Efficient primary authentication method

Abstract

One disclosure of the present specification provides a method by which at least one NF performs communication. The method comprises steps in which: a first event related to primary authentication is detected; a batch timer is driven on the basis of the detection of the first event; a second event related to the primary authentication is detected before the batch timer expires; it is determined, on the basis of the first event and the second event, that a UDM of the at least one NF triggers the primary authentication after the batch timer expires; the UDM transmits an authentication notification to an AMF on the basis of the determination; and the primary authentication is performed on the basis of the transmission of the authentication notification, wherein the first event is based on the expiration of the validity time of a first AKMA application key managed by an AAnF of the at least one NF.

Description

Efficient first-factor authentication method

[0001] This specification relates to mobile communications.

[0002] 3GPP (3rd Generation Partnership Project) LTE (Long-Term Evolution) is a technology designed to enable high-speed packet communications. Numerous approaches have been proposed to achieve LTE's goals of reducing costs for users and operators, improving service quality, expanding coverage, and increasing system capacity. 3GPP LTE's high-level requirements include reduced cost per bit, improved service availability, flexible use of frequency bands, a simple architecture, open interfaces, and adequate power consumption for terminals.

[0003] The International Telecommunication Union (ITU) and 3GPP have begun work on developing requirements and specifications for new radio (NR) systems. 3GPP must identify and develop the technical components necessary to successfully standardize NR in a timely manner, meeting both urgent market needs and the longer-term requirements outlined by the ITU-R (ITU radio communication sector) International Mobile Telecommunications (IMT)-2020 process. NR must also be able to utilize any spectrum band up to at least 100 GHz, ensuring that it remains available for wireless communications well into the future.

[0004] NR aims to be a single technology framework that addresses all deployment scenarios, usage scenarios, and requirements, including enhanced mobile broadband (eMBB), massive machine type communications (mMTC), and ultra-reliable and low latency communications (URLLC). NR must be inherently forward-compatible.

[0005] A method is required to prevent repetitive primary authentication.

[0006] When an event that triggers primary authentication occurs, the primary authentication trigger is suspended for a certain period of time after the event occurs, allowing for all events occurring during that period to be managed at once.

[0007] Figure 1 illustrates an example of a communication system to which the implementation of this specification is applied.

[0008] Figure 2 illustrates an example of a wireless device to which the implementation of the present specification is applied.

[0009] Figure 3 shows an example of a UE to which the implementation of this specification is applied.

[0010] Figure 4 is a structural diagram of a next-generation mobile communications network.

[0011] Figure 5 shows an example of a 5G system structure to which the implementation of this specification is applied.

[0012] Figure 6 shows an example of the start of primary authentication.

[0013] Figure 7 illustrates an example of a primary authentication procedure triggered by a home network.

[0014] Figure 8 shows an example of an AKMA key hierarchy.

[0015] Fig. 9 is K AKMA From K AF Shows an example of creation.

[0016] Figure 10 illustrates an example of a 5G system architecture involving multiple AFs.

[0017] Figures 11 and 12 illustrate examples of UDM-based solutions according to embodiments of the present disclosure.

[0018] Figure 13 illustrates an example of primary authentication and batching in chronological order according to an embodiment of the present specification.

[0019] Figures 14 and 15 illustrate examples of AAnF-based solutions according to embodiments of the present disclosure.

[0020] Figure 16 illustrates the procedure of at least one NF for the disclosure of the present specification.

[0021] The following techniques, devices, and systems can be applied to various wireless multiple access systems. Examples of multiple access systems include code division multiple access (CDMA) systems, frequency division multiple access (FDMA) systems, time division multiple access (TDMA) systems, orthogonal frequency division multiple access (OFDMA) systems, single carrier frequency division multiple access (SC-FDMA) systems, and multicarrier frequency division multiple access (MC-FDMA) systems. CDMA can be implemented via wireless technologies such as universal terrestrial radio access (UTRA) or CDMA2000. TDMA can be implemented via wireless technologies such as global system for mobile communications (GSM), general packet radio service (GPRS), or enhanced data rates for GSM evolution (EDGE). OFDMA can be implemented using wireless technologies such as IEEE (Institute of Electrical and Electronics Engineers) 802.11 (Wi-Fi), IEEE 802.16 (WiMAX), IEEE 802.20, or E-UTRA (evolved UTRA). UTRA is part of UMTS (universal mobile telecommunications system). 3GPP (3rd generation partnership project) LTE (long-term evolution) is part of E-UMTS (evolved UMTS) that uses E-UTRA.3GPP LTE uses OFDMA in the downlink (DL) and SC-FDMA in the uplink (UL). Evolution of 3GPP LTE includes LTE-A (advanced), LTE-A Pro, and / or 5G NR (new radio).

[0022] For convenience of explanation, the implementation of this specification is primarily described in relation to a 3GPP-based wireless communication system. However, the technical features of this specification are not limited thereto. For example, the following detailed description is provided based on a mobile communication system corresponding to a 3GPP-based wireless communication system. However, aspects of this specification that are not limited to a 3GPP-based wireless communication system can be applied to other mobile communication systems.

[0023] For terms and technologies used in this specification that are not specifically described, reference may be made to wireless communication standard documents published prior to this specification.

[0024] As used herein, "A or B" can mean "only A," "only B," or "both A and B." Alternatively, as used herein, "A or B" can be interpreted as "A and / or B." For example, as used herein, "A, B or C" can mean "only A," "only B," "only C," or "any combination of A, B and C."

[0025] As used herein, a slash ( / ) or a comma can mean "and / or." For example, "A / B" can mean "A and / or B." Accordingly, "A / B" can mean "only A," "only B," or "both A and B." For example, "A, B, C" can mean "A, B, or C."

[0026] In this specification, “at least one of A and B” may mean “only A,” “only B,” or “both A and B.” Additionally, in this specification, the expressions “at least one of A or B” or “at least one of A and / or B” may be interpreted identically to “at least one of A and B.”

[0027] Additionally, in this specification, “at least one of A, B and C” can mean “only A”, “only B”, “only C”, or “any combination of A, B and C”. Additionally, “at least one of A, B or C” or “at least one of A, B and / or C” can mean “at least one of A, B and C”.

[0028] Additionally, parentheses used herein may mean "for example." Specifically, when indicated as "control information (PDCCH)", "PDCCH" may be proposed as an example of "control information." In other words, "control information" in this specification is not limited to "PDCCH," and "PDCCH" may be proposed as an example of "control information." Furthermore, even when indicated as "control information (i.e., PDCCH)", "PDCCH" may be proposed as an example of "control information."

[0029] Technical features individually described in a single drawing in this specification may be implemented individually or simultaneously.

[0030] Although not limited thereto, the various descriptions, functions, procedures, proposals, methods and / or operational flowcharts disclosed herein may be applied to various fields requiring wireless communication and / or connectivity between devices (e.g., 5G).

[0031] Hereinafter, the present specification will be described in more detail with reference to the drawings. In the following drawings and / or description, the same reference numbers may refer to the same or corresponding hardware blocks, software blocks, and / or functional blocks, unless otherwise indicated.

[0032] Figure 1 illustrates an example of a communication system to which the implementation of this specification is applied.

[0033] The 5G usage scenario shown in FIG. 1 is only an example, and the technical features of this specification can be applied to other 5G usage scenarios not shown in FIG. 1.

[0034] The three main requirement categories for 5G are (1) enhanced mobile broadband (eMBB), (2) massive machine type communication (mMTC), and (3) ultra-reliable and low latency communications (URLLC).

[0035] Referring to FIG. 1, a communication system (1) includes wireless devices (100a to 100f), a base station (BS; 200), and a network (300). FIG. 1 illustrates a 5G network as an example of a network of the communication system (1), but the implementation of the present disclosure is not limited to a 5G system and can be applied to future communication systems beyond the 5G system.

[0036] The base station (200) and the network (300) may be implemented as wireless devices, and a particular wireless device may operate as a base station / network node in relation to other wireless devices.

[0037] Wireless devices (100a to 100f) refer to devices that perform communication using radio access technology (RAT) (e.g., 5G NR or LTE) and may also be referred to as communication / wireless / 5G devices. Wireless devices (100a to 100f) may include, but are not limited to, robots (100a), vehicles (100b-1 and 100b-2), extended reality (XR) devices (100c), portable devices (100d), home appliances (100e), IoT devices (100f), and artificial intelligence (AI) devices / servers (400). For example, vehicles may include vehicles having wireless communication capabilities, autonomous vehicles, and vehicles capable of performing vehicle-to-vehicle communication. Vehicles may include unmanned aerial vehicles (UAVs) (e.g., drones). XR devices may include AR / VR / mixed reality (MR) devices, and may be implemented in the form of head-mounted devices (HMDs) and heads-up displays (HUDs) mounted on vehicles, televisions, smartphones, computers, wearable devices, home appliances, digital signs, vehicles, robots, etc. Portable devices may include smartphones, smart pads, wearable devices (e.g., smart watches or smart glasses), and computers (e.g., laptops). Home appliances may include TVs, refrigerators, and washing machines. IoT devices may include sensors and smart meters.

[0038] In this specification, wireless devices (100a to 100f) may be referred to as user equipment (UE). The UE may include, for example, a mobile phone, a smartphone, a laptop computer, a digital broadcasting terminal, a personal digital assistant (PDA), a portable multimedia player (PMP), a navigation system, a slate PC, a tablet PC, an ultrabook, a vehicle, a vehicle with autonomous driving functions, a connected car, a UAV, an AI module, a robot, an AR device, a VR device, an MR device, a holographic device, a public safety device, an MTC device, an IoT device, a medical device, a fintech device (or a financial device), a security device, a weather / environmental device, a 5G service-related device, or a 4th industrial revolution-related device.

[0039] For example, a UAV may be an aircraft that is unmanned and navigated by radio control signals.

[0040] For example, a VR device may include a device for implementing objects or backgrounds in a virtual environment. For example, an AR device may include a device that implements objects or backgrounds in a virtual world by connecting them to objects or backgrounds in the real world. For example, an MR device may include a device that implements objects or backgrounds in a virtual world by merging them with objects or backgrounds in the real world. For example, a holographic device may include a device that implements 360-degree stereoscopic images by recording and reproducing three-dimensional information using the light interference phenomenon that occurs when two laser lights, called holograms, meet.

[0041] For example, a public safety device may include an image relay device or imaging device that can be worn on the user's body.

[0042] For example, MTC devices and IoT devices may be devices that do not require direct human intervention or manipulation. Examples include smart meters, vending machines, thermometers, smart light bulbs, door locks, or various sensors.

[0043] For example, a medical device may be a device used for the purpose of diagnosing, treating, mitigating, curing, or preventing a disease. For example, a medical device may be a device used for the purpose of diagnosing, treating, mitigating, or correcting an injury or damage. For example, a medical device may be a device used for the purpose of examining, replacing, or modifying a structure or function. For example, a medical device may be a device used for the purpose of regulating pregnancy. For example, a medical device may include a therapeutic device, a driving device, an (in vitro) diagnostic device, a hearing aid, or a surgical device.

[0044] For example, a security device may be a device installed to prevent potential hazards and maintain safety. For example, a security device may be a camera, closed-circuit television (CCTV), recorder, or black box.

[0045] For example, a fintech device may be a device capable of providing financial services, such as mobile payments. For example, a fintech device may include a payment device or a point-of-sale system.

[0046] For example, a weather / environment device may include a device that monitors or predicts the weather / environment.

[0047] Wireless devices (100a to 100f) can be connected to a network (300) via a base station (200). AI technology can be applied to the wireless devices (100a to 100f), and the wireless devices (100a to 100f) can be connected to an AI server (400) via the network (300). The network (300) can be configured using a 3G network, a 4G (e.g., LTE) network, a 5G (e.g., NR) network, and a network after 5G. The wireless devices (100a to 100f) can communicate with each other via the base station (200) / network (300), but can also communicate directly (e.g., sidelink communication) without going through the base station (200) / network (300). For example, vehicles (100b-1, 100b-2) can communicate directly (e.g., vehicle-to-vehicle (V2V) / vehicle-to-everything (V2X) communication). Additionally, IoT devices (e.g., sensors) can communicate directly with other IoT devices (e.g., sensors) or other wireless devices (100a to 100f).

[0048] Wireless communication / connection (150a, 150b, 150c) can be established between wireless devices (100a to 100f) and / or between wireless devices (100a to 100f) and a base station (200) and / or between base stations (200). Here, the wireless communication / connection can be established through various RATs (e.g., 5G NR), such as uplink / downlink communication (150a), sidelink communication (150b) (or, device-to-device (D2D) communication), and base station-to-base station communication (150c) (e.g., relay, integrated access and backhaul (IAB)). Through the wireless communication / connection (150a, 150b, 150c), the wireless devices (100a to 100f) and the base station (200) can transmit / receive wireless signals to / from each other. For example, wireless communication / connection (150a, 150b, 150c) can transmit / receive signals through various physical channels. To this end, at least some of the various configuration information setting processes for transmitting / receiving wireless signals, various signal processing processes (e.g., channel encoding / decoding, modulation / demodulation, resource mapping / demapping, etc.), and resource allocation processes can be performed based on various proposals of the present specification.

[0049] AI is the study of artificial intelligence or the methodologies for creating it, while machine learning (ML) defines various problems in the field of AI and studies the methodologies for solving them. Machine learning is also defined as an algorithm that improves performance on a task through consistent experience.

[0050] A robot can be defined as a machine that automatically processes or operates a given task based on its own capabilities. Specifically, a robot capable of perceiving its environment, making decisions, and performing actions on its own can be called an intelligent robot. Robots can be categorized into industrial, medical, household, and military applications based on their intended use or field. Robots are equipped with a drive unit, including an actuator or motor, enabling them to perform various physical actions, such as moving robot joints. Furthermore, mobile robots include wheels, brakes, and propellers in their drive unit, enabling them to drive on the ground or fly in the air.

[0051] Autonomous driving refers to the technology of driving on one's own, while autonomous vehicles refer to vehicles that drive without, or with minimal, user intervention. For example, autonomous driving can include technologies such as lane keeping, automatic speed control like adaptive cruise control, autonomous driving along a set route, and autonomous driving based on a set destination. Vehicles encompass all types of vehicles: those with internal combustion engines, hybrid vehicles with both internal combustion engines and electric motors, and electric vehicles with only electric motors. These vehicles can include not only cars but also trains and motorcycles. Autonomous vehicles can be viewed as robots with autonomous driving capabilities.

[0052] Extended reality is a general term for VR, AR, and MR. VR technology provides real-world objects and backgrounds as CG images only, AR technology provides virtual CG images over images of real objects, and MR technology is a CG technology that mixes and combines virtual objects with the real world. MR technology is similar to AR in that it displays real and virtual objects together. However, there is a difference: while AR uses virtual objects to complement real objects, MR uses virtual and real objects equally.

[0053] NR supports multiple numerologies, or subcarrier spacing (SCS), to support diverse 5G services. For example, an SCS of 15 kHz supports wide areas in traditional cellular bands; an SCS of 30 kHz / 60 kHz supports dense urban areas, lower latency, and wider carrier bandwidth; and an SCS of 60 kHz or higher supports bandwidths greater than 24.25 GHz to overcome phase noise.

[0054] The NR frequency band can be defined by two types of frequency ranges (FR1 and FR2). The numerical values ​​of the frequency ranges can be changed. For example, the two types of frequency ranges (FR1 and FR2) can be as shown in Table 1 below. For convenience of explanation, among the frequency ranges used in NR systems, FR1 can mean the "sub-6GHz range," and FR2 can mean the "above 6GHz range," which can be referred to as millimeter wave (mmW).

[0055] Frequency Range DefinitionFrequency RangeSubcarrier SpacingFR1450MHz - 6000MHz15, 30, 60kHzFR224250MHz - 52600MHz60, 120, 240kHz

[0056] As described above, the numerical value of the frequency range of the NR system can be changed. For example, FR1 may include a band from 410 MHz to 7125 MHz, as shown in Table 2 below. That is, FR1 may include frequency bands above 6 GHz (or 5850, 5900, 5925 MHz, etc.). For example, the frequency bands above 6 GHz (or 5850, 5900, 5925 MHz, etc.) included within FR1 may include unlicensed bands. Unlicensed bands can be used for various purposes, such as for communications for vehicles (e.g., autonomous driving).

[0057] Frequency Range DefinitionFrequency RangeSubcarrier SpacingFR1410MHz - 7125MHz15, 30, 60kHzFR224250MHz - 52600MHz60, 120, 240kHz

[0058] Here, the wireless communication technology implemented in the wireless device of the present specification may include not only LTE, NR, and 6G, but also narrowband IoT (NB-IoT) for low-power communication. For example, NB-IoT technology may be an example of LPWAN (low power wide area network) technology and may be implemented with standards such as LTE Cat NB1 and / or LTE Cat NB2, and is not limited to the above-described names. Additionally or alternatively, the wireless communication technology implemented in the wireless device of the present specification may perform communication based on LTE-M technology. For example, LTE-M technology may be an example of LPWAN technology and may be called by various names such as eMTC (enhanced MTC). For example, LTE-M technology can be implemented by at least one of various standards such as 1) LTE CAT 0, 2) LTE Cat M1, 3) LTE Cat M2, 4) LTE non-BL (non-bandwidth limited), 5) LTE-MTC, 6) LTE MTC, and / or 7) LTE M, and is not limited to the above-described names. Additionally or alternatively, the wireless communication technology implemented in the wireless device of the present specification can include at least one of ZigBee, Bluetooth, and / or LPWAN considering low-power communication, and is not limited to the above-described names. For example, ZigBee technology can create PAN (personal area networks) related to small / low-power digital communication based on various standards such as IEEE 802.15.4, and can be called by various names.

[0059] Figure 2 illustrates an example of a wireless device to which the implementation of the present specification is applied.

[0060] In FIG. 2, the first wireless device (100) and / or the second wireless device (200) may be implemented in various forms depending on the use case / service. For example, {the first wireless device (100) and the second wireless device (200)} may correspond to at least one of {the wireless devices (100a to 100f) and the base station (200)}, {the wireless devices (100a to 100f) and the wireless devices (100a to 100f)}, and / or {the base station (200) and the base station (200)} of FIG. 1. The first wireless device (100) and / or the second wireless device (200) may be configured by various components, devices / parts, and / or modules.

[0061] The first wireless device (100) may include at least one transceiver, such as a transceiver (106), at least one processing chip, such as a processing chip (101), and / or one or more antennas (108).

[0062] The processing chip (101) may include at least one processor, such as a processor (102), and at least one memory, such as a memory (104). Additionally and / or alternatively, the memory (104) may be located external to the processing chip (101).

[0063] The processor (102) may control the memory (104) and / or the transceiver (106) and may be configured to implement the descriptions, functions, procedures, proposals, methods, and / or operational flowcharts disclosed herein. For example, the processor (102) may process information in the memory (104) to generate first information / signal and transmit a wireless signal including the first information / signal via the transceiver (106). The processor (102) may receive a wireless signal including second information / signal via the transceiver (106) and store information obtained by processing the second information / signal in the memory (104).

[0064] A memory (104) may be operatively connected to the processor (102). The memory (104) may store various types of information and / or instructions. The memory (104) may store firmware and / or software code (105) that implements code, instructions and / or sets of instructions that, when executed by the processor (102), perform the descriptions, functions, procedures, suggestions, methods and / or operational flowcharts disclosed herein. For example, the firmware and / or software code (105) may implement instructions that, when executed by the processor (102), perform the descriptions, functions, procedures, suggestions, methods and / or operational flowcharts disclosed herein. For example, the firmware and / or software code (105) may control the processor (102) to perform one or more protocols. For example, the firmware and / or software code (105) may control the processor (102) to perform one or more air interface protocol layers.

[0065] Here, the processor (102) and memory (104) may be part of a communication modem / circuit / chip designed to implement a RAT (e.g., LTE or NR). A transceiver (106) may be connected to the processor (102) and may transmit and / or receive wireless signals via one or more antennas (108). Each transceiver (106) may include a transmitter and / or a receiver. The transceiver (106) may be used interchangeably with an RF (radio frequency) unit. In the present specification, the first wireless device (100) may represent a communication modem / circuit / chip.

[0066] The second wireless device (200) may include at least one transceiver, such as a transceiver (206), at least one processing chip, such as a processing chip (201), and / or one or more antennas (208).

[0067] The processing chip (201) may include at least one processor, such as a processor (202), and at least one memory, such as a memory (204). Additionally and / or alternatively, the memory (204) may be located external to the processing chip (201).

[0068] The processor (202) may control the memory (204) and / or the transceiver (206) and may be configured to implement the descriptions, functions, procedures, proposals, methods and / or operational flowcharts disclosed herein. For example, the processor (202) may process information in the memory (204) to generate third information / signal and transmit a wireless signal including the third information / signal via the transceiver (206). The processor (202) may receive a wireless signal including fourth information / signal via the transceiver (206) and store information obtained by processing the fourth information / signal in the memory (204).

[0069] A memory (204) may be operatively connected to the processor (202). The memory (204) may store various types of information and / or instructions. The memory (204) may store firmware and / or software code (205) that implements instruction codes, commands and / or sets of instructions that, when executed by the processor (202), perform the descriptions, functions, procedures, suggestions, methods and / or operational flowcharts disclosed herein. For example, the firmware and / or software code (205) may implement instructions that, when executed by the processor (202), perform the descriptions, functions, procedures, suggestions, methods and / or operational flowcharts disclosed herein. For example, the firmware and / or software code (205) may control the processor (202) to perform one or more protocols. For example, the firmware and / or software code (205) may control the processor (202) to perform one or more air interface protocol layers.

[0070] Here, the processor (202) and memory (204) may be part of a communication modem / circuit / chip designed to implement a RAT (e.g., LTE or NR). A transceiver (206) may be connected to the processor (202) and may transmit and / or receive wireless signals via one or more antennas (208). Each transceiver (206) may include a transmitter and / or a receiver. The transceiver (206) may be used interchangeably with the RF unit. In the present specification, the second wireless device (200) may represent a communication modem / circuit / chip.

[0071] Hereinafter, hardware elements of the wireless device (100, 200) will be described in more detail. Although not limited thereto, one or more protocol layers may be implemented by one or more processors (102, 202). For example, one or more processors (102, 202) may implement one or more layers (e.g., functional layers such as a physical (PHY) layer, a media access control (MAC) layer, a radio link control (RLC) layer, a packet data convergence protocol (PDCP) layer, a radio resource control (RRC) layer, and a service data adaptation protocol (SDAP) layer). One or more processors (102, 202) may generate one or more protocol data units (PDUs), one or more service data units (SDUs), messages, control information, data, or information according to the descriptions, functions, procedures, proposals, methods, and / or operational flowcharts disclosed herein. One or more processors (102, 202) can generate signals (e.g., baseband signals) including PDUs, SDUs, messages, control information, data or information according to the descriptions, functions, procedures, proposals, methods and / or operational flowcharts disclosed herein and provide the signals to one or more transceivers (106, 206). One or more processors (102, 202) can receive signals (e.g., baseband signals) from one or more transceivers (106, 206) and obtain PDUs, SDUs, messages, control information, data or information according to the descriptions, functions, procedures, proposals, methods and / or operational flowcharts disclosed herein.

[0072] The one or more processors (102, 202) may be referred to as a controller, a microcontroller, a microprocessor, and / or a microcomputer. The one or more processors (102, 202) may be implemented by hardware, firmware, software, and / or a combination thereof. For example, one or more application specific integrated circuits (ASICs), one or more digital signal processors (DSPs), one or more digital signal processing devices (DSPDs), one or more programmable logic devices (PLDs), and / or one or more field programmable gate arrays (FPGAs) may be included in the one or more processors (102, 202). For example, the one or more processors (102, 202) may be configured by a set of a communication control processor, an application processor (AP), an electronic control unit (ECU), a central processing unit (CPU), a graphic processing unit (GPU), and a memory control processor.

[0073] One or more memories (104, 204) may be coupled to one or more processors (102, 202) and may store various forms of data, signals, messages, information, programs, codes, instructions, and / or commands. The one or more memories (104, 204) may be configured as random access memory (RAM), dynamic RAM (DRAM), read-only memory (ROM), erasable programmable ROM (EPROM), flash memory, volatile memory, nonvolatile memory, hard drive, register, cache memory, computer-readable storage media, and / or combinations thereof. The one or more memories (104, 204) may be located internally and / or externally to the one or more processors (102, 202). Additionally, the one or more memories (104, 204) may be coupled to the one or more processors (102, 202) via various technologies, such as wired or wireless connections.

[0074] One or more transceivers (106, 206) can transmit user data, control information, wireless signals / channels, etc., referred to in the descriptions, functions, procedures, proposals, methods, and / or flowcharts disclosed herein to one or more other devices. One or more transceivers (106, 206) can receive user data, control information, wireless signals / channels, etc., referred to in the descriptions, functions, procedures, proposals, methods, and / or flowcharts disclosed herein from one or more other devices. For example, one or more transceivers (106, 206) can be coupled to one or more processors (102, 202) and can transmit and receive wireless signals. For example, one or more processors (102, 202) can control one or more transceivers (106, 206) to transmit user data, control information, wireless signals, etc., to one or more other devices. Additionally, one or more processors (102, 202) may control one or more transceivers (106, 206) to receive user data, control information, wireless signals, etc. from one or more other devices.

[0075] One or more transceivers (106, 206) may be coupled to one or more antennas (108, 208). Additionally and / or alternatively, one or more transceivers (106, 206) may include one or more antennas (108, 208). One or more transceivers (106, 206) may be configured to transmit and receive user data, control information, wireless signals / channels, etc., as described in the descriptions, functions, procedures, proposals, methods and / or operational flowcharts disclosed herein via one or more antennas (108, 208). In the present specification, one or more antennas (108, 208) may be multiple physical antennas or multiple logical antennas (e.g., antenna ports).

[0076] One or more transceivers (106, 206) may convert received user data, control information, wireless signals / channels, etc. from RF band signals to baseband signals in order to process the received user data, control information, wireless signals / channels, etc. using one or more processors (102, 202). One or more transceivers (106, 206) may convert processed user data, control information, wireless signals / channels, etc. from baseband signals to RF band signals using one or more processors (102, 202). For this purpose, one or more transceivers (106, 206) may include an (analog) oscillator and / or a filter. For example, one or more transceivers (106, 206) may up-convert an OFDM baseband signal to an OFDM signal via an (analog) oscillator and / or filter under the control of one or more processors (102, 202) and transmit the up-converted OFDM signal at a carrier frequency. One or more transceivers (106, 206) may receive an OFDM signal at a carrier frequency and down-convert the OFDM signal to an OFDM baseband signal via an (analog) oscillator and / or filter under the control of one or more processors (102, 202).

[0077] Although not illustrated in FIG. 2, the wireless device (100, 200) may further include additional components. The additional components (140) may be configured in various ways depending on the type of the wireless device (100, 200). For example, the additional components (140) may include at least one of a power unit / battery, an input / output (I / O) device (e.g., an audio I / O port, a video I / O port), a driving device, and a computing device. The additional components (140) may be connected to one or more processors (102, 202) via various technologies, such as a wired or wireless connection.

[0078] In the implementation of the present specification, a UE can operate as a transmitter in the uplink (UL) and as a receiver in the downlink (DL). In the implementation of the present specification, a base station can operate as a receiver in the UL and as a transmitter in the DL. For the sake of convenience of description, it is mainly assumed below that the first wireless device (100) operates as a UE and the second wireless device (200) operates as a base station. For example, a processor (102) connected to, mounted on, or released in the first wireless device (100) can be configured to perform UE operations according to the implementation of the present specification or to control a transceiver (106) to perform UE operations according to the implementation of the present specification. A processor (202) connected to, mounted on, or released in the second wireless device (200) can be configured to perform base station operations according to the implementation of the present specification or to control a transceiver (206) to perform base station operations according to the implementation of the present specification.

[0079] In this specification, a base station may be referred to as a Node B, an eNode B (eNB), or a gNB.

[0080] Figure 3 shows an example of a UE to which the implementation of this specification is applied.

[0081] Figure 3 shows an example of a UE to which the implementation of this specification is applied.

[0082] Referring to FIG. 3, the UE (100) can correspond to the first wireless device (100) of FIG. 2.

[0083] The UE (100) includes a processor (102), memory (104), a transceiver (106), one or more antennas (108), a power management module (141), a battery (142), a display (143), a keypad (144), a SIM (Subscriber Identification Module) card (145), a speaker (146), and a microphone (147).

[0084] The processor (102) may be configured to implement the descriptions, functions, procedures, proposals, methods and / or flowcharts disclosed herein. The processor (102) may be configured to control one or more other components of the UE (100) to implement the descriptions, functions, procedures, proposals, methods and / or flowcharts disclosed herein. A layer of a radio interface protocol may be implemented in the processor (102). The processor (102) may include an ASIC, other chipsets, logic circuits and / or data processing devices. The processor (102) may be an application processor. The processor (102) may include at least one of a DSP, a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), and a modem (modulator and demodulator). An example of the processor (102) is the SNAPDRAGON manufactured by Qualcomm®. TM Series processors, EXYNOS made by Samsung® TM Series processors, A-series processors made by Apple®, HELIO made by MediaTek® TM ATOM series processors made by Intel® TM It can be found in the series processors or the corresponding next-generation processors.

[0085] Memory (104) is operatively coupled to the processor (102) and stores various information for operating the processor (102). Memory (104) may include ROM, RAM, flash memory, memory cards, storage media, and / or other storage devices. When the implementation is implemented in software, the techniques described herein may be implemented using modules (e.g., procedures, functions, etc.) that perform the descriptions, functions, procedures, suggestions, methods, and / or operational flowcharts disclosed herein. The modules may be stored in memory (104) and executed by the processor (102). Memory (104) may be implemented within the processor (102) or external to the processor (102), in which case it may be communicatively coupled to the processor (102) via various methods known in the art.

[0086] A transceiver (106) is operably coupled to the processor (102) and transmits and / or receives a radio signal. The transceiver (106) includes a transmitter and a receiver. The transceiver (106) may include a baseband circuit for processing a radio frequency signal. The transceiver (106) controls one or more antennas (108) to transmit and / or receive a radio signal.

[0087] The power management module (141) manages the power of the processor (102) and / or the transceiver (106). The battery (142) supplies power to the power management module (141).

[0088] The display (143) outputs the results processed by the processor (102). The keypad (144) receives input to be used by the processor (102). The keypad (144) can be displayed on the display (143).

[0089] A SIM card (145) is an integrated circuit that securely stores an International Mobile Subscriber Identity (IMSI) and associated keys, and is used to identify and authenticate subscribers in mobile devices such as mobile phones and computers. Additionally, many SIM cards can store contact information.

[0090] The speaker (146) outputs sound-related results processed by the processor (102). The microphone (147) receives sound-related input to be used by the processor (102).

[0091] Figure 4 is a structural diagram of a next-generation mobile communications network.

[0092] 5GC (5G Core) may include various components, and in FIG. 5, some of them include AMF (Access and Mobility Management Function) (410), SMF (Session Management Function) (420), PCF (Policy Control Function) (430), UPF (User Plane Function) (440), AF (Application Function) (450), UDM (Unified Data Management) (460), and N3IWF (Non-3GPP (3rd Generation Partnership Project) Inter Working Function) (490).

[0093] The UE (100) is connected to a data network via UPF (440) through a Next Generation Radio Access Network (NG-RAN) including a gNB (20).

[0094] The UE (100) can also receive data services via untrusted non-3GPP access, such as a Wireless Local Area Network (WLAN). To connect the non-3GPP access to the core network, an N3IWF (490) may be deployed.

[0095] The illustrated N3IWF (490) performs the function of managing interworking between non-3GPP access and 5G system. When UE (100) is connected to non-3GPP access (e.g., WiFi, referred to as IEEE 801.11), UE (100) can be connected to 5G system through N3IWF (490). N3IWF (490) performs control signaling with AMF (410) and is connected to UPF (440) through N3 interface for data transmission.

[0096] The illustrated AMF (410) can manage access and mobility in a 5G system. The AMF (410) can perform functions to manage Non-Access Stratum (NAS) security. The AMF (410) can perform functions to handle mobility in the idle state.

[0097] The illustrated UPF (440) is a type of gateway through which user data is transmitted and received. The UPF node (440) can perform all or part of the user plane functions of the S-GW (Serving Gateway) and P-GW (Packet Data Network Gateway) of 4th generation mobile communications.

[0098] The UPF (440) acts as a boundary point between the next generation radio access network (NG-RAN) and the core network, and is an element that maintains a data path between the gNB (20) and the SMF (420). In addition, when the UE (100) moves across the area served by the gNB (20), the UPF (440) acts as a mobility anchor point. The UPF (440) can perform a function of handling PDUs. For mobility within the NG-RAN (Next Generation-Radio Access Network defined after 3GPP Release-15), the UPF can route packets. Additionally, the UPF (440) may also function as an anchor point for mobility with other 3GPP networks (RANs defined before 3GPP Release-15, e.g., UTRAN, E-UTRAN (Evolved-UMTS (Universal Mobile Telecommunications System) Terrestrial Radio Access Network)) or GERAN (GSM (Global System for Mobile Communication) / EDGE (Enhanced Data rates for Global Evolution) Radio Access Network). The UPF (440) may correspond to a termination point of a data interface toward a data network.

[0099] The illustrated PCF (430) is a node that controls the business operator's policy.

[0100] The illustrated AF (450) is a server for providing various services to the UE (100).

[0101] The illustrated UDM (460) is a type of server that manages subscriber information, such as the HSS (Home Subscriber Server) of 4th generation mobile communications. The UDM (460) stores and manages the subscriber information in a Unified Data Repository (UDR).

[0102] The illustrated SMF (420) can perform the function of allocating an IP (Internet Protocol) address of the UE. In addition, the SMF (420) can control a PDU (protocol data unit) session.

[0103] For reference, the drawing symbols for AMF (410), SMF (420), PCF (430), UPF (440), AF (450), UDM (460), N3IWF (490), gNB (20), or UE (100) may be omitted below.

[0104] 5G mobile communications support multiple numerologies, or subcarrier spacing (SCS), to support diverse 5G services. For example, a 15 kHz SCS supports wide areas in traditional cellular bands. A 30 kHz / 60 kHz SCS supports dense urban environments, lower latency, and wider carrier bandwidth. An SCS of 60 kHz or higher supports bandwidths greater than 24.25 GHz to overcome phase noise.

[0105] Figure 5 shows an example of a 5G system structure to which the implementation of this specification is applied.

[0106] The 5G system (5GS; 5G system) structure consists of the following network functions (NF; Network Function).

[0107] - AUSF (Authentication Server Function)

[0108] - AMF (Access and Mobility Management Function)

[0109] - DN (Data Network), 예를 들어 운영자 서비스, 인터넷 접속 또는 타사 서비스

[0110] - USDF (Unstructured Data Storage Function)

[0111] - NEF (Network Exposure Function)

[0112] - I-NEF (Intermediate NEF)

[0113] - NRF (Network Repository Function)

[0114] - NSSF (Network Slice Selection Function)

[0115] - PCF (Policy Control Function)

[0116] - SMF (Session Management Function)

[0117] - UDM (Unified Data Management)

[0118] - UDR (Unified Data Repository)

[0119] - UPF (User Plane Function)

[0120] - UCMF (UE radio Capability Management Function)

[0121] - AF (Application Function)

[0122] - UE (User Equipment)

[0123] - (R)AN ((Radio) Access Network)

[0124] - 5G-EIR (5G-Equipment Identity Register)

[0125] - NWDAF (Network Data Analytics Function)

[0126] - CHF (CHarging Function)

[0127] Additionally, the following network features may be considered:

[0128] - N3IWF (Non-3GPP InterWorking Function)

[0129] - TNGF (Trusted Non-3GPP Gateway Function)

[0130] - W-AGF (Wireline Access Gateway Function)

[0131] Figure 5 illustrates the 5G system architecture for a non-roaming case using a reference point representation showing how various network functions interact with each other.

[0132] In Figure 5, for clarity of the point-to-point diagram, UDSF, NEF, and NRF are not illustrated. However, all network functions shown can interact with UDSF, UDR, NEF, and NRF as needed.

[0133] For clarity, the connection between UDR and other NFs (e.g., PCF) is not shown in Fig. 4. For clarity, the connection between NWDAF and other NFs (e.g., PCF) is not shown in Fig. 4.

[0134] The 5G system architecture includes the following benchmarks:

[0135] - N1: Reference point between UE and AMF.

[0136] - N2: Reference point between (R)AN and AMF.

[0137] - N3: Reference point between (R)AN and UPF.

[0138] - N4: Reference point between SMF and UPF.

[0139] - N6: Reference point between UPF and data network.

[0140] - N9: Reference point between two UPFs.

[0141] The following benchmarks illustrate the interactions that exist between NF services in NF.

[0142] - N5: Reference point between PCF and AF.

[0143] - N7: Reference point between SMF and PCF.

[0144] - N8: Reference point between UDM and AMF.

[0145] - N10: Reference point between UDM and SMF.

[0146] - N11: Reference point between AMF and SMF.

[0147] - N12: Reference point between AMF and AUSF.

[0148] - N13: Reference point between UDM and AUSF.

[0149] - N14: Reference point between two AMFs.

[0150] - N15: Reference point between PCF and AMF for non-roaming scenarios, and reference point between PCF and AMF of visited network for roaming scenarios.

[0151] - N16: Reference point between two SMFs (in case of roaming, between the SMF of the visited network and the SMF of the home network)

[0152] - N22: Reference point between AMF and NSSF.

[0153] In some cases, two NFs may need to be interconnected to serve a UE.

[0154] <Primary Authentication>

[0155] The purpose of the primary authentication and key agreement procedure may be to enable mutual authentication between the UE and the network and to provide key material that can be used between the UE and the serving network in subsequent security procedures. The key material generated by the primary authentication and key agreement procedure may be an anchor key, K, provided by the AUSF of the home network to the SEAF of the serving network. SEAF can be created.

[0156] Keys for one or more security contexts can be used without the need to run a new authentication. SEAF As a concrete example, authentication running over a 3GPP access network may provide keys that establish security between a UE and an N3IWF used for untrusted non-3GPP access.

[0157] Anchor Key K SEAF is K AUSF It is derived from an intermediate key called K AUSF can be established between UE and HN as a result of the first authentication procedure. K AUSF may be securely stored in the AUSF, depending on the home operator's policy for the use of that key, for example, in the control plane solution for Steering of Roaming or UE parameter update procedures, or if AKMA is supported by the HPLMN.

[0158] Figure 6 shows an example of the start of primary authentication.

[0159] SEAF may initiate authentication with the UE during any procedure for establishing a signaling connection with the UE, depending on SEAF policy. The UE may be required to use SUCI or 5G-GUTI for registration requests.

[0160] SEAF may need to call the Nausf_UEAuthentication service by sending a Nausf_UEAuthentication_Authenticate request message to AUSF whenever SEAF wants to initiate authentication.

[0161] The Nausf_UEAuthentication_Authenticate request message may contain one of the following:

[0162] - SUCI, or

[0163] - SUPI

[0164] If SEAF re-authenticates a UE with a valid 5G-GUTI, it may include SUPI in the Nausf_UEAuthentication_Authenticate request message. Otherwise, SUCI is included in the Nausf_UEAuthentication_Authenticate request. The SUPI / SUCI structure may be part of the three-step protocol design.

[0165] The Nausf_UEAuthentication_Authenticate request may additionally include:

[0166] - Defined service network name.

[0167] The Nausf_UEAuthentication_Authenticate request may additionally include:

[0168] - Displays defined disaster roaming services.

[0169] Upon receiving a Nausf_UEAuthentication_Authenticate request message, the AUSF may compare the serving network name with the expected serving network name to determine if the SEAF requesting the serving network is authorized to use the serving network name in the Nausf_UEAuthentication_Authenticate request. The AUSF may need to temporarily store the received serving network name. If the serving network is not authorized to use the serving network name, the AUSF may respond with "Unauthorized Serving Network" in the Nausf_UEAuthentication_Authenticate response.

[0170] In case of disaster roaming, AUSF checks the local configuration and if allowed, AUSF can send Nudm_UEAuthentication_Get request to UDM.

[0171] The Nudm_UEAuthentication_Get request sent from AUSF to UDM may contain the following information:

[0172] - SUCI or SUPI;

[0173] - Service providing network name

[0174] - Indicates Disaster Roaming Service when received from SEAF;

[0175] Upon receiving a Nudm_UEAuthentication_Get request, the UDM may need to call SIDF when the SUCI is received. SIDF may need to unhide the SUCI to obtain the SUPI before the UDM can process the request.

[0176] Based on SUPI, UDM / ARPF may need to select an authentication method.

[0177] Note 3: The Nudm_UEAuthentication_Get response, which is a response to the Nudm_UEAuthentication_Get request, and the Nausf_UEAuthentication_Authenticate response message, which is a response to the Nausf_UEAuthentication_Authenticate request message, can be described as part of the authentication procedure of FIG. 7.

[0178] In case of disaster roaming, UDM checks the local configuration and if allowed, UDM can proceed with the selected authentication method.

[0179] Figure 7 illustrates an example of a primary authentication procedure triggered by a home network.

[0180] Support for home network triggered authentication may be optional for both HN and SN. If both networks (HN and SN) support home network triggered primary authentication, the following may apply.

[0181] UDM can initiate primary authentication based on a procedure initiated by the UE (e.g. UE registration in 5GC) or a procedure directed towards the UE (e.g. SoR / UPU) or an event from another NF, taking into account local policies as well.

[0182] 0a.[Optional] UDM can be pre-configured with operator authentication policies to determine when to trigger the primary authentication procedure.

[0183] 0b. The UE can register with the network. As part of the registration, the serving AMF may register the UE with the UDM via Nudm_UECM_Registration. The UDM may need to create an implicit subscription to the serving AMF to notify the AMF of potential re-authentication later.

[0184] 1. A prerequisite for initiating the home network trigger primary authentication may be that the UDM already has information about the AMF serving the UE. Otherwise, the UDM may not be able to connect to the AMF in subsequent steps.

[0185] The UDM can make its own decisions based on events (e.g., SoR / UPU or AAnF requests) or authentication policies and perform home network-triggered primary authentication as described in the following steps. AAnF may consider sending a Nudm_UECM_AuthTrigger request to the UDM for primary authentication using the UDM service based on certain factors.

[0186] Based on the received events and local operator authentication policy, if there is no primary authentication in progress for the UE and the UDM decides to trigger primary authentication, the UDM can determine the serving AMF / SEAF of the target UE.

[0187] If different AMFs are registered with the UDM for different accesses and support defined procedures, the UDM may need to select one AMF to perform reauthentication. The AMF selection criteria may vary depending on the local UDM authentication policy.

[0188] Note 1: The reasons why the UDM determines that a UE must be authenticated may vary. For example, the UDM may decide to initiate primary authentication when the AMF registers the UE during the registration procedure during mobility from the EPC, when the SoR / UPU counter is about to wrap around, when required based on authentication policies, or at the request of the AAnF. The UDM behavior may be determined by operator policy considering the support of specific features of the PLMN. For example, if the PLMN does not support the SoR / UPU feature, SoR / UPU counter wraparound will not occur, and primary authentication may not be required in this case.

[0189] 2. UDM can send a notification message to AMF / SEAF along with the UE's SUPI.

[0190] 3. After receiving the notification message from the UDM, the AMF / SEAF may decide whether to initiate the primary authentication procedure based on its own local authentication policy and may decide to initiate the primary authentication procedure based on the UE state (e.g., if the UE is in handover, if some steps similar to the network-triggered service request can be reused, or if the UE was already being authenticated by the AMF before receiving the authentication notification from the UDM). If the AMF / SEAF cannot perform the primary authentication as described in step 4, the AMF / SEAF may send an authentication response message with the cause of the failure to the UDM, otherwise it may approve the request. If the AMF / SEAF approves the request but cannot initiate the primary authentication for the UE (e.g., if the UE is unreachable), the AMF / SEAF may set an authentication pending flag in the UE context.

[0191] When the UE reconnects to the same AMF or becomes available, the AMF checks the authentication pending flag and performs re-authentication if necessary. Upon completion of UE re-authentication, the AMF can reset the authentication pending flag. For example, in a mobility scenario, when a UE connects to a new AMF, the new AMF can retrieve the UE context from the previous AMF, check if authentication is pending for the UE, and then perform re-authentication. If a failure is received from the AMF, the UDM can check if another AMF is available through another connection. If available, the UDM can select another AMF and send the authentication request.

[0192] 4. AMF / SEAF may initiate the primary certification process as defined.

[0193] UDM may execute other procedures (e.g. SoR / UPU) depending on what triggered the (re)authentication procedure in step 1.

[0194] Figure 8 shows an example of an AKMA key hierarchy.

[0195] A key hierarchy may contain the following keys: K AUSF , K AKMA , K AF. K AUSF

[0196] K AUSF can be generated by AUSF as specified in section 6.1 of TS 33.501 v18.2.0.

[0197] K AUSF can be generated through successful 5G primary certification.

[0198] The key for AAnF is K AKMA It could be.

[0199] K AKMA ME (Mobile Equipment) and AUSF are K AUSFIt may be a key derived from. The ME may be a device (or terminal) capable of performing a communication protocol function.

[0200] The key for AF is K AF It could be.

[0201] K AF ME and AAnF are K AKMA It may be a key derived from .

[0202] Figure 9 is K AKMA From K AF Shows an example of creation.

[0203] Figure 9 illustrates the procedure for an AF to request an application function-specific AKMA key from an AAnF when the AF is inside the operator's network.

[0204] Before initiating communication between a UE and an AKMA AF, the UE and the AKMA AF may need to know whether AKMA is being used. This may be implicit in specific applications of the UE and the AKMA AF, or the AKMA AF may notify the UE.

[0205] 1. Before starting communication with AKMA application function, UE must AUSF From AKMA anchor key (K AKMA ) and A-KID may need to be generated. When the UE initiates communication with the AKMA AF, it may include the derived A-KID in the Application Session Establishment Request message. The UE may send the K-KID before or after the message. AF You can get it.

[0206] 2. If there is no active context associated with A-KID in AF, AF selects AAnF and sends Naanf_AKMA_ApplicationKey_Get request including A-KID to AAnF to get KID for UE. AFcan request. AF can also include its identity (AF_ID) in the request.

[0207] AF_ID may consist of the AF's FQDN and the Ua* security protocol identifier. The latter parameter may identify the security protocol that the AF will use for the UE.

[0208] AAnF can determine whether it can provide services to AF based on configured local policies or available authentication information (e.g., OAuth2.0 tokens) in signaling. If successful, the next step can be executed. Otherwise, AAnF can reject the process.

[0209] AAnF is a UE specific K identified by A-KID. AKMA Based on the presence of the key, it can be verified whether the subscriber is authorized to use AKMA.

[0210] K AKMA If exists in AAnF, AAnF can proceed to step 3.

[0211] K AKMA If it does not exist in AAnF, AAnF can continue to step 4 with an error response.

[0212] 3. After receiving the request from the AF, if the AAnF determines that this particular AF requires GPSI based on its local policy, the AAnF can send a Nudm_SDM_Get request to the UDM to retrieve the GPSI of the UE. If the particular AF does not require GPSI, the AAnF can proceed to step 5.

[0213] 4. The UDM may respond with the UE's GPSI. The AAnF may store the received GPSI as part of the UE's AKMA context.

[0214] 5. AAnF is still K AF If there is no K AKMAFrom AKMA Application Key (K AF ) can be obtained.

[0215] 6. AAnF is SUPI, K AF and K AF You can send a Naanf_AKMA_ApplicationKey_Get response to AF with an expiration time.

[0216] AAnF may decide whether to transmit SUPI or GPSI based on local policy.

[0217] 7. The AF may send an Application Session Establishment Response to the UE. If the information in step 4 indicates that the AKMA key request failed, the AF may reject the Application Session Establishment request, including the reason for the failure. The UE may then trigger a new Application Session Establishment request to the AKMA AF using the latest A-KID.

[0218] Home network triggered authentication is a technology currently under discussion. Home network triggered authentication re-performs primary authentication between the terminal and the network, as needed, after the primary authentication between the terminal and the network.

[0219] Home network triggered authentication may be performed to prevent the maximum number of counters for Steering of Roaming (SOR) or UE Parameter Update (UPU) from being exceeded (counter wrap-around). For example, home network triggered authentication may be performed to prevent SoR counter wrap-around.

[0220] Home network triggered authentication may be performed due to the terminal registration procedure that occurs during mobility from EPS to 5GS of the terminal.

[0221] K in Authentication and Key Management for Applications (AKMA) AF When the key validity period expires, home network triggered authentication can be performed.

[0222] Home network triggered authentication is caused by SoR counter wrap around, UPU counter wrap around, UE mobility-induced terminal registration procedure and / or K AF May include expiration of validity period.

[0223] K AF can be a key for AF.

[0224] The 5G system's security root key may be newly generated when the primary authentication is re-performed. Therefore, a new K in the SoR, UPU counter, or AKMA that is dependent on the root key may be generated. AKMA It is expected that security will be improved as it is newly formed.

[0225] AKMA can support application session services using 5GS security keys.

[0226] K generated upon successful first authentication of the terminal AUSF Based on this, the network (AUSF) and the terminal can use the root key K to generate future application security keys. AKMA can be created.

[0227] At this time K AKMA An A-KID that can refer to can also be created.

[0228] K generated from AUSF AKMA can be passed on to AAnF.

[0229] Meanwhile, the terminal is K AKMA From K AF can be created in advance. The terminal can request the AF to create an application session including the A-KID.

[0230] Then, AF can verify the A-KID included in the creation request for the application session and confirm the existence of a corresponding security context.

[0231] If a corresponding security context does not exist, AF sends a new K to AAnF. AF You can request the creation of a new K. Then, AAnF will create a new K AF to K AKMA It can be generated based on the above new K AFThe expiration time can be set. AAnF responds to the above request by sending the new K AF New K set with AF The expiration time can be transmitted to AF.

[0232] The connection between the above two technologies is when Home Network Triggered Authentication is performed due to the expiration of AKMA's KAF validity period.

[0233] If multiple AFs are deployed to support AKMA within a 5G system, multiple K AF can be generated at similar times. In this case, as time passes, the above multiple K for one terminal AF As the expiration dates are similar, AAnF can perform multiple recertification requests with UDM.

[0234] If multiple reauthentication requests are made within a short period of time, repeated primary authentication may occur. This repeated primary authentication can lead to inefficiencies.

[0235] Additionally, if the number of terminals managed by a UDM is large, frequent first-pass authentication can overload the UDM or AMF, potentially impacting terminal services.

[0236] To address these issues, this specification proposes a method for efficiently processing multiple primary authentication requests (re-authentication requests). As the proposed method is implemented, the load on the UDM and AMF can be reduced.

[0237] To efficiently perform primary authentication, a method may be proposed in UDM or AAnF to collect multiple primary authentication requests (re-authentication requests) in batches over a certain period of time and process them all at once.

[0238] In this specification, a method may be proposed in which UDM or AAnF uses a batch timer to collect multiple primary authentication requests (re-authentication requests) of AAnF for a certain period of time and process them at once.

[0239] In response to AAnF re-authentication requests, a method is proposed to collect and process primary authentication requests from terminals and networks over a certain period of time using a batch timer in UDM or AAnF.

[0240] Figure 10 illustrates an example of a 5G system architecture involving multiple AFs.

[0241] Figure 10 shows an example of a 5G system structure that can use multiple AFs for a terminal capable of AKMA service.

[0242] Within a 5G system, AAnF can act as an anchoring node for AF #1, AF #2, AF #3, AF #4, and AF #5.

[0243] AF #5 in Figure 10 may be deployed outside the 5GS network via NEF.

[0244] The terminal can create separate sessions with all AFs. Each of the multiple sessions has a K associated with it. AF can be generated. That is, multiple K AF can be generated. Multiple K generated AF can be managed by AAnF.

[0245] UDM-based solutions and AAnF-based solutions are described below.

[0246] 1. First Example

[0247] Figures 11 and 12 illustrate examples of UDM-based solutions according to embodiments of the present disclosure.

[0248] Figures 11 and 12 illustrate a procedure for Home Network Triggered Authentication for processing multiple requests in a UDM-based solution.

[0249] The operations described in FIGS. 6 to 9 may have already been performed before the procedures shown in FIGS. 11 and 12 are performed.

[0250] For example, the following actions may have been performed before the procedures shown in FIGS. 11 and 12 were performed:

[0251] - The terminal can perform AAnF and primary authentication. The terminal is K AUSF From A-KID and AKMA anchor keys (K AKMA ) can be created.

[0252] - The terminal can send an application session establishment request message to the AF.

[0253] - Based on the application session establishment request message from the terminal, AF can send a request for AKMA application key (Naanf_AKMA_ApplicationKey_Get Request) to AAnF.

[0254] - Based on the above request, AAnF will issue an AKMA application key (K AF ) can be obtained.

[0255] - AAnF is K to AF AF and K AF It can transmit information about the validity period.

[0256] - AF can send a response to a session establishment request message to the terminal.

[0257] - Additional K described later AF The above process can be performed repeatedly for .

[0258] UDM can collect and process primary authentication requests from terminals and networks over a certain period of time using a batch timer.

[0259] 0. The operator's operational policy regarding the circumstances under which primary authentication will be performed can be preset in the UDM. The batch timer time value can also be set at this time.

[0260] 1. A specific K managed by AAnF (AKMA Anchor Function) AF When the validity period expires, AAnF can send an authentication trigger request containing SUPI to UDM to refresh the key.

[0261] For example, the UDM may detect a first event based on receiving the authentication trigger request. The first event may be a specific K AF The validity period may have expired. Based on the first event above, the UDM may perform the second step operation (batch timer operation) described below.

[0262] If the UDM determines that the received request is valid, it can send an authentication trigger response including the result to the AAnF.

[0263] The above result may include information about when the refresh will be performed.

[0264] For example, the above result (Result) may include information indicating that the refresh will not be performed immediately but after a scheduled time, and information about the scheduled time.

[0265] K AFInstead of waiting for the validity period to expire and then sending the authentication trigger request, AAnF sends a K AF An authentication trigger request can be sent to the UDM before the validity period expires, which can ensure service continuity for the application.

[0266] The authentication trigger request may include information regarding when the refresh should be performed. For example, if the KAF has 5 minutes remaining until its expiration date, the authentication trigger request may include information indicating that the key must be refreshed within 5 minutes.

[0267] Conventionally, upon receiving the authentication trigger request, the UDM performed the 5-step operation (the operation for determining whether to trigger primary authentication) described below. However, according to the first embodiment, even if the UDM receives the authentication trigger request, the UDM may not immediately perform the 5-step operation (the operation for determining whether to trigger primary authentication). That is, the UDM may postpone performing the 5-step operation (the operation for determining whether to trigger primary authentication) for the duration of the batch timer described below.

[0268] 2. UDM can start a batch timer.

[0269] UDM can start / run batch timers based on authentication trigger requests received.

[0270] Taking into account the values ​​preset in step 0 and / or the information included in the authentication trigger request (information about when the refresh should be performed), the UDM can start the batch timer by setting the batch timer time.

[0271] The time of the above batch timer may be based on a value preset in step 0.

[0272] Alternatively, the batch timer time may be based on information included in the authentication trigger request (information regarding when the refresh should be performed). For example, if AAnF issues a request that includes information indicating that the refresh should be performed within 5 minutes, the batch timer time may be set to 4 minutes.

[0273] 3. The above specific K AF and other K AF If the validity period of K has expired, AAnF may additionally perform the actions described in step 1. If the validity period of K has expired, AF If there are multiple , the above-described step 1 operation may be repeated multiple times.

[0274] For example, another K AF When the validity period of the AAnF expires, the AAnF may send an additional authentication trigger request to the UDM. The UDM may detect a second event based on the receipt of the additional authentication trigger request. The second event may be the other K AF The validity period may have expired.

[0275] 4. When the time of the set batch timer has passed from the time when the UDM started the batch timer in step 2, the batch timer can be stopped.

[0276] For example, the batch timer may stop after the amount of time set in step 0 has elapsed.

[0277] For example, if in step 1, AAnF makes a request containing information about when it should be refreshed (e.g., 5 minutes), and UDM takes this into account and starts the batch timer by setting the time of the batch timer (e.g., 4 minutes), the batch timer can be stopped when that time elapses.

[0278] 5. Based on the received requests and / or local policies (the operator's local policies set in step 0), UDM can decide whether to trigger primary authentication.

[0279] That is, for multiple trigger requests received before the batch timer expires, UDM can only determine whether to trigger primary authentication once. This prevents repetitive primary authentication.

[0280] Based on the local policy (the operator's local policy set in step 0), the UDM can decide whether to trigger primary authentication for re-authentication requests received during the batch timer.

[0281] Based on the multiple requests received by the UDM (the request in step 1 and the request in step 3), the UDM can decide whether to trigger the first authentication.

[0282] For example, if even one of the multiple requests received by the UDM (the request in step 1 and the request in step 3) matches the trigger cause according to the policy (e.g., the local policy set in step 0), the UDM may decide to perform the first authentication.

[0283] For example, the first detected event (a specific K AF Expiration of validity period) and / or second event (other K AFBased on the expiration of the validity period, UDM can decide whether to trigger primary authentication.

[0284] The above-mentioned content in step 1 of Fig. 7 may be applied.

[0285] 6. UDM can send an Authentication Notification containing SUPI information to AMF (or SEAF).

[0286] The above-mentioned content in step 2 of Fig. 7 can be applied.

[0287] 7. The AMF can determine whether to perform primary authentication by considering various circumstances, such as the UE state. The AMF can transmit an authentication response containing information on whether to perform the above-determined authentication to the UDM.

[0288] The above-mentioned content in step 3 of Fig. 7 can be applied.

[0289] 8. AMF may initiate primary authentication.

[0290] The operations described in Figure 6 can be performed for primary authentication.

[0291] The above-mentioned content in step 4 of Fig. 7 can be applied.

[0292] Once the first authentication is performed, the multiple K AF can be refreshed.

[0293] Once the first authentication is performed, the multiple K AF The root key K AKMA can be refreshed.

[0294] Even if the first authentication is performed, the K that was already in use in the previously created application session AF may not be refreshed immediately. When the terminal attempts to create a new application session, a new K AFis generated and can be used as a security key. At this time, K AF can be refreshed.

[0295] Figure 13 illustrates an example of primary authentication and batching in chronological order according to an embodiment of the present specification.

[0296] As shown in Fig. 13, multiple requests due to various factors that can initiate home network triggered authentication can be made by waiting for the time of the batch timer and then the first authentication procedure can be performed.

[0297] When UDM receives the first authentication request (KAF #1 Expiration), UDM can start the batch timer.

[0298] Home network triggered authentication can occur multiple times before the batch timer expires.

[0299] Home network triggered authentication is caused by SoR counter wrap around, UPU counter wrap around, UE mobility-induced terminal registration procedure and / or K AF May include expiration of validity period.

[0300] For example, after the batch timer starts and before it expires, the SoR counter wrap around and the K of the UDM AF #3 An authentication trigger request from AAnF may be received due to expiration of the validity time. In this case, after the batch timer expires, there are three reasons (i.e. K AF#1 Request due to expiration, ii. SoR counter wraparound, and iii. K AF #3 If any of the reasons (requests due to expiration) are in accordance with the operator policy, primary authentication can be performed. That is, UDM can decide to perform primary authentication trigger.

[0301] If another cause occurs later, the first authentication can be performed in the same manner after waiting for the batch timer.

[0302] 2. Second Example

[0303] Figures 14 and 15 illustrate examples of AAnF-based solutions according to embodiments of the present disclosure.

[0304] Figures 14 and 15 illustrate the procedure of Home Network Triggered Authentication for processing multiple requests in an AAnF-based solution.

[0305] The operations described in FIGS. 6 to 9 may have already been performed before the procedures shown in FIGS. 14 and 15 are performed.

[0306] For example, the following actions may have been performed before the procedures shown in FIGS. 11 and 12 were performed:

[0307] - The terminal can perform AAnF and primary authentication. The terminal is K AUSF From A-KID and AKMA anchor keys (K AKMA ) can be created.

[0308] - The terminal can send an application session establishment request message to the AF.

[0309] - Based on the application session establishment request message from the terminal, AF can send a request for AKMA application key (Naanf_AKMA_ApplicationKey_Get Request) to AAnF.

[0310] - Based on the above request, AAnF K AF You can get (obtain) .

[0311] - AAnF is K to AF AF and K AF It can transmit information about the validity period.

[0312] - AF can send a response to a session establishment request message to the terminal.

[0313] - Additional K described later AF The above process can be performed repeatedly for .

[0314] AAnF can collect and process primary authentication requests from terminals and networks over a certain period of time using a batch timer.

[0315] 0. The operator's operational policy regarding the circumstances under which primary authentication will be performed can be preset in the UDM. The batch timer time value can also be set at this time.

[0316] 1. K managed by AAnF (AKMA Anchor Function) AF #1 may expire.

[0317] K managed by AAnF (AKMA Anchor Function) AF A timeout may occur due to expiration of #1.

[0318] AAnF is the first case (K AF #1 can detect a timeout due to expiration of validity.

[0319] AAnF is for application service continuity. AF A timeout can be triggered in advance before the validity period expires.

[0320] Previously, an authentication trigger request was performed immediately based on the above timeout.

[0321] According to the second embodiment of the present specification, even if a timeout occurs, AAnF may not immediately execute an authentication trigger request. That is, AAnF may hold the authentication trigger request for the duration of a batch timer described below. In this case, after the batch timer expires, AAnF may transmit the authentication trigger request to the UDM only once, even if multiple timeouts have occurred. This prevents repeated primary authentication.

[0322] A single authentication trigger request can be made for a timeout that starts a batch timer and multiple timeouts that occur during the batch timer duration.

[0323] 2. AAnF can start a batch timer.

[0324] When a timeout occurs, AAnF can start a batch timer instead of immediately sending an authentication trigger request to UDM.

[0325] AAnF may hold an authentication trigger request for the duration of the batch timer. After the batch timer expires, AAnF may send an authentication trigger request to the UDM only once, based on multiple timeouts that occurred before the expiration.

[0326] Considering the preset value in step 0, AAnF can start the batch timer by setting the batch timer time.

[0327] The time of the above batch timer may be based on a value preset in step 0.

[0328] 3. K managed by AAnF AF #2 (and / or K AF#3) A timeout may occur due to expiration of the validity period.

[0329] AAnF is the second case (K AF #2) can detect a timeout due to expiration of the validity period.

[0330] 4. When the time of the set batch timer has passed from the time when the UDM started the batch timer in step 2, the batch timer can be stopped.

[0331] For example, the batch timer may stop after the amount of time set in step 0 has elapsed.

[0332] 5. AAnF can send an authentication trigger request (Nuydm_UECM_AuthTrigger Request) including SUPI to UDM for re-authentication request.

[0333] The above authentication trigger request is the first event (K AF #1 Timeout due to expiration of validity period) and / or 2nd event (K AF It may be based on a timeout due to expiration of #2.

[0334] According to the second embodiment of the present specification, even if a timeout occurs, AAnF may not immediately execute an authentication trigger request. That is, AAnF may hold the authentication trigger request for the duration of a batch timer described below. In this case, after the batch timer expires, AAnF may transmit the authentication trigger request to the UDM only once, even if there have been multiple timeouts.

[0335] A single authentication trigger request can be made for a timeout that starts a batch timer and multiple timeouts that occur during the batch timer duration.

[0336] 6. Based on the received requests and / or local policies (the operator's local policies set in step 0), UDM can decide whether to trigger primary authentication.

[0337] UDM can decide whether to trigger primary authentication for received re-authentication requests based on local policy (operator's local policy set in step 0).

[0338] Based on the local policy (the operator's local policy set in step 0), the UDM can decide whether to trigger primary authentication for re-authentication requests received during the batch timer.

[0339] The above-mentioned content in step 1 of Fig. 7 may be applied.

[0340] 7. If UDM determines that the received request is valid, it can send an authentication trigger response including the result to AAnF.

[0341] 8. UDM can send an Authentication Notification containing SUPI information to AMF (or SEAF).

[0342] The above-mentioned content in step 2 of Fig. 7 can be applied.

[0343] 9. The AMF can determine whether to perform primary authentication based on various circumstances, such as the UE state. The AMF can transmit an authentication response containing information on whether to perform the above-determined authentication to the UDM.

[0344] The above-mentioned content in step 3 of Fig. 7 can be applied.

[0345] 10. AMF may initiate primary authentication.

[0346] The operations described in Figure 6 can be performed for primary authentication.

[0347] The above-mentioned content in step 4 of Fig. 7 can be applied.

[0348] With UDM-based methods, the following can be done:

[0349] - The first network control node (eg UDM) may start a timer when it receives a request to perform primary authentication from the second network control node (eg AAnF).

[0350] - When the second network control node (eg AAnF) requests the first network control node (eg UDM) to perform primary authentication in the above operation, the second network control node may include the expected primary authentication execution time.

[0351] - In the above operation, when the first network control node (eg UDM) responds to the request for performing primary authentication to the second network control node (eg AAnF), the first network control node may include the expected primary authentication execution time.

[0352] - The value of the above timer can be preset by the network operator, and all primary authentication requests from the second network control node (e.g. AAnF) are stored during the timer's operating period.

[0353] - After the time of the above timer expires, if there is a request that conforms to the operating policy among the first authentication performance requests received by the first network control node (e.g. UDM), it can be determined that the first authentication is performed.

[0354] The AAnF-based method can:

[0355] - The secondary network control node (e.g. AAnF) may start a timer if any of the generated KAFs has expired.

[0356] - A second network control node (e.g. AAnF) can start a timer by generating a timeout before the validity period expires among the KAFs it has created.

[0357] - The value of the above timer can be preset by the network operator.

[0358] - If there is an expired KAF that occurred during the operation time of the above timer, after the time of the timer expires, the second network control node (eg AAnF) can request the first network control node (eg UDM) to perform the first authentication.

[0359] The following drawings are intended to illustrate specific examples of the present specification. The names of specific devices and the names of specific signals, messages, and fields depicted in the drawings are provided for illustrative purposes only, and the technical features of this specification are not limited to the specific names used in the drawings.

[0360] Figure 16 illustrates the procedure of at least one NF for the disclosure of the present specification.

[0361] 1. At least one NF can detect a first event related to primary authentication.

[0362] 2. Based on detecting the first event, at least one NF can start a batch timer.

[0363] 3. Before the above batch timer expires, at least one NF can detect a second event related to the above first authentication.

[0364] 4. Based on the first event and the second event, the UDM (Unified Data Management) of the at least one NF can determine to trigger the first authentication after the batch timer expires.

[0365] 5. Based on the above decision, at least one NF can send an authentication notification to the Access and Mobility management Function (AMF) of the UDM.

[0366] 6. Based on the transmission of the above authentication notification, at least one NF can perform the first authentication.

[0367] The first event may be based on the expiration of the validity period of a first AKMA (Authentication and Key Management for Applications) application key managed by an AAnF (AKMA Anchor Function) of the at least one NF.

[0368] Based on the above primary authentication being performed, the first AKMA application key can be refreshed.

[0369] The above second event may be based on the expiration of the validity period of the second AKMA application key managed by the AAnF.

[0370] The step of detecting the first event, the step of driving the batch timer, and the step of detecting the second event can be performed by the UDM.

[0371] The steps for detecting the above first incident are:

[0372] The step may include the step of the AAnF transmitting a first authentication trigger request to the UDM based on the expiration of the validity time of the first AKMA application key.

[0373] Based on the first authentication trigger request, a step of detecting the first event can be performed.

[0374] The steps for detecting the above second incident are:

[0375] The step may include the step of the AAnF transmitting a second authentication trigger request to the UDM based on the expiration of the validity time of the second AKMA application key.

[0376] Based on the second authentication trigger request, a step of detecting the second event can be performed.

[0377] Based on the above primary authentication being performed, the first AKMA application key and the second AKMA application key can be refreshed.

[0378] The second incident may be related to SoR counter wrap around.

[0379] The time of the above batch timer may be based on a policy preset in the above UDM.

[0380] The above first authentication trigger request may include time information.

[0381] The above time information may include information about the time at which the first AKMA application key is to be refreshed.

[0382] The time of the above batch timer may be based on the above time information.

[0383] The step of detecting the first event, the step of driving the batch timer, and the step of detecting the second event can be performed by the AAnF.

[0384] After the batch timer expires, the AAnF may send an authentication trigger request for the first event and the second event to the UDM.

[0385] The step of determining whether to trigger the above first authentication may be performed based on the authentication trigger request.

[0386] Based on a first application session establishment request message from a UE (User Equipment), the AAnF can receive a request for the first AKMA application key from an AF (Application Function).

[0387] Based on the request for the first AKMA application key, the AAnF can obtain the first AKMA application key.

[0388] Based on the request for the first AKMA application key, the AAnF can transmit the first AKMA application key and the validity time of the first AKMA application key to the AF.

[0389] The step of obtaining the above first AKMA application key may be performed before the above first event.

[0390] Hereinafter, a device for performing communication according to some embodiments of the present specification will be described.

[0391] For example, a device may include a processor, a transceiver, and memory.

[0392] For example, a processor may be configured to be operatively coupled with memory and a processor.

[0393] The operations performed by the processor include: detecting a first event related to primary authentication; starting a batch timer based on detecting the first event; detecting a second event related to the primary authentication before the batch timer expires; determining, based on the first event and the second event, that the UDM of the at least one NF triggers the primary authentication after the batch timer expires; transmitting, based on the determination, an authentication notification to the AMF by the UDM; and performing the primary authentication based on transmitting the authentication notification, wherein the first event may be based on expiration of a validity time of a first AKMA application key managed by the AAnF of the at least one NF.

[0394] Below, a processor of a device for providing communication according to some embodiments of the present specification is described.

[0395] The operations performed by the processor include: detecting a first event related to primary authentication; starting a batch timer based on detecting the first event; detecting a second event related to the primary authentication before the batch timer expires; determining, based on the first event and the second event, that the UDM of the at least one NF triggers the primary authentication after the batch timer expires; transmitting, based on the determination, an authentication notification to the AMF by the UDM; and performing the primary authentication based on transmitting the authentication notification, wherein the first event may be based on expiration of a validity time of a first AKMA application key managed by the AAnF of the at least one NF.

[0396] Hereinafter, a non-volatile computer-readable medium storing one or more commands for providing mobile communication according to some embodiments of the present specification is described.

[0397] According to some embodiments of the present disclosure, the technical features of the present disclosure may be implemented directly in hardware, software executed by a processor, or a combination of the two. For example, a method performed by a wireless device in wireless communication may be implemented in hardware, software, firmware, or any combination thereof. For example, the software may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, a hard disk, a removable disk, a CD-ROM, or other storage media.

[0398] Some examples of storage media are coupled to the processor, allowing the processor to read information from the storage media. Alternatively, the storage media may be integrated into the processor. The processor and storage media may reside in an ASIC. In other examples, the processor and storage media may reside as separate components.

[0399] Computer-readable media may include tangible and non-volatile computer-readable storage media.

[0400] For example, nonvolatile computer-readable media may include random access memory (RAM), such as synchronized dynamic random access memory (SDRAM), read-only memory (ROM), non-volatile random access memory (NVRAM), read-only memory (EEPROM), flash memory, magnetic or optical data storage media, or any other media that can be used to store instructions or data structures. Nonvolatile computer-readable media may also include combinations of the above.

[0401] Additionally, the methods described herein can be realized at least in part by a computer-readable communication medium that carries or transmits code in the form of instructions or data structures and that can be accessed, read, and / or executed by a computer.

[0402] According to some embodiments of the present disclosure, a non-transitory computer-readable medium has one or more instructions stored thereon. The one or more stored instructions can be executed by a processor of a base station.

[0403] The stored one or more commands include: detecting a first event related to primary authentication; starting a batch timer based on detecting the first event; detecting a second event related to the primary authentication before the batch timer expires; determining, based on the first event and the second event, that the UDM of the at least one NF triggers the primary authentication after the batch timer expires; transmitting, based on the determination, an authentication notification to the AMF by the UDM; and performing the primary authentication based on transmitting the authentication notification, wherein the first event may be based on an expiration of a validity time of a first AKMA application key managed by the AAnF of the at least one NF.

[0404] This specification may have various effects.

[0405] For example, the procedure disclosed in this specification can prevent repetitive primary authentication from being performed.

[0406] The effects that can be achieved through specific examples of this specification are not limited to the effects listed above. For example, a person with ordinary skill in the relevant technical field may understand or derive various technical effects from this specification. Accordingly, the specific effects of this specification are not limited to those explicitly described herein, but may include various effects that can be understood or derived from the technical features of this specification.

[0407] The claims set forth in this specification may be combined in various ways. For example, the technical features of the method claims of this specification may be combined to implement a device, and the technical features of the device claims of this specification may be combined to implement a method. Furthermore, the technical features of the method claims and the technical features of the device claims of this specification may be combined to implement a device, and the technical features of the method claims and the technical features of the device claims of this specification may be combined to implement a method. Other implementations are within the scope of the claims.

Claims

1. A method in which at least one NF (Network Function) performs communication, A step for detecting a first event related to primary authentication; A step of driving a batch timer based on detecting the first incident; A step of detecting a second event related to the first authentication before the batch timer expires; Based on the first event and the second event, a step of determining that the UDM (Unified Data Management) of the at least one NF triggers the primary authentication after the batch timer expires; Based on the above decision, the UDM transmits an authentication notification to the AMF (Access and Mobility management Function); A step of performing the first authentication based on transmitting the above authentication notification is included, A method based on the first event being that the validity period of a first AKMA (Authentication and Key Management for Applications) application key managed by an AAnF (AKMA Anchor Function) of at least one NF has expired.

2. In paragraph 1, A method in which the first AKMA application key is refreshed based on the first authentication performed above.

3. In paragraph 1 or 2, The above second incident is a method based on the expiration of the validity period of the second AKMA application key managed by the above AAnF.

4. In paragraph 3, The step of detecting the first event, the step of driving the batch timer, and the step of detecting the second event are performed by the UDM, The steps for detecting the above first incident are: A step in which the AAnF transmits a first authentication trigger request to the UDM based on the expiration of the validity time of the first AKMA application key, A method in which a step of detecting the first event is performed based on the first authentication trigger request.

5. In paragraph 4, The steps for detecting the above second incident are: A step of the AAnF transmitting a second authentication trigger request to the UDM based on the expiration of the validity period of the second AKMA application key, A method in which a step of detecting the second event is performed based on the second authentication trigger request.

6. In any one of the clauses 3 to 5, A method in which the first AKMA application key and the second AKMA application key are refreshed based on the first authentication performed.

7. In paragraph 4, The above second case is related to SoR counter wrap around.

8. In paragraph 4, The time of the above batch timer is based on a policy preset in the above UDM.

9. In paragraph 4, The above first authentication trigger request includes time information, The above time information includes information about the time at which the first AKMA application key should be refreshed, The time of the above batch timer is a method based on the above time information.

10. In paragraph 3, The step of detecting the first event, the step of driving the batch timer, and the step of detecting the second event are performed by the AAnF, Further comprising a step of the AAnF transmitting an authentication trigger request for the first event and the second event to the UDM after the batch timer expires, The step of determining whether to trigger the first authentication is: a method performed based on the authentication trigger request.

11. In any one of paragraphs 1 to 10, A step in which the AAnF receives a request for the first AKMA application key from an AF (Application Function) based on a first application session establishment request message from a UE (User Equipment); A step in which the AAnF obtains the first AKMA application key based on a request for the first AKMA application key; Based on the request for the first AKMA application key, the AAnF further includes a step of transmitting the first AKMA application key and the validity time of the first AKMA application key to the AF, A method wherein the step of obtaining the first AKMA application key is performed before the first incident.

12. At least one NF (Network Function) that performs communication, Transmitter and receiver; Contains a processor, The operation performed by the processor is at least one NF according to any one of claims 1 to 12.

13. As an apparatus in mobile communication, at least one processor; and At least one memory storing instructions and being operably electrically connected to the at least one processor, A device wherein the operation performed based on the command being executed by the at least one processor is a method according to any one of claims 1 to 12.

14. A non-volatile computer-readable storage medium that records commands, A non-volatile computer-readable storage medium, wherein the instructions, when executed by one or more processors, cause the one or more processors to perform a method according to any one of claims 1 to 12.

Images