bootstrap security between the UE and application functions (AFs), which allows the UE to securely exchange data with application servers. The AKMA architecture can be considered an evolution of the Generic Bootstrapping Architecture (GBA) specified for 5GC in Rel-15 and further specified in 3GPP TS 33.535 (v.16.2.0).

[0005] As further specified in 3GPP TS33.535 (v.16.2.0), networks and devices AKMA The key and associated A-KID, and K AF Derive the key. K AF is used to support the security of communications between the UE and the application function (AF), and A-KID is AF The root key (i.e., K AKMA ) AKMA Key Identifier (A-KID). More specifically, the A-KID includes the AKMA Temporary UE Identifier (A-TID) and routing information related to the UE's Home Network (HPLMN).

[0006] A Subscription Privacy Identifier (SUCI) is used in 5G networks to conceal and / or maintain the privacy of a user's Subscription Persistent Identifier (SUPI). The SUCI consists of various fields, including a Routing Indicator, which is allocated by the user's home network operator and provisioned in the USIM in the UE. The Routing Indicator, when combined with the Home Network Identifier contained in the SUCI, facilitates routing of signaling to a Network Function (NF) in the home network that can serve the user / subscriber.

[0007] The routing indicator is also required for the generation of the A-KID. However, there may be various scenarios where the NF that needs to generate the A-KID during UE authentication does not have the routing indicator for the UE, leading to undesired failure of the AKMA procedure.

[0008] HUAWEI et al.: "Clarification on A-KID generation," 3GPP DRAFT S3-210253, January 11, 2021, XP051968205, discloses that when SUPI is used in primary authentication, the AUSF cannot obtain the RID and, as a result, cannot generate the A-KID. Therefore, it is better to store the RID in the AUSF for UEs that support the AKMA service. Summary of the Invention

[0009] Accordingly, exemplary embodiments of the present disclosure address these and other problems, challenges, and / or difficulties associated with generating security keys for UEs in 5G (or, more generally, communications) networks, thereby facilitating the inherently advantageous deployment of security features such as AKMA.

[0010] According to a first aspect, there is provided a method performed by an Authentication Server Function (AUSF) of a communication network. The method may include sending a second authentication request including a first identifier associated with a user equipment (UE) or a second identifier associated with the UE, receiving a response to the second authentication request, and, when the response includes an authentication and key management (AKMA) indicator for an application, determining a first security key identifier based on a first field (RID) included in the response.

[0011] According to some embodiments, the method further includes deriving an anchor key for the UE and sending a message including the anchor key and the first security key identifier to an Anchor Function for Authentication and Key Management (AAnF) for the application. In some embodiments, the message may further include a second identifier.

[0012] In some embodiments, the second authentication request is sent to a unified data manager (UDM) of the communication network, and a response to the second authentication request is received from the UDM.

[0013] In some embodiments, the first field corresponds to a field of the first identifier.

[0014] In some embodiments, the method further includes sending a second authentication request to the UDM, the second authentication request including the first identifier or the second identifier, and receiving a response from the UDM in response to the second authentication request, the response including the first field, the response including the AKMA indicator and the first field.

[0015] In some embodiments, the first identifier is a subscription confidentiality identifier (SUCI).

[0016] In some embodiments, the second identifier is a subscription persistent identifier (SUPI).

[0017] In some embodiments, the first field is a routing indicator (RID) associated with the UE's home network.

[0018] In some embodiments, the first security key identifier is an Authentication and Key Management for Applications (AKMA) Key Identifier (A-KID).

[0019] According to a second aspect, there is provided a method performed by a Unified Data Management Function (UDM) of a communications network. The method may include receiving, from an Authentication Server Function (AUSF) of the communications network, an authentication request for a user equipment (UE), the authentication request including either a first identifier associated with the UE or a second identifier associated with the UE, obtaining a first field, and sending an Authentication and Key Management for Application (AKMA) indicator and the first field to the AUSF in response to the authentication request.

[0020] In some embodiments, the method further includes determining whether an AKMA indicator should be included in the response to the authentication request, and in response to determining that the AKMA indicator should be included, transmitting the AKMA indicator and the first field to the AUSF in the response to the authentication request.

[0021] In some embodiments, the method further includes, when the authentication request includes the first identifier, storing a first field included in the first identifier.

[0022] In some embodiments, obtaining the first field includes one of retrieving a stored version of the first field from UE subscription data or from a previously successful authentication of the UE, or performing a deciphering operation on a second identifier to generate a first identifier that includes the first field.

[0023] In some embodiments, the second identifier is a subscription persistent identifier (SUPI).

[0024] In some embodiments, the first identifier is a subscription confidentiality identifier (SUCI).

[0025] In some embodiments, the first field is a routing indicator (RID) associated with the UE's home network.

[0026] According to a third aspect, there is provided a method performed by an anchor function (AAnF) for authentication and key management for applications of a communications network. The method may include receiving, from an authentication server function (AUSF) of the communications network, an anchor key for a user equipment (UE) and a first security key identifier based on a first field of a first identifier associated with the UE, and storing the anchor key in association with the first security key identifier. The method may further include receiving, from an application function (AF) associated with the communications network, a request for security keys associated with an application session between the AF and the UE, the request including a third security key identifier associated with the UE, and deriving security keys associated with the application session based on the anchor key stored in association with the received third security key identifier based on a determination that the third security key identifier corresponds to the stored first security key identifier.

[0027] In some embodiments, the method further includes transmitting the derived security key to the AF.

[0028] In some embodiments, the second identifier is a subscription persistent identifier (SUPI).

[0029] In some embodiments, the first identifier is a subscription confidentiality identifier (SUCI).

[0030] In some embodiments, the first field is a routing indicator (RID) associated with the UE's home network.

[0031] In some embodiments, the first security key identifier is an Authentication and Key Management for Applications (AKMA) Key Identifier (A-KID).

[0032] According to a fourth aspect, there is provided an Authentication Server Function (AUSF) of a communications network, the AUSF comprising: an interface circuit configured to communicate with a user equipment (UE) and to communicate with an anchor function for authentication and key management for applications (AAnF) and a unified data management function (UDM) of the communications network; and a processing circuit operatively coupled to the interface circuit, whereby the processing circuit and the interface circuit are configured to perform operations corresponding to any of the methods of the first aspect.

[0033] An Authentication Server Function (AUSF) of a communications network is provided, the AUSF being configured to perform operations corresponding to any of the methods of the first aspect.

[0034] A non-transitory computer-readable medium is provided that stores computer-executable instructions that, when executed by processing circuitry associated with an Authentication Server Function (AUSF) of a communications network, configure the AUSF to perform operations corresponding to any of the methods of the first aspect.

[0035] A computer program is provided, the computer program comprising instructions that, when the program is executed by a computer, cause the computer to carry out any of the steps of the method of the first aspect.

[0036] A computer program product is provided that includes computer-executable instructions that, when executed by processing circuitry associated with an Authentication Server Function (AUSF) of a communications network, configure the AUSF to perform operations corresponding to any of the methods of the first aspect.

[0037] According to a fifth aspect, there is provided a Unified Data Management Function (UDM) for a communications network, the UDM comprising an interface circuit configured to communicate with an Authentication Server Function (AUSF) of the communications network, and a processing circuit operably coupled to the interface circuit, whereby the processing circuit and the interface circuit are configured to perform operations corresponding to any of the methods of the second aspect.

[0038] A Unified Data Manager (UDM) for a communications network is provided, the UDM configured to perform operations corresponding to any of the methods of the second aspect.

[0039] A non-transitory computer-readable medium is provided that stores computer-executable instructions that, when executed by processing circuitry associated with a unified data manager (UDM) of a communications network, configure the UDM to perform operations corresponding to any of the methods of the second aspect.

[0040] A computer program is provided, the computer program comprising instructions which, when the program is executed by a computer, cause the computer to carry out any of the steps of the method of the second aspect.

[0041] 10. A computer program product comprising computer-executable instructions that, when executed by processing circuitry associated with a Unified Data Manager (UDM) of a communications network, configure the UDM to perform operations corresponding to any of the methods of the second aspect.

[0042] According to a sixth aspect, there is provided an Anchor Function for Authentication and Key Management for Applications in a Communications Network (AAnF), comprising an interface circuit configured to communicate with a User Equipment (UE) and to communicate with an Authentication Server Function (AUSF) of the communications network, and a processing circuit operatively coupled to the interface circuit, whereby the processing circuit and the interface circuit are configured to perform operations corresponding to any of the methods of the third aspect.

[0043] An anchor function (AAnF) for authentication and key management for applications in a communications network is provided, the AAnF being configured to perform operations corresponding to any of the methods of the third aspect.

[0044] A non-transitory computer-readable medium is provided that stores computer-executable instructions that, when executed by processing circuitry associated with an anchor function (AAnF) for authentication and key management for applications in a communications network, configure the AAnF to perform operations corresponding to any of the methods of the third aspect.

[0045] A computer program is provided, the computer program comprising instructions which, when the program is executed by a computer, cause the computer to carry out any of the steps of the method of the third aspect.

[0046] There is provided a computer program product comprising computer-executable instructions that, when executed by processing circuitry associated with an anchor function (AAnF) for authentication and key management for applications in a communications network, configures the AAnF to perform operations corresponding to any of the methods of the third aspect.

[0047] Some embodiments include an exemplary method (e.g., procedure) for an Authentication Server Function (AUSF) of a communication network (e.g., 5GC).

[0048] The example methods may include receiving, from a user equipment (UE), an authentication request including either a first identifier associated with the UE or a second identifier associated with the UE. When the authentication request includes the second identifier, the example methods may also include one of determining a first security key identifier based on a first field of the first identifier obtained from a unified data management function (UDM) of the communication network or determining a second security key identifier not based on the first field of the first identifier, and sending the first field included in the first identifier to the UDM.

[0049] In some embodiments, when the authentication request includes a first identifier, these example methods may also include operations of blocks 1230-1240, where the AUSF may determine a first security key identifier based on a first field included in the first identifier and send the first field included in the first identifier to the UDM.

[0050] In some embodiments, the second identifier may be a 5G Globally Unique Temporary Identifier (5G-GUTI), the first identifier may be a Subscription Secrecy Identifier (SUCI), and the first field may be a Routing Indicator (RID) associated with the UE's home network. In such embodiments, the first security key identifier may be an Authentication and Key Management for Applications (AKMA) Key Identifier (A-KID), and the second security key identifier may be an AKMA Temporary UE Identifier (A-TID).

[0051] In some embodiments, determining the first security key identifier based on the first field obtained from the UDM can include determining a third identifier associated with the UE based on the second identifier, sending an authentication request to the UDM including the third identifier, and receiving the first field from the UDM in a response to the authentication request. In some of these embodiments, the authentication request can include an explicit request for the first field. In some of these embodiments, the third identifier can be a subscription persistent identifier (SUPI).

[0052] In some embodiments, these exemplary methods also include an anchor key (K AKMA ) and derive the anchor key (K AKMA and sending a message including the determined security key identifier to an authentication and key management for application (AAnF) of the communication network. In some embodiments, the message may also include an indication of whether the included security key identifier is a first security key identifier or a second security key identifier (e.g., a key identifier type indicator).

[0053] In some embodiments, determining the second security key identifier may be further based on determining that a first field of a first identifier associated with the UE is unavailable to the AUSF.

[0054] Other embodiments include exemplary methods (e.g., procedures) for unified data management (UDM) of a communications network (e.g., 5GC).

[0055] The example methods may include receiving, from an AUSF of a communication network, an authentication request for the UE, the authentication request including either a first identifier associated with the UE or a second identifier associated with the UE. When the authentication request includes the second identifier, the example methods may also include obtaining a first field of the first identifier and sending the first field to the AUSF in a response to the authentication request. When the authentication request includes the first identifier, the example methods may also include storing the first field included in the first identifier.

[0056] In some embodiments, obtaining the first field may include one of retrieving a stored version of the first field from UE subscription data or from a previously successful authentication of the UE, or performing a deciphering operation on the second identifier to generate the first identifier including the first field.

[0057] In some embodiments, sending the first field to the AUSF may be in response to one of an explicit request for the first field to be included in the authentication request or inclusion of an AKMA indicator in a response to the authentication request.

[0058] In some embodiments, the second identifier may be a 5G Global Unique Temporary Identifier (5G-GUTI), the first identifier may be a Subscription Confidentiality Identifier (SUCI), and the first field may be a Routing Indicator (RID) associated with the UE's home network.

[0059] Other embodiments include exemplary methods (e.g., procedures) for an anchor function (AAnF) for authentication and key management for communications network (e.g., 5GC) applications.

[0060] These exemplary methods involve receiving an anchor key (K) for a user equipment (UE) from an authentication server function (AUSF) of a communications network.AKMA ) along with one of the following security key identifiers: a first security key identifier based on a first field of a first identifier associated with the UE; or A second security key identifier that is not based on the first field

[0061] These exemplary methods involve the use of an anchor key (K AKMA These example methods may also include storing a security key (K) associated with the received security key identifier from an Application Function (AF) associated with the communication network, the security key (K) associated with the application session between the AF and the UE. AF ), the request may include a third security key identifier associated with the UE. These example methods may also include determining, based on a determination that the third security key identifier corresponds to a stored security key identifier, a stored anchor key (K ) associated with the received security key identifier. AKMA ) based on the security key (K AF ) In some embodiments, these exemplary methods may also include deriving a derived security key (K AF ) to the AF.

[0062] In some embodiments, the second identifier may be a Subscription Persistent Identifier (SUPI), the first identifier may be a Subscription Confidentiality Identifier (SUCI), and the first field may be a Routing Indicator (RID) associated with the UE's home network. In such embodiments, the first security key identifier may be an Authentication and Key Management for Applications (AKMA) Key Identifier (A-KID), and the second security key identifier may be an AKMA Temporary UE Identifier (A-TID).

[0063] In some embodiments, the anchor key (KAKMA ) is stored in association with the second security key identifier, determining that the third security key identifier corresponds to the stored security key identifier may include determining a fourth security key identifier from the received third security key identifier and determining a match between the fourth security key identifier and the second security key identifier. In some embodiments, the third security key identifier may be an Authentication and Key Management for Application (AKMA) Key Identifier (A-KID), and the fourth security key identifier may be an AKMA Temporary UE Identifier (A-TID).

[0064] Other embodiments include AUSFs, UDMs, and AAnFs (or network nodes hosting them) configured to perform operations corresponding to any of the example methods described herein. Other embodiments include a non-transitory computer-readable medium storing computer-executable instructions that, when executed by a processing circuit, configure such AUSFs, UDMs, and AAnFs to perform operations corresponding to any of the example methods described herein.

[0065] These and other objects, features and advantages of the present disclosure will become apparent from a reading of the following detailed description in light of the drawings, which are briefly described below. [Brief explanation of the drawings]

[0066] [Figure 1] FIG. 1 illustrates aspects of an exemplary 5G network architecture. [Figure 2] FIG. 1 illustrates aspects of an exemplary 5G network architecture. [Figure 3] FIG. 1 illustrates an exemplary hierarchy of security keys in a 5G network. [Figure 4] FIG. 1 illustrates various fields of a Subscription Privacy Identifier (SUCI) used in 5G networks. [Figure 5]FIG. 2 is a signal flow diagram of an exemplary security key generation procedure. [Figure 6] FIG. 2 is a signal flow diagram of an exemplary security key generation procedure. [Figure 7] FIG. 1 is a signal flow diagram of an example procedure for initiating user equipment (UE) authentication and selecting an authentication method. [Figure 8] FIG. 4 is a signal flow diagram of an exemplary security key generation procedure, according to various embodiments of the present disclosure. [Figure 9] FIG. 4 is a signal flow diagram of an exemplary security key generation procedure, according to various embodiments of the present disclosure. [Figure 10] FIG. 4 is a signal flow diagram of an exemplary security key generation procedure, according to various embodiments of the present disclosure. [Figure 11] FIG. 4 is a signal flow diagram of an exemplary security key generation procedure, according to various embodiments of the present disclosure. [Figure 12A] 1 illustrates an example method (e.g., procedure) for an Authentication Server Function (AUSF) in a communication network, according to various example embodiments of the present disclosure. [Figure 12B] 1 illustrates an example method (e.g., procedure) for an Authentication Server Function (AUSF) in a communication network, according to various example embodiments of the present disclosure. [Figure 13A] 1 illustrates an example method (e.g., procedure) for unified data management (UDM) of a communication network, according to various exemplary embodiments of the present disclosure. [Figure 13B] 1 illustrates an example method (e.g., procedure) for unified data management (UDM) of a communication network, according to various exemplary embodiments of the present disclosure. [Figure 14] FIG. 1 illustrates an example method (e.g., procedure) for an Anchor Function for Authentication and Key Management (AAnF) for applications in a communication network, according to various example embodiments of the present disclosure. [Figure 15] FIG. 1 illustrates a wireless network in accordance with various exemplary embodiments of the present disclosure. [Figure 16]FIG. 1 illustrates an example embodiment of a UE in accordance with various aspects described herein. [Figure 17] FIG. 1 is a block diagram illustrating an example virtualization environment that can be used to implement various embodiments of a network node or NF described herein. [Figure 18] 1A-1D are block diagrams of various exemplary communication systems and / or networks, in accordance with various exemplary embodiments of the present disclosure. [Figure 19] 1A-1D are block diagrams of various exemplary communication systems and / or networks, in accordance with various exemplary embodiments of the present disclosure. [Figure 20] 1 is a flowchart of an example method (eg, procedure) for transmitting and / or receiving user data, according to various example embodiments of the present disclosure. [Figure 21] 1 is a flowchart of an example method (eg, procedure) for transmitting and / or receiving user data, according to various example embodiments of the present disclosure. [Figure 22] 1 is a flowchart of an example method (eg, procedure) for transmitting and / or receiving user data, according to various example embodiments of the present disclosure. [Figure 23] 1 is a flowchart of an example method (eg, procedure) for transmitting and / or receiving user data, according to various example embodiments of the present disclosure. DETAILED DESCRIPTION OF THE INVENTION

[0067] The exemplary embodiments briefly summarized above will now be described more fully with reference to the accompanying drawings. These descriptions are provided as examples to explain the subject matter to those skilled in the art and should not be construed as limiting the scope of the subject matter to only the embodiments described herein. More particularly, examples illustrating the operation of various embodiments in accordance with the advantages described above are provided below.

[0068] In general, all terms used herein should be interpreted according to their ordinary meaning in the relevant technical field unless a different meaning is clearly given and / or suggested by the context of use. All references to elements, devices, components, means, steps, etc. should be openly interpreted as referring to at least one instance of the element, device, component, means, step, etc., unless expressly stated otherwise. The steps of any method and / or procedure disclosed herein need not be performed in the exact order disclosed, unless explicitly stated as one step following or preceding another and / or implicitly stated as one step necessarily following or preceding another. Any feature of any of the embodiments disclosed herein may be applied to any other embodiment, as appropriate. Similarly, any advantage of any of the embodiments may be applied to any other embodiment, and vice versa. Other objects, features, and advantages of the disclosed embodiments will become apparent from the following description.

[0069] Furthermore, the following terms are used throughout the description provided below: Radio Access Node: As used herein, a “radio access node” (or equivalently, a “radio network node,” “radio access network node,” or “RAN node”) may be any node in a Radio Access Network (RAN) of a cellular communications network that operates to transmit and / or receive signals wirelessly. Some examples of radio access nodes include, but are not limited to, base stations (e.g., a New Radio (NR) base station (gNB) in a 3GPP fifth-generation (5G) NR network or an enhanced or evolved Node B (eNB) in a 3GPP LTE network), base station distribution elements (e.g., CU and DU), high-power or macro base stations, low-power base stations (e.g., a micro base station, pico base station, femto base station, or home base station), integrated access backhaul (IAB) nodes (or elements of an IAB node such as a MT or DU), transmission points, remote radio units (RRUs or RRHs), and relay nodes. Core network node: As used herein, a "core network node" is any type of node in a core network. Some examples of core network nodes include, for example, a mobility management entity (MME), a serving gateway (SGW), a packet data network gateway (P-GW), etc. A core network node may also be a node that implements a specific core network function (NF), such as an access and mobility management function (AMF), a session management function (AMF), a user plane function (UPF), or a service capability publication function (SCEF). Wireless Device: As used herein, a "wireless device" (or "WD" for short) is any type of device that can access (i.e., be served by) a cellular communications network by wirelessly communicating with network nodes and / or other wireless devices. Wireless communication may involve transmitting and / or receiving radio signals using electromagnetic waves, radio waves, infrared waves, and / or other types of signals suitable for conveying information over the air. Unless otherwise noted, the term "wireless device" is used interchangeably herein with "user equipment" (or "UE" for short). Some examples of wireless devices include, but are not limited to, smartphones, mobile phones, cell phones, Voice over IP (VoIP) phones, wireless local loop phones, desktop computers, personal digital assistants (PDAs), wireless cameras, gaming consoles or devices, music storage devices, playback appliances, wearable devices, wireless endpoints, mobile stations, tablets, laptop computers, laptop embedded equipment (LEE), laptop mounted equipment (LME), smart devices, wireless customer premises equipment (CPE), mobile telecommunications (MTC) devices, Internet of Things (IoT) devices, automotive wireless terminal devices, mobile terminals (MT), and the like. Wireless node: As used herein, a "wireless node" may be either a "wireless access node" (or equivalent term) or a "wireless device." Network Node: As used herein, a "network node" is any node that is part of either the radio access network (e.g., radio access node or equivalent term) or core network (e.g., the core network node described above) of a cellular communications network. Functionally, a network node is equipment that is configured, arranged, and / or operable to communicate directly or indirectly with wireless devices and / or other network nodes or equipment in the cellular communications network, to enable and / or provide wireless access to wireless devices, and / or to perform other functions (e.g., management) in the cellular communications network. Node: As used herein, the term “node” (without a prefix) may be any type of node capable of operating within or with a wireless network (including a RAN and / or core network), including a radio access node (or equivalent term), a core network node, or a wireless device. Service: As used herein, the term "service" generally refers to a set of data associated with one or more applications and transmitted over a network along with specific delivery requirements that must be met for the applications to be successful. Component: As used herein, the term "component" generally refers to any component required for the delivery of a service. Examples of components are the RAN (e.g., E-UTRAN, NG-RAN, or parts thereof such as eNB, gNB, base station (BS)), the CN (e.g., EPC, 5GC, or parts thereof, including all types of links between the RAN and CN entities), and a cloud infrastructure with associated resources such as computation, storage, etc. Generally, each component can have a "manager," which is an entity that can collect historical information about resource usage and provide information about the current and predicted future availability of resources associated with that component (e.g., the RAN manager).

[0070] It should be noted that the description provided herein focuses on 3GPP cellular communication systems, and therefore, 3GPP terminology or terminology similar to 3GPP terminology is generally used. However, the concepts disclosed herein are not limited to 3GPP systems. Other wireless systems, including, but not limited to, Wideband Code Division Multiple Access (WCDMA), Worldwide Interoperability for Microwave Access (WiMax), Ultra Mobile Broadband (UMB), and Global System for Mobile Communications (GSM), may also benefit from the concepts, principles, and / or embodiments described in this disclosure.

[0071] Furthermore, functions and / or operations described herein as being performed by a wireless device or network node may be distributed over multiple wireless devices and / or network nodes. Furthermore, although the term "cell" is used herein, it should be understood that a beam may be used instead of a cell (particularly for 5G NR), and thus the concepts described herein apply equally to both cells and beams.

[0072] Broadly speaking, a 5G system (5GS) consists of an access network (AN) and a core network (CN). The AN provides connectivity to UEs to the CN via base stations, e.g., gNBs or ng-eNBs, as described below. The CN contains various network functions (NFs) that provide a wide range of different functions, such as session management, connection management, charging, and authentication.

[0073] The communication link between the UE and the 5G network (AN and CN) can be grouped into two different hierarchies: the UE communicates with the CN over the Non-Access Stratum (NAS) and with the AN over the Access Stratum (AS). All NAS communication takes place between the UE and the AMF via the NAS protocol. Security for communication on these hierarchies is provided by the NAS protocol (for the NAS) and PDCP (for the AS).

[0074] FIG. 1 shows a high-level diagram of an exemplary 5G network architecture consisting of a Next Generation RAN (NG-RAN) 199 and a 5G Core (5GC) 198. The NG-RAN 199 may include one or more gNodeBs (gNBs) connected to the 5GC via one or more NG interfaces, such as gNBs 100, 150 connected via interfaces 102, 152, respectively. More specifically, the gNBs 100, 150 may be connected to one or more Access and Mobility Management Functions (AMFs) in the 5GC 198 via their respective NG-C interfaces. Similarly, the gNBs 100, 150 may be connected to one or more User Plane Functions (UPFs) in the 5GC 198 via their respective NG-U interfaces. As described in more detail below, the 5GC 198 may include various other Network Functions (NFs).

[0075] Additionally, gNBs may be interconnected via one or more Xn interfaces, such as Xn interface 140 between gNB 100 and gNB 150. The radio technology for NG-RAN is often referred to as “New Radio” (NR). With respect to the NR interface to the UE, each gNB may support frequency division duplexing (FDD), time division duplexing (TDD), or a combination thereof. Each gNB may serve a geographic coverage area including one or more cells, and in some cases may provide coverage to each cell using various directional beams.

[0076] The NG-RAN 199 is layered into a Radio Network Layer (RNL) and a Transport Network Layer (TNL). The NG-RAN architecture, i.e., the NG-RAN logical nodes and the interfaces between the NG-RAN logical nodes, are specified as part of the RNL. For each NG-RAN interface (NG, Xn, F1), the associated TNL protocols and functions are specified. The TNL provides user plane transport and signaling transport services. In some example configurations, each gNB is connected to all 5GC nodes within the "AMF domain" specified in 3GPP TS 23.501 (v15.5.0). If security protection for CP data and UP data on the TNL of the NG-RAN interface is supported, NDS / IP (3GPP TS 33.401 (v15.8.0)) shall apply.

[0077] The NG RAN logical node shown in FIG. 1 (and described in 3GPP TS38.401 (v15.6.0) and 3GPP TR38.801 (v14.0.0)) includes a central unit (CU or gNB-CU) and one or more distributed units (DU or gNB-DU). For example, gNB 100 includes gNB-CU 110 and gNB-DUs 120 and 130. The CU (e.g., gNB-CU 110) is a logical node that hosts upper layer protocols and performs various gNB functions, such as controlling the operation of the DU. The DUs (e.g., gNB-DUs 120, 130) are distributed logical nodes that host lower layer protocols and can include various subsets of gNB functionality depending on the functional separation option. Thus, the CU and DU each include various circuits necessary to perform their respective functions, including processing circuitry, transceiver circuitry (e.g., for communication), and power supply circuitry.

[0078] A gNB-CU connects to one or more gNB-DUs over respective F1 logical interfaces, such as interfaces 122 and 132 shown in Figure 1. However, a gNB-DU can only be connected to a single gNB-CU. The gNB-CU and connected gNB-DU only appear as a gNB to other gNBs and 5GC. In other words, the F1 interface is invisible outside the range of the gNB-CU.

[0079] Another change in 5GS (e.g., 5GC) is that the traditional peer-to-peer interfaces and protocols found in previous generation networks are modified and / or replaced by a service-based architecture (SBA) in which network functions (NFs) offer one or more services to one or more service consumers. This may be done, for example, through a Hypertext Transfer Protocol / Representational State Transfer (HTTP / REST) ​​application programming interface (API). Generally, various services are self-contained functions that can be changed and modified in an independent manner without affecting other services. This SBA model may also employ principles such as modularity, reusability, and self-containment of NFs to enable deployments that leverage the latest virtualization and software technologies.

[0080] Services in 5GC can be stateless, where business logic and data context are separated. For example, a service can store its service context externally in its own database. This can facilitate various cloud infrastructure features such as auto-scaling or auto-healing. Furthermore, 5GC services can be composed of various "service operations", which are finer divisions of the overall functionality of the service. Interactions between service consumers and producers can be of the "request / response" or "subscribe / notify" type.

[0081] Figure 2 shows an example non-roaming 5G reference architecture with service-based interfaces within the control plane (CP) and various 3GPP-defined NFs, including the following NFs, with further details provided for those most relevant to this disclosure: The Application Function (AF, with its Naf interface) interacts with the 5GC to provision information to the network operator and to subscribe to certain events occurring within the operator's network. The AF provides applications where services are provided at a layer (i.e., the transport layer) different from the layer where the service is requested (i.e., the signaling layer), and the control of flow resources is subject to what has been negotiated with the network. The AF communicates dynamic session information to the PCF (via the N5 interface), including a description of the media delivered by the transport layer. The Policy Control Function (PCF, with Npcf interface) supports a unified policy framework for governing network behavior by providing PCC rules (e.g., regarding the treatment of each service data flow under PCC control) to the SMF via the N7 reference point. The PCF provides policy control decisions and flow-based charging control to the SMF, including service data flow discovery, gating, QoS, and flow-based charging (excluding credit control). The PCF receives session and media-related information from the AF and notifies the AF of traffic (or user) plane events. User Plane Function (UPF) - Supports handling of user plane traffic based on rules received from the SMF, including packet inspection and various enforcement actions (e.g., event detection and reporting). The UPF communicates with the RAN (e.g., NG-RNA) via the N3 reference point, with the SMF (described below) via the N4 reference point, and with the external packet data network (PDN) via the N6 reference point. The N9 reference point is for communication between two UPFs. The Session Management Function (SMF, with Nsmf interface) interacts with the separated traffic (or user) plane, including creating, updating, and deleting Protocol Data Unit (PDU) sessions, and managing session context with the User Plane Function (UPF), e.g., for event reporting. For example, the SMF performs data flow detection (based on filter specifications contained in PCC rules), online and offline charging interactions, and policy enforcement. The Charging Function (CHF, with Nchf interface) is responsible for the aggregated online and offline charging functions. It provides quota management (for online charging), reauthorization triggers, evaluation conditions, etc. and is informed of usage reports by the SMF. Quota management involves granting a specific number of units (e.g., bytes, seconds) to a service. The CHF also interacts with the billing system. The Access and Mobility Management Function (AMF, with Namf interface) terminates the RAN CP interface and handles all mobility and connection management for the UE (similar to the MME in the EPC). The AMF communicates with the UE via the N1 reference point and with the RAN (e.g., NG-RAN) via the N2 reference point. The AMF may be co-located with a Security Anchor Function (SEAF, not shown) that holds the root (or anchor) keys of the visited network. Network Exposure Function (NEF) with Nnef interface - acts as an entry point into the operator's network by securely exposing network capabilities and events provided by 3GPP NFs to the AF and providing a way for the AF to securely provide information to the 3GPP network. For example, the NEF provides services that allow the AF to provision specific subscription data (e.g., expected UE behavior) for various UEs. · Network Repository Function (NRF) with Nnrf interface - provides service registration and discovery and allows NFs to identify suitable services available from other NFs. Network Slice Selection Function (NSSF) with Nnssf Interface - A "network slice" is a logical partition of a 5G network that provides specific network capabilities and characteristics, for example, in support of a specific service. A network slice instance is a set of NF instances and the required network resources (e.g., computation, storage, communication) that provide the capabilities and characteristics of the network slice. The NSSF enables other NFs (e.g., AMF) to identify a network slice instance that is suitable for a UE's desired service. · Authentication Server Function (AUSF) with Nausf Interface - performs user authentication based on the user's home network (HPLMN) and calculates security key material for various purposes. Network Data Analysis Function (NWDAF) with Nnwdaf Interface - Provides network analysis information (e.g., statistics and / or forecast information of past events) to other NFs at the network slice instance level. Location Management Function (LMF) with Nlmf interface - Supports various functions related to determining the UE's location, including determining the UE's location and obtaining either DL position measurements or estimates from the UE, UL position measurements from the NG RAN, and non-UE related assistance data from the NG RAN.

[0082] The Unified Data Management (UDM) function supports the generation of 3GPP authentication credentials, handling of user identification, access authorization based on subscription data, and other subscriber-related functions. To provide this functionality, the UDM uses subscription data (including authentication data) stored in the 5GC Unified Data Repository (UDR). In addition to the UDM, the UDR supports the storage and retrieval of policy data by the PCF and the storage and retrieval of application data by the NEF.

[0083] The UDM may include, or be co-sited with, an Authentication Credential Repository and Processing Function (ARPF) that stores subscriber long-term security credentials. The UDM may also include, or be co-sited with a Subscription Identifier Demasking Function (SIDF) that maps between different subscriber identifiers.

[0084] The NRF allows all NFs to discover services provided by other NFs, and the Data Storage Function (DSF) allows all NFs to store their context. Furthermore, the NEF exposes 5GC capabilities and events to AFs inside and outside the 5GC. For example, the NEF provides a service that allows AFs to provision specific subscription data (e.g., expected UE behavior) for various UEs.

[0085] As mentioned above, 3GPP Rel-16 introduces new AKMA functionality based on 3GPP user credentials in 5G, including IoT use cases. More specifically, AKMA leverages the user's AKA credentials to bootstrap security between the UE and the AF, which enables the UE to securely exchange data with application servers. The AKMA architecture can be considered an evolution of the Generic Bootstrapping Architecture (GBA) specified for 5GC in Rel-15 and further specified in 3GPP TS 33.535 (v.16.2.0).

[0086] In addition to the NEF, AUSF, and AF shown in Figure 2 and described above, the AKMA also utilizes an Anchor Function (AAnF) for authentication and key management for applications. This function is shown in Figure 2 with the Naanf interface. In general, the AAnF interacts with the AUSF and maintains the UE AKMA context, which is used, for example, for subsequent bootstrap requests by application functions. Roughly speaking, the AAnF is similar to the Bootstrapping Server Function (BSF) specified for Rel-15 GBA.

[0087] In general, AKMA reuses the results of the 5G primary authentication procedure used to authenticate the UE during network registration (also known as "implicit bootstrapping"). In this procedure, the AUSF is responsible for generating and storing keying material. In particular, the AKMA key hierarchy includes the following, which is further described in Figure 3: ·K AUSF Root key. It is the output of the primary authentication procedure and is stored in the UE (i.e., part of the mobile equipment, ME) and the AUSF. Furthermore, the AUSF stores K as the result and the output of the primary authentication result in the UDM, as specified in 3GPP TS33.501 (v15.11.0). AUSF The specific AUSF instance that generates the AUSF can be reported. ·K AKMA :K by ME and AUSF AUSF A key identifier A-KID is an anchor key derived from K and used by the AAnF for the generation of further AKMA key material. AKMA The A-KID contains the AKMA Temporary UE Identifier (A-TID) and routing information related to the UE's home network (HPLMN). ·K AF :K by ME and AAnF AKMA and used by the UE and application to securely exchange application data.

[0088] When the UE wants to use AKMA, the UE AF and constructs an A-KID and sends the A-KID to the AF, which may be located inside or outside the operator's network. The AF receives the K associated with the A-KID from the AAnF by sending the A-KID to the AAnF via the NEF when the AF is located outside the operator's network, or directly to the AAnF when the AF is located inside the operator's network. AF After authentication of the AF by the operator network, the AAnF, possibly via the NEF, requests the corresponding K AF This sends the shared key material K AF will be available in the UE and the AF to support the security of communications between the UE and the AF.

[0089] The A-KID is in the NAI format specified in Section 2.2 of IETF RFC7542, i.e., username@realm. The username part contains a routing indicator (RID) and an AKMA temporary UE identifier (A-TID), and the realm part contains a home network identifier. The A-TID is AUSF For example, A-KID = "A-TID". "RID" @ home network realm.

[0090] The RID is an integral part of the Subscription Privacy Identifier (SUCI) used in 5G networks to conceal and / or maintain the privacy of a user's Subscription Persistent Identifier (SUPI). Figure 4 shows the various fields of the SUCI. The RID can be 1 to 4 digits, depending on the implementation. The RID, when combined with the home network identifier contained in the SUCI, facilitates routing of signaling to a network function (NF) within the home network that can serve the user / subscriber.

[0091] In addition to being pre-provisioned by the home network, the routing indicator in the UE / USIM may also be dynamically updated by a UDM instance in the home network (e.g., via control signaling) when the UE registers with the network, which facilitates flexible capability partitioning and routing planning of NF instances in the home network.

[0092] Figure 5 shows the K AKMA 5 shows a signal flow diagram of an exemplary procedure for generating. Although some of the operations shown in FIG. 5 are labeled with numbers, these are for ease of explanation and do not imply a strict chronological order of the operations unless otherwise specified. Additionally, some of the operations shown in FIG. 5 may be optional.

[0093] In operation 1, during the primary authentication procedure, the AUSF interacts with the UDM to fetch authentication information such as subscription credentials (e.g., AKA authentication vector) and authentication method using the Nudm_UEAuthentication_Get request service operation. In the Nudm_UEAuthentication_Get response in operation 2, the UDM may also indicate to the AUSF whether an AKMA anchor key needs to be generated for the UE. When the AUSF receives an AKMA indication (AKMA Ind) from the UDM, the AUSF AUSF and after the primary authentication procedure is successfully completed,AUSF From K AKMA (operation 3a) and A-KID (operation 3b). Similarly, the UE also generates the K AUSF From K AKMA (operation 3a) and generate an A-KID (operation 3b).

[0094] In operation 4, after the AKMA key material is generated, the AUSF uses the Naanf_AKMA_KeyRegister request service operation to register the generated A-KID and K AKMA together with the UE's SUPI to the AAnF. The AAnF stores this information sent by the AUSF and responds with a Naanf_AKMA_KeyRegister response service operation.

[0095] Figure 6 shows the K AF 6 shows a signal flow diagram of an exemplary procedure for generating: Although some of the operations shown in FIG. 6 are labeled with numbers, these are for ease of explanation and do not imply a strict chronological order of the operations unless otherwise specified.

[0096] The primary authentication between the UE and the AAnF is performed by the K AF Generation, and K AUSF From K AKMA and requirements of an exemplary procedure for UE generation of A-KID. In operation 1, the UE sends an application establishment request including the A-KID to the AF. The UE may request K before or after sending the message. AF may be derived.

[0097] In operation 2, if the AF does not have an active context associated with the received A-KID, the AF discovers and selects an AAnF (e.g., based on the routing indicator in the A-KID) that can handle the request from the UE. The AF sends a Naanf_AKMA_ApplicationKey_Get request to the AAnF, including the received A-KID and an AF identifier (AF_ID). The AF ID consists of the AF's fully qualified domain name (FQDN) and a Ua* security protocol identifier that identifies the security protocol the AF uses with the UE. When the AAnF receives this request, it checks whether the AAnF can provide service to the AF based on its configured local policy or based on the authorization information or policy provided by the NRF using the AF ID. If unsuccessful, the AAnF shall reject the request and the procedure ends. The AAnF uses the UE-specific K AKMA verifies whether the subscriber is authorized to use AKMA based on the presence or absence of K AKMA If present, the AAnF continues with operation 3, otherwise the AAnF skips operation 3 and performs operation 4 with the error response.

[0098] In operation 3, AAnF is required. AF If AAnF does not already have K AKMA From AF key (K AF The key derivation procedure is described in 3GPP TS38.535 (v17.0.0) Annex A.4. In operation 4, the AAnF derives K AF and K. AFIn operation 5, the AF sends a Naanf_AKMA_ApplicationKey_Get response to the AF, including the expiration date and expiration time of the AKMA key request. In operation 6, the AF sends an application session establishment response to the UE. If the information received in operation 4 indicates a failure of the AKMA key request, the AF rejects the application session establishment by including the cause of the failure. The UE may then trigger a new application session establishment request using the latest A-KID to the AKMA AF.

[0099] The AMF / SEAF may initiate authentication with the UE during any procedure of establishing a signaling connection with the UE. Figure 7 shows a signal flow diagram of an exemplary procedure for initiating UE authentication and selecting an authentication method. Although some of the operations shown in Figure 7 are numbered, these are for ease of explanation and do not imply a strict chronological order of the operations unless otherwise specified.

[0100] First, the UE sends a message to the AMF over the N1 interface. This is collectively referred to as the "N1 message," but in some cases may be a registration request. The UE includes either a SUCI or a 5G Global Unique Temporary Identifier (5G-GUTI) in this message. The 5G-GUTI is allocated by the AMF and includes a public land mobile network (PLMN) identifier, an AMF ID, and a temporary mobile subscriber identity (TMSI). The 5G-GUTI is not permanently fixed to a specific subscriber or UE, but is allocated temporarily. For example, the AMF may reallocate a new 5G-GUTI to the UE at any time under various conditions.

[0101] Subsequently, when the AMF / SEAF has a valid 5G-GUTI, it includes the corresponding SUPI in an authentication request to the AUSF (i.e., Nausf_UEAuthentication_Authenticate) and re-authenticates the UE. Otherwise, the AUSF includes the SUCI in the authentication request. Thus, the various AUSF instances involved in the initial and / or subsequent authentication procedures may or may not obtain the UE's SUCI and the routing indicator included in the SUCI.

[0102] The AUSF forwards the authentication request to the UDM (which includes a co-sited ARPF / SIDF). Given the SUCI in the authentication request, the SIDF performs SUCI-to-SUPI deciphering and maps the SUCI to the SUPI. The UDM also selects an authentication method and sends the SUPI back to the AUSF for subsequent use (not shown).

[0103] As briefly mentioned above, when a SUPI is used instead of a SUCI in the primary authentication of a UE, the AUSF may not be able to obtain the routing indicator (RID) included in the SUCI. One exemplary scenario is when the AMF selects an AUSF instance (e.g., AUSF2) that is different from the AUSF instance (e.g., AUSF1) that performed the authentication procedure based on the SUCI from the UE. Another exemplary scenario is when the UE's authentication context (e.g., including the routing indicator) stored in AUSF1 is cleared, deleted, and / or removed after the initial authentication.

[0104] Since the RID is a required attribute for generating AKMA keying material (e.g., A-KID), the AKMA key generation procedure will fail in these instances. This can lead to various problems, challenges, and / or difficulties. For example, without the AKMA keying material, the network will not be able to generate application keys that will subsequently be used by the AF for application sessions with the UE. This is highly undesirable.

[0105] Embodiments of the present disclosure address these and other problems, issues, and / or difficulties by providing novel, flexible, and efficient techniques for facilitating retrieval of routing indicators from a UDM that is under trusted home network (HPLMN) control. Advantages of these embodiments include home network control over the retrieval and use of routing indicators, as well as trustworthiness of the routing indicators obtained in this manner. Other embodiments facilitate the AUSF / AAnF generating and using A-KIDs without routing indicators, e.g., A-TIDs only. In either case, the high-level advantage is the availability of AKMA keying material necessary to generate application keys used by the AF for application sessions with the UE.

[0106] 8 illustrates a signal flow diagram of an exemplary key generation procedure according to some embodiments of the present disclosure. Many of the operations in FIG. 8 are substantially similar to those illustrated in FIG.

[0107] Generally speaking, during primary authentication, the AUSF receives an authentication request including a first identifier or a second identifier. The first identifier may be, for example, a SUCI, and the second identifier may be, for example, a SUPI. As described above with reference to Figure 7, the SUCI or SUPI may be received from the AMF or the SEAF.

[0108] In operation 1, the AUSF performs a second authentication request to the UDM, including the first identifier or the second identifier, and optionally including an explicit request for the first field. The first field may correspond to the first field of the first identifier. In some examples, the first field is the RID. In an exemplary embodiment, in operation 1, the AUSF may perform a Nudm_UEAuthentication_Get request service operation, which may include a request for the RID. This may be useful in situations where the RID is not yet available to the AUSF. The request for the RID is optional, as shown in FIG. 8 as an optional information element.

[0109] The UDM may determine whether an AKMA indicator should be returned in the response to the AUSF. The AKMA indicator may indicate to the AUSF that AKMA key material will be generated. If the AKMA indicator is included in the response, the UDM may also include a first field, in this example, a RID. This is illustrated in operation 2. The UDM may derive the first field from either: UE subscription data, a deciphering procedure from a second identifier to a first identifier, for example by a deciphering procedure from SUCI to SUPI, or Previously stored successful authentication results (described in more detail below)

[0110] Thus, in operation 2, the AUSF may receive a response to the second authentication request from the UDM, which may include the AKMA indicator and the first field.

[0111] In one embodiment, receiving the response includes a Nudm_UEAuthentication_Get response of act 2, and the UDM may include the RID according to the explicit request of the AUSF in act 1. Alternatively, the UDM may determine to include the RID when the response also includes an AKMA Ind. In some of these examples, the UDM may include the RID when the Nudm_UEAuthentication_Get response includes the UE's SUPI rather than a SUCI. In some examples, the UDM may return the RID in response to a determination performed by the UDM that an AKMA indicator should be included in the response.

[0112] After receiving the response including the RID, the AUSF may derive an anchor key (KAKMA) for the UE (operation 3a). Further, the AUSF may generate a first security key identifier, e.g., A-KID, based on the received first field, e.g., the RID (operation 3b).

[0113] The AUSF may further send a message including the anchor key (KAKMA) and the first security key identifier to an Anchor Function for Authentication and Key Management for Applications (AAnF). The AAnF may be included in the communication network. In some examples, the message further includes a second identifier. As described above, in some examples, the second identifier is a SUPI. In one specific example, after the AKMA key material is generated in operation 4, the AUSF uses the Naanf_AKMA_KeyRegister request service operation to register the generated A-KID and K AKMA together with the UE's SUPI to the AAnF. The AAnF stores this information sent by the AUSF and responds with a Naanf_AKMA_KeyRegister response service operation.

[0114] 9 illustrates a signal flow diagram of an exemplary key generation procedure according to another embodiment of the present disclosure. Although some of the operations shown in FIG. 9 are labeled with numbers, these are for ease of explanation and do not imply a strict chronological order of the operations unless otherwise specified.

[0115] In operation 0 (which may be considered a prerequisite or precondition), the UE and AUSF perform an authentication procedure using an Extensible Authentication Protocol (EAP) method or a 5G-AKA-related method as illustrated in FIG. 5. When the UE provides the SUCI in operation 0, the AUSF includes the routing indicator portion of the SUCI in a Nudm_UEAuthentication_ResultConfirmation request to the UDM in operation 1. The UDM stores the UE's authentication status, including the routing indicator (operation 2), and responds to the AUSF (operation 3). In operation 4, the UDM authorizes a subsequent authentication procedure (e.g., by the AMF) based on the stored UE authentication status.

[0116] Other embodiments include procedures for deriving AKMA keying material after primary authentication, regardless of whether a routing indicator is available to the AUSF. Figure 10 shows a signal flow diagram of an exemplary key generation procedure according to these embodiments. Many of the operations in Figure 10 are substantially similar to those shown in Figures 5 and 8.

[0117] After receiving the AKMA indicator and the first field in step 2, the AUSF may generate a first security key identifier based on the first field in operation 3b. If the first field is unavailable, the AUSF may generate a second security key identifier that is not based on the first field. In operation 4, the AUSF may include the first security key identifier or the second security key identifier in a message to the AAnF. Optionally, the AUSF may also indicate which of the two security key identifiers is included in the message by including a type of security key identifier.

[0118] Next, a more specific example of the above method is shown. If the AUSF has received the AKMA indicator and the RID of the UE is available, then in operation 3b the AUSF generates an A-KID. If the RID is not available, the AUSF instead generates the K AUSF In operation 4, the AUSF includes the generated A-KID or A-TID in a message to the AAnF. Optionally, the AUSF can also indicate which of the two identifiers is included in the message, for example by the type of AKMA key ID.

[0119] FIG. 11 shows the K AF 11 shows a signal flow diagram of an exemplary procedure for generation. Many of the operations in Fig. 11 are substantially similar to those shown in Fig. 6, so only the differences are described below. This procedure assumes that the AUSF has provided the A-TID to the AAnF in the manner described above.

[0120] In operation 3a, when the AAnF receives the A-KID from the AF, it derives an A-TID corresponding to the received A-KID. In operation 3b, the AAnF searches for AKMA keying material based on the derived A-TID. For example, the AAnF may search for a match between the derived A-TID and an A-TID previously provided by the AUSF. Once a matching A-TID is found, the AAnF searches for the associated K AKMA and its associated K AKMA Using K AF (action 3c).

[0121] The above-described embodiments may be further described with reference to FIGS. 12-14 , which illustrate example methods (e.g., procedures) for AUSF, AAnF, and UDM, respectively. In other words, various features of the operations described below correspond to the various embodiments described above. The example methods illustrated in FIGS. 12-14 may be used in conjunction (e.g., with each other and / or with other procedures described herein) to provide benefits, advantages, and / or solutions to problems described herein. Although the example methods are illustrated in FIGS. 12-14 by specific blocks in a particular order, the operations corresponding to the blocks may be performed in a different order than illustrated, and may be combined and / or divided into operations having different functionality than illustrated. Optional blocks and / or operations are indicated by dashed lines.

[0122] 12A and 12B illustrate an exemplary method (e.g., procedure) for an authentication server function (AUSF) in a communication network, according to various exemplary embodiments of the present disclosure. The exemplary method illustrated in FIG. 12A and 12B may be performed by an AAnF as described herein with reference to other figures. Optional method steps are indicated by dashed lines in FIG. 12A and 12B.

[0123] The exemplary method may include the operations of block 1210, where an AUSF may receive an authentication request from a user equipment (UE) that includes either a first identifier associated with the UE or a second identifier associated with the UE. The exemplary method may also include the operations of block 1220 or block 1250. In block 1220, the AUSF may determine a first security key identifier based on a first field included in or corresponding to the first identifier, obtained from a unified data management function (UDM) of the communication network. In block 1250, the AUSF may determine a second security key identifier that is not based on the first field of the first identifier. The method may further include sending (1240) the first field to the UDM.

[0124] In some embodiments, when the authentication request includes a first identifier, the exemplary method may also include the operations of blocks 1230-1240, in which the AUSF determines a first security key identifier based on a first field that may be included in the first identifier or that may correspond to a first field of the first identifier (1230), and sends the first field included in the first identifier to the UDM (1240).

[0125] In some embodiments, the second identifier may be a SUPI generated from or corresponding to a 5G Globally Unique Temporary Identifier (5G-GUTI) (see FIG. 7), the first identifier may be a Subscription Secrecy Identifier (SUCI), and the first field may be a Routing Indicator (RID) associated with the UE's home network. In such embodiments, the first security key identifier may be an Authentication and Key Management for Applications (AKMA) Key Identifier (A-KID), and the second security key identifier may be an AKMA Temporary UE Identifier (A-TID).

[0126] In some embodiments, determining the first security key identifier based on the first field obtained from the UDM (e.g., in block 1220) may include operations of sub-blocks 1221-1223, wherein the AUSF may receive from the AMF or SEAF a second identifier determined based on a third identifier associated with the UE, send an authentication request to the UDM including the third identifier, and receive the first field from the UDM in a response to the authentication request. In some of these embodiments, the authentication request may include an explicit request for the first field. In some of these embodiments, the third identifier may be a subscription persistent identifier (SUPI).

[0127] In some embodiments, the exemplary method may also include operations of blocks 1260-1270, where the AUSF obtains an anchor key (K AKMA ) and derive the anchor key (K AKMA ) and the determined security key identifier to an AAnF of the communications network. In some embodiments, the message may also include an indication of whether the included security key identifier is a first security key identifier or a second security key identifier (e.g., a key identifier type indicator).

[0128] In some embodiments, determining the second security key identifier (e.g., at block 1220) may be further based on determining that the first field of the first identifier associated with the UE is unavailable to the AUSF.

[0129] Figure 12B includes substantially the same steps as the method described above with reference to Figure 12A, but omits optional steps 1221, 1240, and 1250. However, these steps may also be advantageously included in the method shown in Figure 12B. Figure 12B further includes step 1224 of receiving an AKMA indicator from the UDM in response to the authentication request. An example of this step is also illustrated, for example, in Figure 8.

[0130] 13A and 13B illustrate an example method (e.g., a procedure) for a unified data management function (UDM) of a communication network, according to various example embodiments of the present disclosure. The example method illustrated in FIGS. 13A and 13B may be performed by a UDM as described herein with reference to other figures. The example method of FIG. 13A may include the operation of block 1310, where the UDM may receive, from an AUSF of the communication network, an authentication request for a UE, the authentication request including either a first identifier associated with the UE or a second identifier associated with the UE. When the authentication request includes the second identifier, the example method may also include the operation of block 1320, where the UDM may obtain a first field of the first identifier, or a first field corresponding to the field of the first identifier, and send the first field to the AUSF in a response to the authentication request. "Corresponding field" may mean that the first field includes a data field corresponding to a data field of the first identifier, i.e., the fields have the same value. In some examples, the UDM may obtain the first field from a previously stored field of the received first identifier, as described below with respect to how the UDM may obtain the first field. When the authentication request includes the first identifier, the example method may also include the operation of block 1330, where the UDM may store the first field included in the first identifier.

[0131] In some embodiments, obtaining the first field (e.g., in block 1320) may include the operations of either sub-block 1321 or sub-block 1322. In sub-block 1321, the UDM may retrieve a stored version of the first field from the UE subscription data or from a previous successful authentication of the UE. In sub-block 1322, the UDM may perform a deciphering operation on the second identifier to generate a first identifier that includes the first field.

[0132] In some embodiments, sending the first field to the AUSF (e.g., at block 1320) may be in response to one of an explicit request for the first field to be included in the authentication request or inclusion of an AKMA indicator in the response to the authentication request.

[0133] In some embodiments, the second identifier may be a Subscription Persistent Identifier (SUPI), the first identifier may be a Subscription Concealment Identifier (SUCI), and the first field may be a Routing Indicator (RID) associated with the UE's home network. As described above, the SUPI may correspond to or be determined based on a 5G Global Unique Temporary Identifier (5G-GUTI).

[0134] The example method of FIG. 13B may include the operations of block 1310, where the UDM may receive, from an AUSF of a communication network, an authentication request for the UE, the authentication request including either a first identifier associated with the UE or a second identifier associated with the UE. The method may further include determining (1315) whether a response to the authentication request should include an AKMA indicator. An example of this step is also shown in FIG. 8. When the response should include the AKMA indicator, the method may further include obtaining (1320) the first field and sending the first field to the AUSF in the response to the authentication request. Obtaining (1320) may include retrieving (1321) a stored version of the first field from UE subscription data or from a previously successful authentication of the UE. Alternatively, the method may include performing a deciphering operation on the second identifier to generate a first identifier including the first field (1322).

[0135] 14 illustrates an example method (e.g., procedure) for an anchor function (AAnF) for authentication and key management for applications in a communication network, according to various exemplary embodiments of the present disclosure. The example method illustrated in FIG. 14 may be performed by the AAnF as described herein with reference to other figures.

[0136] The exemplary method may include the operation of block 1410, where the AAnF receives an anchor key (K AKMA ) can be received with one of the following security key identifiers: a first security key identifier based on a first field of a first identifier associated with the UE; or A second security key identifier that is not based on the first field

[0137] The example method may also include the operation of block 1420, where the AAnF receives an anchor key (K AKMA ) associated with the received security key identifier and stored. The example method may also include the operation of block 1430, in which the AAnF receives, from an Application Function (AF) associated with the communication network, a security key (K) associated with the application session between the AF and the UE. AF ), the request including a third security key identifier associated with the UE. The example method may also include the operation of block 1440, where the AAnF, based on a determination that the third security key identifier corresponds to a stored security key identifier, AKMA ) based on the security key (K AF In some embodiments, the exemplary method may also include the operation of block 1450, where the AAnF may derive the derived security key (K AF) can be sent to AF.

[0138] In some embodiments, the second identifier may be a Subscription Persistent Identifier (SUPI), the first identifier may be a Subscription Confidentiality Identifier (SUCI), and the first field may be a Routing Indicator (RID) associated with the UE's home network. In such embodiments, the first security key identifier may be an Authentication and Key Management for Applications (AKMA) Key Identifier (A-KID), and the second security key identifier may be an AKMA Temporary UE Identifier (A-TID).

[0139] In some embodiments, the anchor key (K AKMA When a fourth security key identifier is stored in association with the second security key identifier, determining (e.g., in block 1440) that the third security key identifier corresponds to the stored security key identifier may include operations in sub-blocks 1441-1442. In sub-block 1441, the AAnF may determine a fourth security key identifier from the received third security key identifier. In sub-block 1442, the AAnF may determine a match between the fourth security key identifier and the second security key identifier. In some embodiments, the third security key identifier may be an Authentication and Key Management for Application (AKMA) Key Identifier (A-KID), and the fourth security key identifier may be an AKMA Temporary UE Identifier (A-TID).

[0140] Although the subject matter described herein may be implemented in any suitable type of system using any suitable components, the embodiments disclosed herein are described with reference to a wireless network, such as the exemplary wireless network shown in FIG. 15. For simplicity, the wireless network of FIG. 15 illustrates only network 1506, network nodes 1560 and 1560b, and WDs 1510, 1510b, and 1510c. In practice, the wireless network may further include any additional elements suitable for supporting communication between wireless devices or between a wireless device and another communication device, such as a landline telephone, a service provider, or any other network node or end device. Of the illustrated components, network node 1560 and wireless device (WD) 1510 are depicted in further detail. A wireless network may provide communication and other types of services to one or more wireless devices to facilitate wireless devices accessing and / or using services offered by or via the wireless network.

[0141] A wireless network can include and / or interface with any type of communication, telecommunication, data, cellular, and / or radio network, or other similar type of system. In some embodiments, a wireless network may be configured to operate according to a particular standard or other type of predefined rules or procedures. Thus, particular embodiments of a wireless network may implement communication standards such as Global System for Mobile Communications (GSM), Universal Mobile Telecommunications System (UMTS), Long Term Evolution (LTE), and / or other suitable 2G, 3G, 4G, or 5G standards, wireless local area network (WLAN) standards such as the IEEE 802.11 standard, and / or any other suitable wireless communication standards such as Worldwide Interoperability for Microwave Access (WiMax), Bluetooth, Z-Wave, and / or ZigBee standards.

[0142] The network 1506 may include one or more backhaul networks, core networks, IP networks, public switched telephone networks (PSTN), packet data networks, optical networks, wide area networks (WANs), local area networks (LANs), wireless local area networks (WLANs), wired networks, wireless networks, metropolitan area networks, and other networks that enable communication between devices.

[0143] The network node 1560 and the WD 1510 comprise various components, which are described in more detail below. These components cooperate to provide the functionality of a network node and / or a wireless device, such as providing wireless connectivity in a wireless network. In different embodiments, a wireless network may include any number of wired or wireless networks, network nodes, base stations, controllers, wireless devices, relay stations, and / or any other components or systems capable of facilitating or participating in communication of data and / or signals, whether via wired or wireless connections.

[0144] Examples of network nodes include, but are not limited to, access points (APs) (e.g., wireless access points) and base stations (BSs) (e.g., radio base stations, Node Bs, evolved Node Bs (eNBs), and NR Node Bs (gNBs)). Base stations may be classified based on the amount of coverage they provide (or, in other words, their transmit power level), in which case they may also be referred to as femto, pico, micro, or macro base stations. A base station may be a relay node or a relay donor node that controls relaying. A network node may also include one or more (or all) parts of a distributed radio base station, such as a centralized digital unit and / or a remote radio unit (RRU), sometimes referred to as a remote radio head (RRH). Such remote radio units may or may not be integrated with antennas as antenna-integrated radios. Portions of a distributed radio base station may be referred to as nodes in a distributed antenna system (DAS).

[0145] Further examples of a network node include multi-standard radio (MSR) equipment such as an MSR BS, a network controller such as a radio network controller (RNC) or base station controller (BSC), a base transceiver station (BTS), a transmission point, a transmitting node, a multi-cell / multicast coordination entity (MCE), a core network node (e.g., MSC, MME), an O&M node, an OSS node, a SON node, a positioning node (e.g., E-SMLC), and / or an MDT. As another example, a network node may be a virtual network node as described in more detail below. However, more generally, a network node may represent any suitable device (or group of devices) configured, arranged, and / or operable to enable wireless devices to access a wireless network and / or provide wireless devices with access to a wireless network or provide some service to wireless devices accessing a wireless network.

[0146] In FIG. 15 , network node 1560 includes processing circuitry 1570, device-readable medium 1580, interface 1590, auxiliary equipment 1584, power supply 1586, power circuitry 1587, and antenna 1562. While network node 1560 shown in the example wireless network of FIG. 15 may represent a device including the illustrated combination of hardware components, other embodiments may include network nodes having different combinations of components. It should be understood that a network node includes any suitable combination of hardware and / or software necessary to perform the tasks, features, functions, and methods and / or procedures disclosed herein. Furthermore, while the components of network node 1560 are shown as a single box located within a larger box or as a single box nested within multiple boxes, in reality, the network node may comprise multiple different physical components that make up the single component shown (e.g., device-readable medium 1580 may comprise multiple separate hard drives and multiple RAM modules).

[0147] Similarly, the network node 1560 may be composed of multiple physically separate components (e.g., a Node B component and an RNC component, or a BTS component and a BSC component, etc.), each of which may have its own respective components. In certain scenarios in which the network node 1560 comprises multiple separate components (e.g., a BTS component and a BSC component), one or more of the separate components may be shared among several network nodes. For example, a single RNC may control multiple Node Bs. In such a scenario, each unique Node B and RNC pairing may possibly be considered a single separate network node. In some embodiments, the network node 1560 may be configured to support multiple radio access technologies (RATs). In such embodiments, some components may be duplicated (e.g., separate device-readable media 1580 for different RATs) and some components may be reused (e.g., the same antenna 1562 may be shared by the RATs). Network node 1560 may also include multiple sets of the various illustrated components for different wireless technologies, such as GSM, WCDMA, LTE, NR, WiFi, or Bluetooth wireless technologies, integrated into network node 1560. These wireless technologies may be integrated into the same or different chips or sets of chips and other components within network node 1560.

[0148] The processing circuit 1570 may be configured to perform any decision, calculation, or similar operation (e.g., a particular acquisition operation) described herein as being provided by a network node. These operations performed by the processing circuit 1570 may include processing information acquired by the processing circuit 1570, for example, by transforming the acquired information to other information, comparing the acquired or converted information to information stored in the network node, and / or performing one or more operations based on the acquired or converted information, and making a decision as a result of said processing.

[0149] The processing circuit 1570 may comprise one or more combinations of a microprocessor, controller, microcontroller, central processing unit, digital signal processor, application specific integrated circuit, field programmable gate array, or any other suitable computing device, resource, or combination of hardware, software, and / or coded logic operable to provide various functions of the network node 1560, alone or in conjunction with other network node 1560 components (e.g., device-readable medium 1580). Such functionality may include any of the various wireless features, functions, or benefits described herein.

[0150] For example, the processing circuit 1570 may execute instructions stored on the device-readable medium 1580 or on a memory within the processing circuit 1570. In some embodiments, the processing circuit 1570 may include a system-on-chip (SOC). As a more specific example, the instructions (also referred to as a computer program product) stored on the medium 1580 may include instructions that, when executed by the processing circuit 1570, can configure the network node 1560 to perform operations corresponding to various example methods (e.g., procedures) described herein.

[0151] In some embodiments, the processing circuitry 1570 may include one or more of a radio frequency (RF) transceiver circuitry 1572 and a baseband processing circuitry 1574. In some embodiments, the radio frequency (RF) transceiver circuitry 1572 and the baseband processing circuitry 1574 may be on separate chips (or sets of chips), boards, or units such as a radio unit and a digital unit. In alternative embodiments, some or all of the RF transceiver circuitry 1572 and the baseband processing circuitry 1574 may be on the same chip or set of chips, board, or unit.

[0152] In particular embodiments, some or all of the functionality described herein as being provided by a network node, base station, eNB, or other such network device may be performed by the processing circuitry 1570 executing instructions stored on the device-readable medium 1580 or memory within the processing circuitry 1570. In alternative embodiments, some or all of the functionality may be provided by the processing circuitry 1570 without executing instructions stored on a separate or distinct device-readable medium, such as in a hardwired manner. In any of those embodiments, the processing circuitry 1570 may be configured to perform the described functionality, regardless of whether or not it executes instructions stored on a device-readable storage medium. Benefits provided by such functionality are not limited to the processing circuitry 1570 alone or to other components of the network node 1560, but are enjoyed by the network node 1560 as a whole and / or by end users and the wireless network generally.

[0153] The device-readable medium 1580 may comprise any form of volatile or non-volatile computer-readable memory, including, but not limited to, persistent storage, solid-state memory, remotely mounted memory, magnetic media, optical media, random-access memory (RAM), read-only memory (ROM), mass storage media (e.g., hard disk), removable storage media (e.g., flash drive, compact disc (CD), or digital video disc (DVD)), and / or any other volatile or non-volatile non-transitory device-readable and / or computer-executable memory device that stores information, data, and / or instructions that can be used by the processing circuit 1570. The device-readable medium 1580 may store any suitable instructions, data, or information, including applications including one or more of computer programs, software, logic, rules, code, tables, etc., and / or other instructions available for execution by the processing circuit 1570 and utilization by the network node 1560. The device-readable medium 1580 may be used to store any calculations performed by the processing circuit 1570 and / or any data received via the interface 1590. In some embodiments, the processing circuit 1570 and the device-readable medium 1580 may be considered to be integrated.

[0154] The interface 1590 is used in wired or wireless communication of signaling and / or data between the network node 1560, the network 1506, and / or the WD 1510. As shown, the interface 1590 comprises a port / terminal 1594 for transmitting and receiving data to and from the network 1506, for example, via a wired connection. The interface 1590 also includes a radio front-end circuit 1592, which may be coupled to the antenna 1562 or, in certain embodiments, may be part of the antenna 1562. The radio front-end circuit 1592 comprises a filter 1598 and an amplifier 1596. The radio front-end circuit 1592 may be connected to the antenna 1562 and the processing circuit 1570. The radio front-end circuit may be configured to condition signals communicated between the antenna 1562 and the processing circuit 1570. The radio front-end circuit 1592 may receive digital data to be sent to another network node or WD via a wireless connection. The radio front-end circuit 1592 can convert the digital data into a radio signal having appropriate channel and bandwidth parameters using a combination of filters 1598 and / or amplifiers 1596. The radio signal can then be transmitted via the antenna 1562. Similarly, when receiving data, the antenna 1562 can collect the radio signal, which is then converted into digital data by the radio front-end circuit 1592. The digital data can be passed to the processing circuit 1570. In other embodiments, the interface can comprise different components and / or different combinations of components.

[0155] In certain alternative embodiments, the network node 1560 may not include a separate radio front-end circuit 1592; instead, the processing circuit 1570 may comprise a radio front-end circuit and may be connected to the antenna 1562 without a separate radio front-end circuit 1592. Similarly, in some embodiments, all or a portion of the RF transceiver circuit 1572 may be considered part of the interface 1590. In still other embodiments, the interface 1590 may include one or more ports or terminals 1594, the radio front-end circuit 1592, and the RF transceiver circuit 1572 as part of a radio unit (not shown), and the interface 1590 may communicate with baseband processing circuitry 1574 that is part of a digital unit (not shown).

[0156] The antenna 1562 may include one or more antennas or antenna arrays configured to transmit and / or receive wireless signals. The antenna 1562 may be coupled to the radio front-end circuitry 1590 and may be any type of antenna capable of transmitting and receiving data and / or signals wirelessly. In some embodiments, the antenna 1562 may comprise one or more omni-directional, sector, or panel antennas operable to transmit / receive wireless signals, for example, between 2 GHz and 66 GHz. An omni-directional antenna may be used to transmit / receive wireless signals in any direction, a sector antenna may be used to transmit / receive wireless signals from devices within a specific area, and a panel antenna may be a line-of-sight antenna used to transmit / receive wireless signals in a relatively straight line. In some instances, the use of two or more antennas may be referred to as MIMO. In certain embodiments, the antenna 1562 may be separate from the network node 1560 and connectable to the network node 1560 through an interface or port.

[0157] The antenna 1562, the interface 1590, and / or the processing circuit 1570 may be configured to perform any receiving operations and / or certain acquisition operations described herein as being performed by a network node. Any information, data, and / or signals may be received from a wireless device, another network node, and / or any other network equipment. Similarly, the antenna 1562, the interface 1590, and / or the processing circuit 1570 may be configured to perform any transmitting operations described herein as being performed by a network node. Any information, data, and / or signals may be transmitted to a wireless device, another network node, and / or any other network equipment.

[0158] The power circuit 1587 may comprise or be coupled to power management circuitry and may be configured to supply power to the components of the network node 1560 for performing the functions described herein. The power supply circuit 1587 may receive power from a power source 1586. The power source 1586 and / or the power supply circuit 1587 may be configured to provide power to the various components of the network node 1560 in a form suitable for each component (e.g., at voltage and current levels required for each component). The power source 1586 may be included in the power supply circuit 1587 and / or the network node 1560, or may be external thereto. For example, the network node 1560 may be connectable to an external power source (e.g., an electrical outlet) via an input circuit or interface, such as an electrical cable, whereby the external power source provides power to the power circuit 1587. As a further example, the power source 1586 may comprise a power source in the form of a battery or battery pack connected to or integrated with the power supply circuit 1587. The battery may provide backup power in the event that the external power source fails. Other types of power sources may also be used, such as photovoltaic devices.

[0159] Alternate embodiments of network node 1560 may include additional components other than those shown in Figure 15 that may be responsible for providing particular aspects of the network node's functionality, including any of the functionality described herein and / or any functionality necessary to support the subject matter described herein. For example, network node 1560 may include user interface devices to enable and / or facilitate the input of information into network node 1560 and to enable and / or facilitate the output of information from network node 1560. This may enable and / or facilitate a user to perform diagnostic, maintenance, repair, and other management functions on network node 1560.

[0160] Additionally, the various network functions (NFs, e.g., UDM, AAnF, AUSF, etc.) described herein may be implemented and / or hosted using different variations of the network node 1560, including the variations described above.

[0161] In some embodiments, a wireless device (WD, e.g., WD1510) may be configured to send and / or receive information without direct human interaction. For example, a WD may be designed to send information to a network on a predetermined schedule, triggered by an internal or external event, or in response to a request from the network. Examples of WDs include, but are not limited to, smartphones, mobile phones, cell phones, voice-over-IP (VoIP) phones, wireless local loop phones, desktop computers, personal digital assistants (PDAs), wireless cameras, gaming consoles or devices, music storage devices, playback appliances, wearable devices, wireless endpoints, mobile stations, tablets, laptop computers, laptop embedded devices (LEEs), laptop mounted devices (LMEs), smart devices, wireless customer premises equipment (CPEs), mobile telecommunications (MTC) devices, Internet of Things (IoT) devices, in-vehicle wireless terminal devices, etc.

[0162] A WD may support device-to-device (D2D) communication, e.g., by implementing 3GPP standards for sidelink communication, vehicle-to-vehicle (V2V), vehicle-to-infrastructure (V2I), and vehicle-to-everything (V2X), in which case it may be referred to as a D2D communication device. As yet another specific example, in an Internet of Things (IoT) scenario, a WD may represent a machine or other device that performs monitoring and / or measurements and transmits results of such monitoring and / or measurements to another WD and / or a network node. In this case, the WD may be a machine-to-machine (M2M) device, which may be referred to as an MTC device in the 3GPP context. As one specific example, a WD may be a UE implementing the 3GPP Narrowband Internet of Things (NB-IoT) standard. Specific examples of such machines or devices are sensors, metering devices such as power meters, industrial machinery, or household or personal appliances (e.g., refrigerators, televisions, etc.), and personal wearables (e.g., watches, fitness trackers, etc.). In other scenarios, a WD may represent a vehicle or other equipment that can monitor and / or report operational status or other functions associated with its operation. The WD described above may represent an endpoint of a wireless connection, in which case the device may be referred to as a wireless terminal. Furthermore, the WD described above may be portable, in which case the WD may be referred to as a mobile device or mobile terminal.

[0163] As shown, wireless device 1510 includes antenna 1511, interface 1514, processing circuitry 1520, device-readable medium 1530, user interface equipment 1532, auxiliary equipment 1534, power supply 1536, and power circuitry 1537. WD 1510 may include multiple sets of one or more of the illustrated components for different wireless technologies supported by WD 1510, such as GSM, WCDMA, LTE, NR, WiFi, WiMAX, or Bluetooth wireless technologies, to name a few. These wireless technologies may be integrated on the same or different chips or sets of chips as other components within WD 1510.

[0164] The antenna 1511 may include one or more antennas or antenna arrays configured to transmit and / or receive wireless signals and is connected to the interface 1514. In certain alternative embodiments, the antenna 1511 may be separate from the WD 1510 and may be connectable to the WD 1510 through an interface or port. The antenna 1511, the interface 1514, and / or the processing circuit 1520 may be configured to perform any receiving or transmitting operations described herein as being performed by a WD. Any information, data, and / or signals may be received from a network node and / or another WD. In some embodiments, the wireless front-end circuit and / or the antenna 1511 may be considered an interface.

[0165] As shown, the interface 1514 comprises a radio front-end circuit 1512 and an antenna 1511. The radio front-end circuit 1512 comprises one or more filters 1518 and an amplifier 1516. The radio front-end circuit 1514 may be connected to the antenna 1511 and the processing circuit 1520 and configured to condition signals communicated between the antenna 1511 and the processing circuit 1520. The radio front-end circuit 1512 may be coupled to or part of the antenna 1511. In some embodiments, the WD 1510 may not include a separate radio front-end circuit 1512; rather, the processing circuit 1520 may comprise the radio front-end circuit and be connected to the antenna 1511. Similarly, in some embodiments, some or all of the RF transceiver circuit 1522 may be considered part of the interface 1514. The radio front-end circuit 1512 may receive digital data to be sent to other network nodes or WDs via a wireless connection. The radio front-end circuitry 1512 can convert the digital data into a radio signal having appropriate channel and bandwidth parameters using a combination of filters 1518 and / or amplifiers 1516. The radio signal can then be transmitted via the antenna 1511. Similarly, when receiving data, the antenna 1511 can collect the radio signal, which is then converted into digital data by the radio front-end circuitry 1512. The digital data can be passed to the processing circuitry 1520. In other embodiments, the interface can include different components and / or different combinations of components.

[0166] The processing circuit 1520 may comprise one or more combinations of a microprocessor, controller, microcontroller, central processing unit, digital signal processor, application specific integrated circuit, field programmable gate array, or any other suitable computing device, resource, or combination of hardware, software, and / or coded logic operable to provide the functionality of the WD 1510, alone or in conjunction with other WD 1510 components, such as the device-readable medium 1530. Such functionality may include any of the various wireless features or benefits described herein.

[0167] For example, the processing circuit 1520 may execute instructions stored on the device-readable medium 1530 or on a memory within the processing circuit 1520 to provide the functionality disclosed herein. More specifically, the instructions (also referred to as a computer program product) stored on the medium 1530 may include instructions that, when executed by the processor 1520, can configure the wireless device 1510 to perform operations corresponding to various example methods (e.g., procedures) described herein.

[0168] As shown, the processing circuit 1520 includes one or more of an RF transceiver circuit 1522, a baseband processing circuit 1524, and an application processing circuit 1526. In other embodiments, the processing circuit may comprise different components and / or different combinations of components. In a particular embodiment, the processing circuit 1520 of the WD 1510 may comprise a SOC. In some embodiments, the RF transceiver circuit 1522, the baseband processing circuit 1524, and the application processing circuit 1526 may be on separate chips or sets of chips. In alternative embodiments, some or all of the baseband processing circuit 1524 and the application processing circuit 1526 may be combined within one chip or set of chips, and the RF transceiver circuit 1522 may be on a separate chip or set of chips. In further alternative embodiments, some or all of the RF transceiver circuit 1522 and the baseband processing circuit 1524 may be on the same chip or set of chips, and the application processing circuit 1526 may be on a separate chip or set of chips. In yet other alternative embodiments, some or all of the RF transceiver circuitry 1522, the baseband processing circuitry 1524, and the application processing circuitry 1526 may be combined within the same chip or set of chips. In some embodiments, the RF transceiver circuitry 1522 may be part of the interface 1514. The RF transceiver circuitry 1522 may condition RF signals for the processing circuitry 1520.

[0169] In particular embodiments, some or all of the functionality described herein as being performed by the WD may be provided by the processing circuitry 1520 executing instructions stored on a device-readable medium 1530, which in particular embodiments may be a computer-readable storage medium. In alternative embodiments, some or all of the functionality may be provided by the processing circuitry 1520 without executing instructions stored on a separate or distinct device-readable storage medium, such as in a hardwired manner. In any of these particular embodiments, the processing circuitry 1520 may be configured to perform the described functionality, regardless of whether or not it executes instructions stored on a device-readable storage medium. Benefits provided by such functionality are not limited to the processing circuitry 1520 alone or to other components of the WD 1510, but are enjoyed by the WD 1510 as a whole and / or by end users and wireless networks generally.

[0170] The processing circuit 1520 may be configured to perform any determination, calculation, or similar operation (e.g., a particular acquisition operation) described herein as being performed by a WD. These operations performed by the processing circuit 1520 may include processing information acquired by the processing circuit 1520, for example, by transforming the acquired information to other information, comparing the acquired or converted information to information stored by the WD 1510, and / or performing one or more operations based on the acquired or converted information, and making a decision as a result of said processing.

[0171] The device-readable medium 1530 may be operable to store applications, including one or more of computer programs, software, logic, rules, code, tables, etc., and / or other instructions executable by the processing circuit 1520. The device-readable medium 1530 may include computer memory (e.g., random access memory (RAM) or read-only memory (ROM)), mass storage media (e.g., hard disk), removable storage media (e.g., compact discs (CDs) or digital video discs (DVDs)), and / or any other volatile or non-volatile non-transitory device-readable and / or computer-executable memory device that stores information, data, and / or instructions that may be used by the processing circuit 1520. In some embodiments, the processing circuit 1520 and the device-readable medium 1530 may be considered to be integrated.

[0172] The user interface devices 1532 may include components that enable and / or facilitate a human user to interact with the WD 1510. Such interaction may be in many forms, such as visual, auditory, tactile, etc. The user interface devices 1532 may be operable to produce output to the user as well as enable and / or facilitate the user to provide input to the WD 1510. The type of interaction may vary depending on the type of user interface devices 1532 installed on the WD 1510. For example, if the WD 1510 is a smartphone, the interaction may be via a touchscreen; if the WD 1510 is a smart meter, the interaction may be through a screen that provides usage (e.g., number of gallons used) or a speaker that provides an audible alarm (e.g., if smoke is detected). The user interface devices 1532 may include input interfaces, devices, and circuits, as well as output interfaces, devices, and circuits. The user interface devices 1532 may be configured to enable and / or facilitate the input of information into the WD 1510 and are connected to the processing circuit 1520 to enable and / or facilitate the processing circuit 1520 to process the input information. The user interface devices 1532 may include, for example, a microphone, a proximity or other sensor, keys / buttons, a touch display, one or more cameras, a USB port, or other input circuitry. The user interface devices 1532 are also configured to enable and / or facilitate the output of information from the WD 1510 and to enable and / or facilitate the processing circuit 1520 to output information from the WD 1510. The user interface devices 1532 may include, for example, a speaker, a display, a vibration circuit, a USB port, a headphone interface, or other output circuitry.By using one or more input and output interfaces, devices, and circuits of the user interface equipment 1532, the WD 1510 can communicate with end users and / or wireless networks to enable and / or facilitate the end users and / or wireless networks to benefit from the functionality described herein.

[0173] The auxiliary device 1534 is operable to provide more specific functions that may not generally be performed by the WD. It may include specialized sensors for taking measurements for various purposes, interfaces for additional types of communication such as wired communication, etc. The inclusion and type of components of the auxiliary device 1534 may vary depending on the embodiment and / or scenario.

[0174] In some embodiments, the power source 1536 may be in the form of a battery or battery pack. Other types of power sources, such as an external power source (e.g., an electrical outlet), a photovoltaic device, or a power cell, may also be used. The WD 1510 may further include a power circuit 1537 for delivering power from the power source 1536 to various portions of the WD 1510 that require power from the power source 1536 to perform any of the functions described or indicated herein. The power circuit 1537, in certain embodiments, may include a power management circuit. The power circuit 1537 may additionally or alternatively be operable to receive power from an external power source, in which case the WD 1510 may be connectable to an external power source (such as an electrical outlet) via an input circuit or interface, such as a power cable. The power circuit 1537, in certain embodiments, may also be operable to deliver power from the external power source to the power source 1536. This may be, for example, for charging the power source 1536. The power circuitry 1537 may perform any conversion or other modification on the power from the power source 1536 to make it suitable for delivery to the respective components of the WD 1510.

[0175] FIG. 16 illustrates one embodiment of a UE in accordance with various aspects described herein. User equipment, or UE, as used herein, does not necessarily have a user in the sense of a human user who owns and / or operates an associated device. Instead, a UE may represent a device (e.g., a smart sprinkler controller) that is intended for sale to or operation by a human user, but that may not be associated with or may not initially be associated with a particular human user. Alternatively, a UE may represent a device (e.g., a smart power meter) that is not intended for sale to or operation by an end user, but that may be associated with or operated for the benefit of a user. The UE 1600 may be any UE identified by the 3rd Generation Partnership Project (3GPP), including an NB-IoT UE, a machine-type communication (MTC) UE, and / or an enhanced MTC (eMTC) UE. The UE 1600 shown in Figure 16 is an example of a WD configured for communication according to one or more communications standards promulgated by the 3rd Generation Partnership Project (3GPP), such as the 3GPP's GSM, UMTS, LTE, and / or 5G standards. As mentioned above, the terms WD and UE may be used interchangeably. Thus, although Figure 16 is a UE, the components described herein are equally applicable to a WD, and vice versa.

[0176] In FIG. 16 , UE 1600 includes a processing circuit 1601 operably coupled to an input / output interface 1605, a radio frequency (RF) interface 1609, a network connection interface 1611, memory 1615 including random access memory (RAM) 1617, read-only memory (ROM) 1619, and storage medium 1621, a communication subsystem 1631, a power source 1633, and / or any other components, or any combination thereof. Storage medium 1621 includes an operating system 1623, application programs 1625, and data 1627. In other embodiments, storage medium 1621 may include other similar types of information. A particular UE may utilize all of the components shown in FIG. 16 or only a subset of the components. The level of integration between components may vary from UE to UE. Additionally, a particular UE may include multiple instances of components such as multiple processors, memories, transceivers, transmitters, receivers, etc.

[0177] 16, processing circuit 1601 may be configured to process computer instructions and data. Processing circuit 1601 may be configured to implement any sequential state machine operable to execute machine instructions stored in memory as a machine-readable computer program, such as one or more hardware-implemented state machines (e.g., in discrete logic, FPGA, ASIC, etc.), programmable logic with appropriate firmware, one or more pre-programmed, general-purpose processors such as microprocessors or digital signal processors (DSPs) with appropriate software, or any combination of the above. For example, processing circuit 1601 may include two central processing units (CPUs). Data may be information in a form suitable for use by a computer.

[0178] In the illustrated embodiment, the input / output interface 1605 may be configured to provide an input device, an output device, or a communication interface for an input / output device. The UE 1600 may be configured to use an output device via the input / output interface 1605. An output device may use the same type of interface port as an input device. For example, a USB port may be used to provide input to and output from the UE 1600. The output device may be a speaker, a sound card, a video card, a display, a monitor, a printer, an actuator, an emitter, a smart card, another output device, or any combination thereof. The UE 1600 may be configured to enable and / or facilitate a user to capture information within the UE 1600 using an input device via the input / output interface 1605. The input device may include a touch-sensitive or presence-sensitive display, a camera (e.g., a digital camera, a digital video camera, a webcam, etc.), a microphone, a sensor, a mouse, a trackball, a directional pad, a trackpad, a scroll wheel, a smart card, etc. The presence-sensitive display may include a capacitive or resistive touch sensor for detecting input from a user. The sensor may be, for example, an accelerometer, a gyroscope, a tilt sensor, a force sensor, a magnetometer, an optical sensor, a proximity sensor, another similar sensor, or any combination thereof. For example, the input device may be an accelerometer, a magnetometer, a digital camera, a microphone, and an optical sensor.

[0179] In FIG. 16, the RF interface 1609 may be configured to provide a communication interface to RF components such as a transmitter, receiver, and antenna. The network connection interface 1611 may be configured to provide a communication interface to a network 1643a. The network 1643a may encompass a wired and / or wireless network, such as a local area network (LAN), a wide area network (WAN), a computer network, a wireless network, a communications network, another similar network, or any combination thereof. For example, the network 1643a may include a Wi-Fi network. The network connection interface 1611 may be configured to include a receiver and transmitter interface used to communicate with one or more other devices over a communications network according to one or more communications protocols, such as Ethernet, TCP / IP, SONET, ATM, etc. The network connection interface 1611 may implement receiver and transmitter functionality appropriate for a communications network link (e.g., an optical link, an electrical link, etc.). The transmitter and receiver functionality may share circuit components, software, or firmware, or alternatively may be implemented separately.

[0180] RAM 1617 may be configured to interface to processing circuit 1601 via bus 1602 to provide storage or caching of data or computer instructions during execution of software programs such as an operating system, application programs, and device drivers. ROM 1619 may be configured to provide computer instructions or data to processing circuit 1601. For example, ROM 1619 may be configured to store unchanging low-level system code or data for basic system functions such as basic input / output (I / O), booting, or receiving keystrokes from a keyboard, stored in non-volatile memory. Storage medium 1621 may be configured to include memory such as RAM, ROM, programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), magnetic disk, optical disk, floppy disk, hard disk, removable cartridge, or flash drive.

[0181] In one example, the storage medium 1621 may be configured to include an operating system 1623, an application program 1625, such as a web browser application, a widget or gadget engine, or another application, and data files 1627. The storage medium 1621 may store any of a wide variety of operating systems or combinations of operating systems for use by the UE 1600. For example, the application program 1625 may include executable program instructions (also referred to as a computer program product) that, when executed by the processor 1601, may configure the UE 1600 to perform operations corresponding to various example methods (e.g., procedures) described herein.

[0182] The storage medium 1621 may be configured to include many physical drive units, such as a redundant array of independent disks (RAID), a floppy disk drive, a flash memory, a USB flash drive, an external hard disk drive, a thumb drive, a pen drive, a key drive, a high-density digital versatile disk (HD-DVD) optical disk drive, an internal hard disk drive, a Blu-ray optical disk drive, a holographic digital data storage (HDDS) optical disk drive, an external mini-dual in-line memory module (DIMM), a synchronous dynamic random access memory (SDRAM), an external micro-DIMM SDRAM, a smart card memory such as a subscriber identity module or removable user identity module (SIM / RUIM), other memory, or any combination thereof. The storage medium 1621 may enable and / or facilitate the UE 1600 to access, offload data, or upload data to, computer-executable instructions, application programs, etc. stored on a transient or non-transient memory medium. An article of manufacture, such as an article of manufacture utilizing the communication system, may be tangibly embodied in a storage medium 1621, which may comprise a device-readable medium.

[0183] In FIG. 16, the processing circuit 1601 may be configured to communicate with a network 1643b using a communications subsystem 1631. The networks 1643a and 1643b may be the same network or networks, or different networks or networks. The communications subsystem 1631 may be configured to include one or more transceivers used to communicate with the network 1643b. For example, the communications subsystem 1631 may be configured to include one or more transceivers used to communicate with one or more remote transceivers of another device capable of wireless communication, such as another WD, UE, or base station of a radio access network (RAN), according to one or more communications protocols, such as IEEE 802.16, CDMA, WCDMA, GSM, LTE, UTRAN, WiMax, etc. Each transceiver may include a transmitter 1633 and / or a receiver 1635 to implement transmitter or receiver functionality, respectively, appropriate for the RAN link (e.g., frequency allocation, etc.). Furthermore, the transmitter 1633 and receiver 1635 of each transceiver may share circuit components, software or firmware, or may alternatively be implemented separately.

[0184] In the illustrated embodiment, the communication capabilities of the communication subsystem 1631 may include data communication, voice communication, multimedia communication, short-range communication such as Bluetooth, short-range communication, location-based communication such as determining location using a global positioning system (GPS), another similar communication capability, or any combination thereof. For example, the communication subsystem 1631 may include cellular communication, Wi-Fi communication, Bluetooth communication, and GPS communication. The network 1643b may encompass wired and / or wireless networks, such as a local area network (LAN), a wide area network (WAN), a computer network, a wireless network, a communications network, another similar network, or any combination thereof. For example, the network 1643b may be a cellular network, a Wi-Fi network, and / or a short-range network. The power supply 1613 may be configured to provide alternating current (AC) or direct current (DC) power to the components of the UE 1600.

[0185] The features, benefits, and / or functions described herein may be implemented in one of the components of the UE 1600 or split across multiple components of the UE 1600. Furthermore, the features, benefits, and / or functions described herein may be implemented in any combination of hardware, software, or firmware. In one example, the communication subsystem 1631 may be configured to include any of the components described herein. Furthermore, the processing circuit 1601 may be configured to communicate with any of such components over the bus 1602. In another example, any of such components may be represented by program instructions stored in memory that, when executed by the processing circuit 1601, perform the corresponding functions described herein. In another example, the functions of any of such components may be split between the processing circuit 1601 and the communication subsystem 1631. In another example, non-computationally intensive functions of any of such components may be implemented in software or firmware, and computationally intensive functions may be implemented in hardware.

[0186] 17 is a schematic block diagram illustrating a virtualization environment 1700 in which functionality implemented by some embodiments may be virtualized. In this context, virtualization means creating a virtual version of an apparatus or device, which may include a virtualized hardware platform, storage devices, and networking resources. Virtualization, as used herein, may apply to a node (e.g., a virtualized base station or a virtualized wireless access node) or device (e.g., a UE, a wireless device, or any other type of communication device) or component thereof, and relates to implementations in which at least a portion of functionality is implemented as one or more virtual components (e.g., via one or more applications, components, functions, virtual machines, or containers executing on one or more physical processing nodes in one or more networks).

[0187] In some embodiments, some or all of the functionality described herein may be implemented as virtual components executed by one or more virtual machines implemented in one or more virtual environments 1700 hosted by one or more of the hardware nodes 1730. Furthermore, in embodiments where the virtual node is not a wireless access node or does not require wireless connectivity (e.g., a core network node), the network node may be fully virtualized.

[0188] The functionality may be implemented by one or more applications 1720 (which may alternatively be referred to as software instances, virtual appliances, network functions, virtual nodes, virtual network functions, etc.) operable to implement some of the features, functions, and / or advantages of some embodiments disclosed herein. The applications 1720 are run in a virtualization environment 1700 that provides hardware 1730 comprising processing circuitry 1760 and memory 1790. The memory 1790 includes instructions 1795 executable by the processing circuitry 1760 such that the applications 1720 are operable to provide one or more of the features, advantages, and / or functions disclosed herein.

[0189] The virtualization environment 1700 may include a general-purpose or dedicated network hardware device (or node) 1730 comprising a set of one or more processors or processing circuitry 1760, which may be a commercial off-the-shelf (COTS) processor, a dedicated application-specific integrated circuit (ASIC), or any other type of processing circuitry, including digital or analog hardware components or dedicated processors. Each hardware device may comprise a memory 1790-1, which may be a non-persistent memory for temporarily storing instructions 1795 or software executed by the processing circuitry 1760. For example, the instructions 1795 may include program instructions (also referred to as a computer program product) that, when executed by the processing circuitry 1760, can configure the hardware node 1720 to perform operations corresponding to various example methods (e.g., procedures) described herein. Such operations may in turn be attributed to a virtual node 1720 hosted by the hardware node 1730.

[0190] Each hardware device may include one or more network interface controllers (NICs) 1770, also known as network interface cards, that include a physical network interface 1780. Each hardware device may also include a non-transitory, persistent, machine-readable storage medium 1790-2 having stored thereon software 1795 and / or instructions executable by the processing circuitry 1760. The software 1795 may include any type of software, including software for instantiating one or more virtualization layers 1750 (also referred to as hypervisors), software for running virtual machines 1740, and software that enables the functions, features, and / or benefits described in connection with some embodiments described herein to be implemented.

[0191] The virtual machines 1740 may comprise virtual processing, virtual memory, virtual networking or interfaces, and virtual storage, and may be run by a corresponding virtualization layer 1750 or hypervisor. Different embodiments of instances of virtual appliance 1720 may be implemented on one or more of the virtual machines 1740, and the implementation may be done in different ways.

[0192] In operation, the processing circuitry 1760 executes software 1795 to instantiate a hypervisor or virtualization layer 1750, sometimes referred to as a virtual machine monitor (VMM), which can present a virtual operating platform to the virtual machine 1740 that looks like networking hardware.

[0193] 17, hardware 1730 may be a standalone network node having general-purpose or specific components. Hardware 1730 may include antenna 17225 and may implement some functionality through virtualization. Alternatively, hardware 1730 may be part of a larger hardware fleet (e.g., in a data center or customer premises equipment (CPE)) where many hardware nodes work together and are managed through a management and orchestration (MANO) 17100 that oversees, among other things, the lifecycle management of application 1720.

[0194] Hardware virtualization is referred to in some contexts as network functions virtualization (NFV), which can be used to aggregate many network equipment types onto industry-standard high-volume server hardware, physical switches, and physical storage that can be located in data centers and customer premises equipment.

[0195] In the context of NFV, a virtual machine 1740 may be a software implementation of a physical machine that runs programs as if they were running on a physical, non-virtualized machine. Each virtual machine 1740 and the portion of the hardware 1730 on which it runs, whether it is hardware dedicated to that virtual machine and / or hardware that the virtual machine shares with other virtual machines 1740, forms a separate virtual network element (VNE).

[0196] Furthermore, in the context of NFV, a virtual network function (VNF) is responsible for handling a specific network function running in one or more virtual machines 1740 on top of the hardware networking infrastructure 1730 and corresponds to application 1720 in FIG. 17.

[0197] In some embodiments, one or more radio units 17200, each including one or more transmitters 17220 and one or more receivers 17210, may be coupled to one or more antennas 17225. The radio units 17200 may communicate directly with a hardware node 1730 via one or more appropriate network interfaces, or may be used in combination with a virtualization component to provide radio capabilities to a virtualization node, such as a radio access node or base station. A node configured in this manner may also communicate with one or more UEs, as described elsewhere herein.

[0198] In some embodiments, some signaling may be performed via a control system 17230, which may alternatively be used for communication between the hardware node 1730 and the radio unit 17200.

[0199] Additionally, the various network functions (NFs, e.g., UDM, AAnF, AUSF, etc.) described herein may be implemented and / or hosted using different variations of hardware 1730, including the variations described above.

[0200] 18 , according to one embodiment, a communication system includes a communication network 1810, such as a 3GPP-type cellular network, comprising an access network 1811, such as a wireless access network, and a core network 1814. The access network 1811 includes multiple base stations 1812a, 1812b, 1812c, such as NBs, eNBs, gNBs, or other types of wireless access points, each defining a corresponding coverage area 1813a, 1813b, 1813c. Each base station 1812a, 1812b, 1812c can be connected to the core network 1814 over a wired or wireless connection 1815. A first UE 1891 located within the coverage area 1813c can wirelessly connect to or be configured to be paged by the corresponding base station 1812c. A second UE 1892 within the coverage area 1813a can wirelessly connect to the corresponding base station 1812a. Although multiple UEs 1891, 1892 are shown in this example, embodiments of the present disclosure are equally applicable to situations where only a single UE is present within the coverage area or is connected.

[0201] The communications network 1810 itself is connected to a host computer 1830, which may be embodied in hardware and / or software of a standalone server, a cloud-implemented server, a distributed server, or as a processing resource in a server farm. The host computer 1830 may be owned or controlled by a service provider, or may be operated by or on behalf of the service provider. Connections 1821 and 1822 between the communications network 1810 and the host computer 1830 may extend directly from the core network 1814 to the host computer 1830 or may proceed via an optional intermediate network 1820. The intermediate network 1820 may be one of a public network, a private network, or a hosted network, or a combination of two or more of them; if present, the intermediate network 1820 may be a backbone network or the Internet; in particular, the intermediate network 1820 may comprise two or more subnetworks (not shown).

[0202] The communication system of FIG. 18 as a whole enables connectivity between connected UEs 1891, 1892 and a host computer 1830. This connectivity may be described as an over-the-top (OTT) connection 1850. The host computer 1830 and connected UEs 1891, 1892 are configured to communicate data and / or signaling via the OTT connection 1850, using the access network 1811, the core network 1814, any intermediate networks 1820, and possible further infrastructure (not shown) as intermediaries. The OTT connection 1850 may be transparent in the sense that the involved communication devices through which the OTT connection 1850 passes are unaware of the routing of the uplink and downlink communications. For example, the base station 1812 may not or need not be informed about the past routing of incoming downlink communications involving data originating from the host computer 1830 that is to be forwarded (e.g., handed over) to the connected UE 1891. Similarly, the base station 1812 does not need to be aware of the future routing of outgoing uplink communications originating from the UE 1891 and destined for the host computer 1830 .

[0203] An exemplary implementation of a UE, a base station, and a host computer according to one embodiment described in the previous paragraph will now be described with reference to FIG. 19. In the communication system 1900, the host computer 1910 comprises hardware 1915 including a communication interface 1916 configured to set up and maintain wired or wireless connections with interfaces of different communication devices of the communication system 1900. The host computer 1910 further comprises processing circuitry 1918, which may have storage and / or processing capabilities. In particular, the processing circuitry 1918 may comprise one or more programmable processors, application specific integrated circuits, field programmable gate arrays, or combinations thereof (not shown) adapted to execute instructions. The host computer 1910 further comprises software 1911, which is stored on or accessible by the host computer 1910 and executable by the processing circuitry 1918. The software 1911 includes a host application 1912. The host application 1912 may be operable to provide services to a remote user, such as the UE 1930, connecting via an OTT connection 1950 that terminates at the UE 1930 and the host computer 1910. In providing services to the remote user, the host application 1912 may provide user data that is transmitted using the OTT connection 1950.

[0204] The communications system 1900 may also include a base station 1920 provided within the communications system, the base station 1920 comprising hardware 1925 that enables the base station 1920 to communicate with the host computer 1910 and the UE 1930. The hardware 1925 may include a communications interface 1926 for setting up and maintaining wired or wireless connections with interfaces of different communications devices of the communications system 1900, and a wireless interface 1927 for setting up and maintaining at least a wireless connection 1970 with a UE 1930 located within a coverage area (not shown in FIG. 19 ) served by the base station 1920. The communications interface 1926 may be configured to facilitate a connection 1960 to the host computer 1910. The connection 1960 may be direct, or the connection 1960 may pass through a core network of the communications system (not shown in FIG. 19 ) and / or one or more intermediate networks external to the communications system. In the illustrated embodiment, the hardware 1925 of the base station 1920 may also include processing circuitry 1928, which may comprise one or more programmable processors, application specific integrated circuits, field programmable gate arrays, or combinations thereof (not shown), adapted to execute instructions.

[0205] Base station 1920 also includes software 1921 stored internally or accessible via an external connection. For example, software 1921 may include program instructions (also referred to as a computer program product) that, when executed by processing circuitry 1928, can configure base station 1920 to perform operations corresponding to various example methods (e.g., procedures) described herein.

[0206] The communications system 1900 may also include the previously mentioned UE 1930, whose hardware 1935 may include a wireless interface 1937 configured to set up and maintain a wireless connection 1970 with a base station serving a coverage area in which the UE 1930 is currently located. The hardware 1935 of the UE 1930 may also include processing circuitry 1938, which may comprise one or more programmable processors, application specific integrated circuits, field programmable gate arrays, or combinations thereof (not shown), adapted to execute instructions.

[0207] The UE 1930 also includes software 1931, which is stored on or accessible by the UE 1930 and executable by the processing circuitry 1938. The software 1931 includes a client application 1932. The client application 1932, with the support of the host computer 1910, may be operable to provide services to a human or non-human user via the UE 1930. An executing host application 1912 on the host computer 1910 can communicate with an executing client application 1932 via an OTT connection 1950 that terminates at the UE 1930 and the host computer 1910. In providing services to the user, the client application 1932 can receive request data from the host application 1912 and provide user data in response to the request data. The OTT connection 1950 can transfer both the request data and the user data. The client application 1932 can interact with the user to generate the user data that the client application 1932 provides. The software 1931 may also include program instructions (also referred to as a computer program product) that, when executed by the processing circuitry 1938, can configure the UE 1930 to perform operations corresponding to various example methods (e.g., procedures) described herein.

[0208] As an example, the host computer 1910, base station 1920, and UE 1930 shown in Figure 19 may be similar to or identical to the host computer 1830, one of the base stations 1812a-1812c, and one of the UEs 1891-1892, respectively, of Figure 18. That is, the internal workings of these entities may be as shown in Figure 19, and separately, the surrounding network topology may be as shown in Figure 18.

[0209] 19, the OTT connection 1950 is depicted abstractly to show communication between the host computer 1910 and the UE 1930 via the base station 1920, without explicit reference to intermediate devices and the exact routing of messages through those devices. The network infrastructure can determine the routing, and the network infrastructure can be configured to hide the routing from the UE 1930, or from the service provider operating the host computer 1910, or both. The network infrastructure can also decide to dynamically change the routing while the OTT connection 1950 is active (e.g., based on load balancing considerations or network reconfiguration).

[0210] The radio connection 1970 between the UE 1930 and the base station 1920 follows the teachings of embodiments described throughout this disclosure. One or more of the various embodiments improve the performance of the OTT service provided to the UE 1930 using the OTT connection 1950, of which the radio connection 1970 forms the final segment. More specifically, the example embodiments disclosed herein can improve the flexibility for a network to monitor the end-to-end quality of service (QoS) of data flows, including their corresponding radio bearers, associated with a data session between a user equipment (UE) and another entity, such as an OTT data application or service, external to the 5G network. These and other advantages can facilitate more timely design, implementation, and deployment of 5G / NR solutions. Furthermore, such embodiments can facilitate flexible and timely control of data session QoS, which may lead to improvements in capacity, throughput, latency, and the like, that are envisioned by 5G / NR and critical to the growth of OTT services.

[0211] Measurement procedures may be provided for the purpose of monitoring data rates, latency, and other aspects of network operation that one or more embodiments improve. There may further be optional network functionality for reconfiguring the OTT connection 1950 between the host computer 1910 and the UE 1930 in response to fluctuations in the measurement results. The measurement procedures and / or network functionality for reconfiguring the OTT connection 1950 may be implemented in the software 1911 and hardware 1915 of the host computer 1910, or in the software 1931 and hardware 1935 of the UE 1930, or both. In embodiments, sensors (not shown) may be deployed in or associated with communication devices through which the OTT connection 1950 passes, and the sensors may participate in the measurement procedures by providing values ​​of the monitored quantities exemplified above or by providing values ​​of other physical quantities from which the software 1911, 1931 can calculate or estimate the monitored quantities. The reconfiguration of the OTT connection 1950 may include message formats, retransmission settings, preferred routing, etc., and the reconfiguration need not affect the base station 1920, and the reconfiguration may be unknown or unrecognizable to the base station 1920. Such procedures and functions are known and may be practiced in the art. In particular embodiments, the measurements may involve proprietary UE signaling that facilitates the host computer 1910 measurements of throughput, propagation time, latency, etc. The measurements may be implemented in that the OTT connection 1950 is used to send messages, specifically empty or “dummy” messages, while the software 1911 and 1931 monitors propagation times, errors, etc.

[0212] FIG. 20 is a flow diagram illustrating an example method and / or procedure implemented in a communication system, according to one embodiment. The communication system includes a host computer, a base station, and a UE, which may be as described in some exemplary embodiments with reference to other figures herein. To simplify this disclosure, only drawing references to FIG. 20 are included in this section. In step 2010, the host computer provides user data. In sub-step 2011 of step 2010 (which may be optional), the host computer provides the user data by executing a host application. In step 2020, the host computer initiates a transmission carrying the user data to the UE. In step 2030 (which may be optional), the base station transmits the user data carried in the host computer-initiated transmission to the UE, in accordance with the teachings of embodiments described throughout this disclosure. In step 2040 (which may also be optional), the UE executes a client application associated with the host application executed by the host computer.

[0213] FIG. 21 is a flow diagram illustrating an example method and / or procedure implemented in a communication system, according to one embodiment. The communication system includes a host computer, a base station, and a UE, which may be as described with reference to other figures herein. To simplify this disclosure, only drawing references to FIG. 21 are included in this section. In step 2110 of the method, the host computer provides user data. In an optional sub-step (not shown), the host computer provides the user data by executing a host application. In step 2120, the host computer initiates a transmission carrying the user data to the UE. The transmission may be routed through a base station in accordance with the teachings of the embodiments described throughout this disclosure. In step 2130 (which may be optional), the UE receives the user data carried in the transmission.

[0214] FIG. 22 is a flow diagram illustrating an example method and / or procedure implemented in a communications system, according to one embodiment. The communications system includes a host computer, a base station, and a UE, which may be as described with reference to other figures herein. To simplify this disclosure, only drawing references to FIG. 22 are included in this section. In step 2210 (which may be optional), the UE receives input data provided by the host computer. Additionally or alternatively, in step 2220, the UE provides user data. In sub-step 2221 (which may be optional) of step 2220, the UE provides the user data by executing a client application. In sub-step 2211 (which may be optional) of step 2210, the UE executes a client application that provides user data in response to the received input data provided by the host computer. In providing the user data, the executed client application may further consider user input received from the user. Regardless of the particular manner in which the user data is provided, the UE initiates transmission of the user data to the host computer in sub-step 2230 (which may be optional). In method step 2240, the host computer receives user data transmitted from the UE in accordance with the teachings of the embodiments described throughout this disclosure.

[0215] Figure 23 is a flow diagram illustrating an example method and / or procedure implemented in a communication system, according to one embodiment. The communication system includes a host computer, a base station, and a UE, which may be as described with reference to other figures herein. For brevity of this disclosure, only drawing references to Figure 23 are included in this section. In step 2310 (which may be optional), the base station receives user data from the UE in accordance with the teachings of embodiments described throughout this disclosure. In step 2320 (which may be optional), the base station initiates transmission of the received user data to the host computer. In step 2330 (which may be optional), the host computer receives the user data carried in the transmission initiated by the base station.

[0216] As described herein, devices and / or apparatus may be represented by semiconductor chips, chipsets, or (hardware) modules comprising such chips or chipsets, but this does not exclude the possibility that the functionality of a device or apparatus may not be implemented in hardware but may be implemented as a software module, such as a computer program or computer program product including executable software code portions for execution or running on a processor. Furthermore, the functionality of a device or apparatus may be implemented by any combination of hardware and software. A device or apparatus may also be considered an assembly of multiple devices and / or apparatus, regardless of whether they cooperate with or are independent of each other functionally. Furthermore, devices and apparatus may be implemented in a distributed manner throughout a system, as long as the functionality of the device or apparatus is preserved. Such and similar principles are believed to be known to those skilled in the art.

[0217] Furthermore, functionality described herein as being performed by a wireless device or network node may be distributed across multiple wireless devices and / or network nodes. In other words, it is contemplated that the functionality of the network nodes and wireless devices described herein is not limited to being performed by a single physical device, but may in fact be distributed among several physical devices.

[0218] Unless otherwise specified, all terms used herein (including technical and scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs. It will be further understood that the terms used herein should be interpreted as having a meaning consistent with their meaning in the context of the present specification and related art, and should not be interpreted in an idealized or overly formal sense unless expressly so defined herein.

[0219] Additionally, certain terms used in this disclosure, including the specification, drawings, and exemplary embodiments thereof, may be used synonymously in certain instances, including, but not limited to, for example, data and information. It is understood that these and / or other words that may be synonymous with each other may be used synonymously herein, and that there may be instances where such words are not intended to be used synonymously. Furthermore, to the extent that prior art knowledge has not been expressly incorporated herein by reference above, that prior art knowledge is expressly incorporated herein in its entirety. All referenced publications are incorporated herein by reference in their entirety.

[0220] The foregoing merely illustrates the principles of the present disclosure. Various modifications and alternatives to the described embodiments will be apparent to those skilled in the art in light of the teachings herein. Accordingly, those skilled in the art will recognize that they can devise numerous systems, arrangements, and procedures that, although not explicitly shown or described herein, embody the principles of the present disclosure and thus may be within the spirit and scope of the present disclosure. As will be understood by those skilled in the art, the various exemplary embodiments can be used in combination with and interchangeably with each other.

[0221] Exemplary embodiments of the techniques and apparatus described herein include, but are not limited to, the following enumerated embodiments.

[0222] A1. A method for an Authentication Server Function (AUSF) in a communication network, comprising: receiving an authentication request from a user equipment (UE) including either a first identifier associated with the UE or a second identifier associated with the UE; When the authentication request includes a second identifier, the following security key identifier: a first security key identifier based on a first field of a first identifier obtained from a unified data management (UDM) of the communications network; or a second security key identifier that is not based on the first field of the first identifier determining one of A method comprising:

[0223] A2. When the authentication request includes a first identifier, the following actions are performed: determining a first security key identifier based on a first field included in the first identifier; sending a first field included in the first identifier to the UDM; The method of embodiment A1, further comprising performing:

[0224] A3. The second identifier is a 5G Global Unique Temporary Identifier (5G-GUTI); the first identifier is a Subscription Confidentiality Identifier (SUCI); a first field is a routing indicator (RID) associated with the UE's home network; the first security key identifier is an Authentication and Key Management for Application (AKMA) Key Identifier (A-KID); the second security key identifier is an AKMA Temporary UE Identifier (A-TID); The method of embodiment A1 or A2.

[0225] A4. Determining a first security key identifier based on a first field obtained from the UDM; determining a third identifier associated with the UE based on the second identifier; sending an authentication request to the UDM that includes the third identifier; receiving a first field from the UDM in a response to the authentication request; The method of any of embodiments A1 to A3, comprising:

[0226] A5. The method of embodiment A4, in which the authentication request includes an explicit request for the first field.

[0227] A6. The method of embodiment A4 or A5, wherein the third identifier is a subscription persistent identifier (SUPI).

[0228] A7. Anchor key for UE (K AKMA ) and Anchor Key (K AKMA ) and the determined security key identifier to an Anchor Function for Authentication and Key Management for Applications (AAnF) of the communication network; and The method of any of embodiments A1 to A7, further comprising:

[0229] A8. The method of embodiment A7, wherein the message includes an indication of whether the included security key identifier is a first security key identifier or a second security key identifier.

[0230] A9. The method of any of embodiments A1-A8, wherein determining the second security key identifier is further based on determining that the first field of the first identifier associated with the UE is unavailable to the AUSF.

[0231] B1. A method for Unified Data Management (UDM) of a communications network, comprising: receiving an authentication request for a user equipment (UE) from an authentication server function (AUSF) of a communication network, the authentication request including either a first identifier associated with the UE or a second identifier associated with the UE; When the authentication request includes a second identifier, obtaining a first field of the first identifier and sending the first field to the AUSF in a response to the authentication request; when the authentication request includes a first identifier, storing a first field included in the first identifier; A method comprising:

[0232] B2. Getting the first field Retrieving a stored version of the first field from the UE subscription data or from a previously successful authentication of the UE; or performing a deciphering operation on the second identifier to generate a first identifier including the first field; The method of embodiment B1, comprising one of:

[0233] B3. Sending the first field to AUSF An explicit request for the first field to be included in the authentication request, or The response to the authentication request must include an Authentication and Key Management for Application (AKMA) indicator. The method of embodiment B1 or B2, wherein the method is responsive to one of:

[0234] B4. The second identifier is a Subscription Persistent Identifier (SUPI), and the first identifier is a Subscription Confidentiality Identifier (SUCI); The first field is a routing indicator (RID) associated with the UE's home network; The method of any one of embodiments B1 to B3.

[0235] C1. A method for an Anchor Function for Authentication and Key Management (AAnF) for applications in a communication network, comprising: The authentication server function (AUSF) of the communication network sends an anchor key (K AKMA ) into the following security key identifier: a first security key identifier based on a first field of a first identifier associated with the UE; or A second security key identifier that is not based on the first field and receiving the signal with one of Anchor Key (K AKMA ) in association with the received security key identifier; A security key (K) associated with an application session between the AF and the UE is received from an application function (AF) associated with the communication network. AF receiving a request for a security key, wherein the request includes a third security key identifier associated with the UE; Based on a determination that the third security key identifier corresponds to the stored security key identifier, an anchor key (K AKMA ) based on the security key (K AF ) and A method comprising:

[0236] C2. Derived security key (K AF The method of embodiment C1, further comprising sending a notification to the AF.

[0237] C3. The second identifier is a Subscription Persistent Identifier (SUPI); the first identifier is a Subscription Confidentiality Identifier (SUCI); a first field is a routing indicator (RID) associated with the UE's home network; the first security key identifier is an Authentication and Key Management for Application (AKMA) Key Identifier (A-KID); the second security key identifier is an AKMA Temporary UE Identifier (A-TID); The method of embodiment C1 or C2.

[0238] C4. Anchor Key (K AKMA ) is stored in association with the second security key identifier, determining that the third security key identifier corresponds to the stored security key identifier; determining a fourth security key identifier from the received third security key identifier; determining a match between the fourth security key identifier and the second security key identifier; The method of any of embodiments C1 to C3, further comprising:

[0239] C5. The third security key identifier is an Authentication and Key Management for Application (AKMA) Key Identifier (A-KID); and the fourth security key identifier is an AKMA Temporary UE Identifier (A-TID); The method of embodiment C4.

[0240] D1. An Authentication Server Function (AUSF) of a communications network, comprising: an interface circuit configured to communicate with a user equipment (UE) and to communicate with an anchor function (AAnF) for authentication and key management for applications of the communication network and an integrated data management function (UDM); a processing circuit operably coupled to the interface circuit; whereby the processing circuitry and the interface circuitry are configured to perform operations corresponding to the method described in any of embodiments A1 to A9.

[0241] D2. An authentication server function (AUSF) of a communications network, the authentication server function (AUSF) configured to perform operations corresponding to the method described in any one of embodiments A1-A9.

[0242] D3. A non-transitory computer-readable medium storing computer-executable instructions that, when executed by processing circuitry associated with an Authentication Server Function (AUSF) of a communications network, configure the AUSF to perform operations corresponding to the method described in any of embodiments A1-A9.

[0243] D4. A computer program product comprising computer-executable instructions that, when executed by processing circuitry associated with an Authentication Server Function (AUSF) of a communications network, configure the AUSF to perform operations corresponding to the method described in any of embodiments A1-A9.

[0244] E1. A communications network Unified Data Management (UDM) function, comprising: an interface circuit configured to communicate with an Authentication Server Function (AUSF) of the communications network; a processing circuit operably coupled to the interface circuit; whereby the processing circuitry and the interface circuitry are configured to perform operations corresponding to the method of any of embodiments B1 to B4.

[0245] E2. A unified data management function (UDM) of a communications network, the unified data management function (UDM) configured to perform operations corresponding to the method described in any one of embodiments B1-B4.

[0246] E3. A non-transitory computer-readable medium storing computer-executable instructions that, when executed by processing circuitry associated with a unified data management function (UDM) of a communications network, configure the UDM to perform operations corresponding to the method described in any of embodiments B1 to B4.

[0247] E4. A computer program product comprising computer-executable instructions that, when executed by processing circuitry associated with a unified data management function (UDM) of a communications network, configure the UDM to perform operations corresponding to the method described in any of embodiments B1-B4.

[0248] F1. An anchor function for authentication and key management (AAnF) for applications in a communications network, comprising: an interface circuit configured to communicate with a user equipment (UE) and to communicate with an authentication server function (AUSF) of a communications network; a processing circuit operably coupled to the interface circuit; An anchor function (AAnF) for authentication and key management for an application, comprising: a processing circuit and an interface circuit configured to perform operations corresponding to the method described in any of embodiments C1 to C5.

[0249] F2. An anchor function (AAnF) for authentication and key management for applications in a communications network, configured to perform operations corresponding to the method described in any of embodiments C1 to C5.

[0250] F3. A non-transitory computer-readable medium storing computer-executable instructions that, when executed by processing circuitry associated with an anchor function (AAnF) for authentication and key management for applications in a communications network, configure the AAnF to perform operations corresponding to the method described in any of embodiments C1 to C5.

[0251] F4. A computer program product comprising computer-executable instructions that, when executed by processing circuitry associated with an anchor function (AAnF) for authentication and key management for applications in a communications network, configure the AAnF to perform operations corresponding to the method described in any of embodiments C1 to C5.

Claims

1. 1. A method performed by an Authentication Server Function (AUSF) of a communication network, comprising: sending a second authentication request including a second identifier of the user equipment (UE); receiving a response to the second authentication request; determining an Authentication and Key Management (AKMA) Key Identifier for an Application (AKMA) based on a Routing Indicator (RID) associated with the AKMA indicator and included in the response when the response includes an AKMA indicator indicating to the AUSF that an A-KID should be generated; Including, the RID is further associated with a home network of the UE; The method, wherein the second identifier is a Subscription Persistent Identifier (SUPI).

2. deriving an anchor key for the UE; sending a message including the anchor key and the A-KID to an Anchor Function for Authentication and Key Management for Applications (AAnF); The method of claim 1 further comprising:

3. The method of claim 2 , wherein the message further includes the second identifier.

4. The method of claim 1 , wherein the second authentication request is sent to a Unified Data Manager (UDM) of the communication network, and the response to the second authentication request is received from the UDM.

5. sending the second authentication request to the UDM, the second authentication request including the second identifier; receiving the response from the UDM in response to the second authentication request, the response including the RID; further comprising The method of claim 4 , wherein the response includes the AKMA indicator and the RID.

6. 1. A method performed by a Unified Data Manager (UDM) of a communications network, comprising: receiving an authentication request for a user equipment (UE) from an authentication server function (AUSF) of the communication network, the authentication request including a second identifier of the UE; obtaining an Authentication and Key Management (AKMA) indicator for an Application, indicating to the AUSF that an AKMA key identifier (A-KID) should be generated, and a routing indicator (RID) associated with the AKMA indicator; sending the AKMA indicator and the RID to the AUSF in response to the authentication request; Including, The method, wherein the RID is further associated with a home network of the UE, and the second identifier is a Subscription Persistent Identifier (SUPI).

7. obtaining the RID, 7. The method of claim 6, comprising retrieving a stored version of the RID from UE subscription data or from a previous successful authentication of the UE.

8. An Authentication Server Function (AUSF) of a communication network, comprising: an interface circuit configured to communicate with a user equipment (UE) and to communicate with an anchor function for authentication and key management (AAnF) and a unified data management function (UDM) for applications of said communication network; a processing circuit operably coupled to the interface circuit; whereby said processing circuitry and interface circuitry are configured to perform operations corresponding to the method of any one of claims 1 to 5.

9. An Authentication Server Function (AUSF) of a communications network, the Authentication Server Function (AUSF) being configured to perform operations corresponding to the method according to any one of claims 1 to 5.

10. 6. A non-transitory computer-readable medium storing computer-executable instructions that, when executed by processing circuitry associated with an Authentication Server Function (AUSF) of a communications network, configures the AUSF to perform operations corresponding to the method of any one of claims 1 to 5.

11. A computer program comprising instructions which, when said program is executed by a computer, cause said computer to carry out the steps of the method according to any one of claims 1 to 5.

12. 1. A Unified Data Management Function (UDM) for a communications network, comprising: an interface circuit configured to communicate with an Authentication Server Function (AUSF) of said communications network; a processing circuit operably coupled to the interface circuit; whereby said processing circuitry and interface circuitry are configured to perform operations corresponding to the method of claim 6 or 7.

13. A Unified Data Management Function (UDM) of a communications network, configured to perform operations corresponding to the method of claim 6 or 7.

14. 8. A non-transitory computer-readable medium storing computer-executable instructions that, when executed by processing circuitry associated with a Unified Data Manager (UDM) of a communications network, configures the UDM to perform operations corresponding to the method of claim 6 or 7.

15. A computer program comprising instructions, which when said program is executed by a computer, cause said computer to carry out the steps of the method according to claim 6 or 7.

Images