First node, second node, third node, first device, communications system and methods performed thereby for one or more devices

Abstract

A computer-implemented method, performed by a first node (111). The method is for handling one or more devices (130). The first node (111) operates in a communications system (100). The first node (111) obtains (301) first information from another node (115) operating via the communications system (100). The first information comprises: i) a first identifier identifying a first subscriber of the communications system (100), ii) a respective identifier of the one or more devices (130) that are allowed to connect to a first device (131) of the first subscriber and use resources of the communications system (100) allocated to a set of one or more subscribers; the first subscriber is comprised in the set of one or more subscribers, and iii) a second identifier of the set of one or more subscribers. The first node (111) then initiates (303) storage of the obtained first information.

Description

[0001] FIRST NODE, SECOND NODE, THIRD NODE, FIRST DEVICE, COMMUNICATIONS

[0002] SYSTEM AND METHODS PERFORMED THEREBY FOR ONE OR MORE DEVICES

[0003] TECHNICAL FIELD

[0004] The present disclosure relates generally to a first node and methods performed thereby for handling one or more devices. The present disclosure also relates generally to a second node, and methods performed thereby for handling the one or more devices. The present disclosure further relates generally to a third node, and methods performed thereby for handling the one or more devices. The present disclosure additionally relates generally to a first device, and methods performed thereby for handling the one or more devices. The present disclosure also relates generally to a communications system, and methods performed thereby for handling the one or more devices. BACKGROUND

[0005] Computer systems in a communications network or communications system may comprise one or more nodes. A node may comprise a processing circuitry which, together with computer program code may perform different functions and actions, a memory, a receiving port, and a sending port. A node may be, for example, a server. Nodes may perform their functions entirely on the cloud.

[0006] The communications system may cover a geographical area which may be divided into cell areas, each cell area being served by a type of node, a network node in the Radio Access Network (RAN), radio network node or Transmission Point (TP), for example, an access node such as a Base Station (BS), e.g., a Radio Base Station (RBS), which sometimes may be referred to as e.g., gNB, evolved Node B (“eNB”), “eNodeB”, “NodeB”, “B node”, or Base Transceiver Station (BTS), depending on the technology and terminology used. The base stations may be of different classes such as e.g., Wide Area Base Stations, Medium Range Base Stations, Local Area Base Stations, and Home Base Stations, based on transmission power and thereby also cell size. A cell may be understood to be the geographical area where radio coverage may be provided by the base station at a base station site. One base station, situated on the base station site, may serve one or several cells. Further, each base station may support one or several communication technologies. The telecommunications network may also comprise network nodes which may serve receiving nodes, such as user equipments, with serving beams.

[0007] The standardization organization Third Generation Partnership Project (3GPP) is currently in the process of specifying a New Radio Interface called Next Generation Radio or New Radio (NR) or 5G-Universal Terrestrial Radio Access (UTRA), as well as a Fifth Generation (5G) Packet Core Network, which may be referred to as 5G Core Network (5GC), abbreviated as 5GC. Figure 1 is a schematic diagram depicting a particular example of a 5G reference architecture of a policy and charging control framework, as defined by 3GPP, which may be used as a reference for the present disclosure. An Application Function (AF) 1 may provide a service in the communications system and may interact with the 3GPP Core Network through a Network Exposure Function (NEF) 2. The AF 1 may allow external parties to use the Exposure Application Programming Interfaces (APIs) offered by the network operator. The NEF 2 may support different functionality. Specifically, the NEF 2 may support different Exposure APIs. A Session Management Function (SMF) 3 may support different functionalities. For example, the SMF 3 may receive Policy and Charging Control (PCC) rules from a Policy Control Function (PCF) 4 and may configure a User Plane function (UPF) 5 accordingly. The UPF 5 may support handling of user plane traffic, including packet inspection, packet routing and forwarding, traffic usage reporting, and Quality of Service (QoS) handling. A Unified Data Repository (UDR) 6 may store data, grouped into distinct collections of subscription-related information: subscription data, policy data, structured data for exposure, and application data. The PCF 4 may support a unified policy framework to govern the network behavior. Specifically, the PCF 4 may provide PCC rules to a Policy and Charging Enforcement Function (PCEF), that is, the SMF 3 and / or the UPF 5 that may enforce policy and charging decisions according to provisioned PCC rules. A Charging Function (CHF) 7 may support charging related functionality, specifically online and offline charging. The PCF

[0008] 4 may provide policy rules to a User Equipment (UE) through an Access and Mobility Management Function (AMF) 8. The AMF 8 may support different functionality, e.g., Termination of Non-Access Stratum (NAS) signalling, NAS ciphering and integrity protection, registration management, connection management, mobility management, access authentication and authorization, security context management, etc. The AMF 8 may be used to convey information from / to a User Equipment (UE) through NAS signaling, including the UE Policies provided by the PCF 4. A Network Data Analytics Function (NWDAF) 9 may be understood to represent an operator managed network analytics logical function. The NWDAF 9 may be part of the 5GC architecture and may use the mechanisms and interfaces specified for 5GC and Operations, Administration and Maintenance (QAM). Each of the UDR 6, the NEF 2, the NWDAF 9, the AF 1 , the PCF 4, the CHF 7, the AMF 8, the SMF 3 and the UPF

[0009] 5 may have an interface through which they may be accessed, which as depicted in the Figure, may be, respectively: Nudr 10, Nnef 11 , Nnwdaf 12, Naf 13, Npcf 14, Nchf 15, Namf 16, Nsmf 17 and N4 18.

[0010] UE Policies

[0011] 3GPP may be understood to define UE policies for the network, and specifically the

[0012] PCF, to configure the UE with two types of operator policies. The first type of operator policy may be understood to be an Access Network Discovery and Selection Policy (AN DSP) for non-3GPP access, which may include information for which non-3GPP accesses the UE may need to prioritize, and which may be used by the UE, e.g., for selecting non-3GPP accesses, e.g., Wi-Fi networks. A non-3GPP access may be understood to be an access to a network that may use a protocol other than a 3GPP protocol.

[0013] The second type of operator policy may be understood to be a UE Route Selection Policy (URSP) related to applications and Protocol Data Unit (PDU) sessions, which may include information mapping certain user data traffic, e.g., applications, to 5G PDU Session connectivity parameters. The user data traffic may be defined in the URSP rule by a “traffic descriptor” parameter that may include, e.g., Internet Protocol (IP) filter parameters or Application Identity.

[0014] 3GPP Rel19 Study Item Identifier (SID) on User Identities

[0015] A 3GPP Rel19 SID on User Identities [1] has been proposed and specifically related to the identification and policy control of individual devices connecting behind a 3GPP UE, e.g., behind a Residential Gateway (RG), a Work Task (WT) has been proposed, WT-4.1. Devices may be understood to connect behind a 3GPP UE when they may communicate via a 3GPP network using a subscription of the 3GPP UE to the network, as they may be understood to lack their own, e.g., they may lack a Subscriber Identity Module (SIM) card. The subscription may be understood to be necessary to use the 3GPP network resources to perform 3GPP communications. For example, a device using the network of a 3GPP UE by connecting to the 3GPP device via Bluetooth may be understood to be connecting behind the 3GPP UE. The proposed WT-4.1 relates to when non-3GPP devices communicate via a UE, whether and how to control the UE, e.g., whether Network Address Translation (NAT) may be allowed in the UE, which devices, and how many devices may be allowed to access the 5GC via the UE, and whether and how to allocate IP addresses for the non-3GPP devices.

[0016] Existing methods are not fully accurate when detecting devices behind UE. For example, some UPF products may detect devices behind a UE based on techniques such as Operating System (OS) detection, Transmission Control Protocol (TCP) fingerprinting, etc., which may result in false detection, e.g. a user may manually change the settings, e.g., Time to Live (TTL), in a device, e.g., a laptop, behind UE in order to appear as it is the UE, and effectively hide tethering from the mobile operator. Existing methods to handle traffic in a network relating to devices connecting to the network behind a 3GPP UE may therefore lead to increased latency and low quality of experience, and / or to lower security in the communications.

[0017] SUMMARY

[0018] As part of the development of embodiments herein, one or more challenges with the existing technology will first be identified and discussed. Network operators today may require applying differentiated traffic management actions, e.g., QoS, etc., according to operator policies and subscription terms. It is currently not possible to apply differentiated traffic management actions based on the non-3GPP devices connected behind 3GPP UE, especially in environments involving groups of subscribers, e.g., enterprise, Internet of Things (loT), that is in vertical environments, for example, in enterprise, an employee having a mobile device, e.g., a UE, with a SIM card, corresponding to an enterprise subscription, but also having other, SIM-less, devices connected behind the UE, e.g., an enterprise laptop, printer, etc. The set of one or more subscribers may belong to a party which may have a Service-Level Agreement (SLA) agreement with a Mobile Network Operator (MNO). For the specific subscribers, e.g., a list of Subscription Permanent Identifiers (SUPI), pertaining to a certain entity, e.g., an external entity or company, the MNO may apply certain traffic management actions, as per SLA, e.g., through a reserved Data Network Name (DNN) / Serving Network Slice Selection Assistance Information (S-NSSAI) with a certain QoS.

[0019] According to the foregoing, it is an object of embodiments herein to improve the handling of one or more devices in a communications system.

[0020] According to a first aspect of embodiments herein, the object is achieved by a computer- implemented method, performed by a first node. The method is handling one or more devices. The first node operates in a communications system. The first node obtains first information from another node operating via the communications system. The first information comprises a first identifier (ID) identifying a first subscriber of the communications system. The first information further comprises a respective identifier of the one or more devices that are allowed to connect to the first device of the first subscriber and use resources of the communications system allocated to a set of one or more subscribers. The first information additionally comprises a second identifier of the set of one or more subscribers. The first node then initiates storage of the obtained first information.

[0021] According to a second aspect of embodiments herein, the object is achieved by a computer-implemented method, performed by a second node. The method is for handling the one or more devices. The second node operates in the communications system. The second node receives a first indication from the first node operating in the communications system. The first indication indicates to store the first information. The first information comprises: i) the first identifier identifying the first subscriber of the communications system, ii) the respective identifier of the one or more devices that are allowed to connect to the first device of the first subscriber and use the resources of the communications system allocated to the set of one or more subscribers; the first subscriber is comprised in the set of one or more subscribers, and iii) the second identifier of the set of one or more subscribers. The second node then stores the received first information.

[0022] According to a third aspect of embodiments herein, the object is achieved by a computer-implemented method, performed by the third node. The method is for handling the one or more devices. The third node operates in the communications system. The third node obtains the first information. The first information indicates, for the first subscriber of the communications system, the first identifier identifying the first subscriber of the communications system. The first information also indicates, for the first subscriber of the communications system, the respective identifier of the one or more devices that are allowed to connect to the first device of the first subscriber and use the resources of the communications system allocated to the set of one or more subscribers. As stated earlier, the first subscriber is comprised in the set of one or more subscribers. The first information further indicates the second identifier of the set of one or more subscribers. The third node generates, based on the obtained first information, a policy. The policy comprises one or more rules. The one or more rules are to indicate to the first device to route traffic generated by the one or more devices, while connected to the first device to communicate via the communications system, using at least a subset of the resources of the communications system allocated to the set of one or more subscribers. The third node provides a further indication of the generated policy towards the first device.

[0023] According to a fourth aspect of embodiments herein, the object is achieved by a computer-implemented method, performed by the first device. The method is for handling the one or more devices. The first device operates in the communications system. The first device is of the first subscriber of the communications system. The first device obtains, directly or indirectly, the further indication from the third node operating in the communications system. The further indication indicates the one or more rules to route traffic generated by the one or more devices. The one or more devices are allowed to connect to the first device and use the resources of the communications system allocated to the set of one or more subscribers. The first subscriber is comprised in the set of one or more subscribers. The one or more rules are to route the traffic generated by the one or more devices while connected to the first device to communicate via the communications system, using at least a subset of resources of the communications system allocated to the set of one or more subscribers. The further indication comprises a first descriptor of the traffic indicating the respective identifier of the one or more devices. The further indication also comprises a second descriptor of a route for the traffic generated by the one or more devices, while connected to the first device to communicate via the communications system. The second descriptor indicates the subset of the resources of the communications system. The first device routes the traffic according to the indicated one or more rules. According to a fifth aspect of embodiments herein, the object is achieved by the first node, for handling the one or more devices. The first node is configured to operate in the communications system. The first node is configured to obtain the first information from the another node configured to operate via the communications system. The first information is configured to comprise: i) the first identifier configured to identify the first subscriber of the communications system, ii) the respective identifier of the one or more devices that are configured to be allowed to connect to the first device of the first subscriber and use the resources of the communications system configured to be allocated to the set of one or more subscribers; the first subscriber is configured to be comprised in the set of one or more subscribers, and iii) the second identifier of the set of one or more subscribers. The first node is also configured to initiate storage of the first information configured to be obtained.

[0024] According to a sixth aspect of embodiments herein, the object is achieved by the second node, for handling the one or more devices. The second node is configured to operate in the communications system. The second node is configured to receive the first indication from the first node configured to operate in the communications system. The first information is configured to comprise: i) the first identifier configured to identify the first subscriber of the communications system, ii) the respective identifier of the one or more devices that are configured to be allowed to connect to the first device of the first subscriber and use the resources of the communications system configured to be allocated to the set of one or more subscribers; the first subscriber is configured to be comprised in the set of one or more subscribers, and iii) the second identifier of the set of one or more subscribers. The second node is also configured to store the first information configured to be received.

[0025] According to a seventh aspect of embodiments herein, the object is achieved by the third node, for handling the one or more devices. The third node is configured to operate in the communications system. The third node is configured to obtain the first information configured to indicate, for a first subscriber of the communications system: i) the first identifier configured to identify the first subscriber of the communications system, ii) the respective identifier of the one or more devices that are configured to be allowed to connect to the first device of the first subscriber and use the resources of the communications system configured to be allocated to the set of one or more subscribers; the first subscriber is configured to be comprised in the set of one or more subscribers, and iii) the second identifier of the set of one or more subscribers. The third node is also configured to generate, based on the first information configured to be obtained, the policy configured to comprise the one or more rules. The one or more rules are configured to be to indicate to the first device to route traffic configured to be generated by the one or more devices, while connected to the first device to communicate via the communications system, using at least the subset of the resources of the communications system configured to be allocated to the set of one or more subscribers. The third node is further configured to provide the further indication of the policy configured to be generated towards the first device.

[0026] According to an eighth aspect of embodiments herein, the object is achieved by the first device, for handling the one or more devices. The first device is configured to operate in the communications system. The first device is configured to be of the first subscriber of the communications system. The first device is configured to obtain, directly or indirectly, the further indication from the third node configured to operate in the communications system. The further indication is configured to indicate the one or more rules to route traffic configured to be generated by the one or more devices. The one or more devices are configured to be allowed to connect to the first device and use the resources of the communications system configured to be allocated to the set of one or more subscribers. The first subscriber is comprised in the set of one or more subscribers. The one or more rules are configured to be to route the traffic configured to be generated by the one or more devices while connected to the first device to communicate via the communications system, using at least the subset of resources of the communications system configured to be allocated to the set of one or more subscribers. The further indication is configured to comprise: i) the first descriptor of the traffic indicating the respective identifier of the one or more devices, and ii) the second descriptor of the route for the traffic configured to be generated by the one or more devices, while connected to the first device to communicate via the communications system. The second descriptor is configured to indicate the subset of the resources of the communications system 100. The first device is also configured to route the traffic according to the one or more rules configured to be indicated.

[0027] According to a ninth aspect of embodiments herein, the object is achieved by the communications system, for handling the one or more devices. The communications system is configured to comprise one or more of: the first node, the second node and the third node.

[0028] By obtaining the first information, the first node may enable the another node, which may be a third party, the possibility to provision the one or more devices, e.g., the allowed non- 3GPP devices connected behind the first device, on a per subscriber basis. This may enable the first node to store the first information in the communications system so that the first information may be eventually provided to the third node and thereby enable the third node to generate the one or more rules to manage the traffic of the one or more devices and the other devices accordingly. By enabling to ultimately generate the one or more rules, the first node may allow an MNO of the communications system to apply differentiated policies, e.g., traffic management actions, for the one or more devices connected behind the first device, especially in vertical, e.g., enterprise, loT, environments. This may be understood to then allow in turn the MNO to improve security in vertical environments as allowed non- 3GPP traffic may be understood to not get routed to the Internet. By initiating storing the first information, the third node may be enabled to retrieve the stored first information from the second node and thereby eventually enable the third node to generate the one or more rules to manage the traffic of the one or more devices and other non-allowed devices accordingly.

[0029] By providing the further indication of the policy configured to be generated towards the first device, the third node may enable the first device to then route the traffic according to the one or more rules configured to be indicated.

[0030] Embodiments herein may therefore be understood to allow the network operator of the communications system, through the first device, to apply differentiated traffic management actions for the one or more devices connected behind the first device, especially in vertical, e.g., enterprise, loT, environments.

[0031] BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Examples of embodiments herein are described in more detail with reference to the accompanying drawings, according to the following description.

[0033] Figure 1 is a schematic diagram illustrating an example of a 5G Network Architecture, according to existing methods.

[0034] Figure 2 is a schematic diagram illustrating a non-limiting example of a communications system, according to embodiments herein.

[0035] Figure 3 is a flowchart depicting embodiments of a method in a first node, according to embodiments herein.

[0036] Figure 4 is a flowchart depicting embodiments of a method in a second node, according to embodiments herein.

[0037] Figure 5 is a flowchart depicting embodiments of a method in a third node, according to embodiments herein.

[0038] Figure 6 is a flowchart depicting embodiments of a method in a first device, according to embodiments herein.

[0039] Figure 7 is a schematic diagram depicting a non-limiting example of signalling between nodes in a communications system, according to embodiments herein.

[0040] Figure 8 is a schematic diagram depicting another non-limiting example of signalling between nodes in a communications system, according to embodiments herein.

[0041] Figure 9 is a schematic diagram depicting a further non-limiting example of signalling between nodes in a communications system, according to embodiments herein.

[0042] Figure 10 is a schematic block diagram illustrating two non-limiting examples, a) and b), of a first node, according to embodiments herein.

[0043] Figure 11 is a schematic block diagram illustrating two non-limiting examples, a) and b), of a second node, according to embodiments herein. Figure 12 is a schematic block diagram illustrating two non-limiting examples, a) and b), of a third node, according to embodiments herein.

[0044] Figure 13 is a schematic block diagram illustrating two non-limiting examples, a) and b), of a first device, according to embodiments herein.

[0045] DETAILED DESCRIPTION

[0046] Certain aspects of the present disclosure and their embodiments address one or more of the challenges identified with the existing methods and provide solutions to the challenges discussed.

[0047] Embodiments herein may be understood to address the problems identified with the existing methods and may relate to methods and apparatus for identification and control of devices connecting behind 3GPP UE. More particularly, embodiments herein may be understood to relate to methods and apparatus that may enable to apply differentiated traffic management actions for non-3GPP devices connected behind a UE. In a particular nonlimiting example, the application of differentiated traffic management actions for non-3GPP devices connected behind a UE may be based on a node of a Third Party (3P), e.g., an enterprise AF, provisioning, e.g., via a further node, such as a NEF, a list of non-3GPP devices, for example, by providing device identifiers, which may be connected to a UE and which may be allowed to use the resources allocated for use to a set of one or more subscribers, e.g., enterprise resources.

[0048] Embodiments herein may also relate to methods and apparatus that may enable to apply differentiated traffic management actions for non-3GPP devices connected behind a UE, based on an extension of URSP rules in order to influence the UE to route the traffic generated by the non-3GPP devices, that is, the allowed non-3GPP devices, indicated by their device identifiers, connected behind the UE, towards, in a particular example, the corresponding DNN and / or S-NSSAI.

[0049] As a result of applying the differentiated traffic management actions, traffic generated by the allowed non-3GPP devices connected behind the 3GPP UE may be able to access the resources allocated to the set of one or more subscribers, e.g., enterprise resources, such as an enterprise Virtual Private Network (VPN) connection, as this traffic may get routed through a PDU session established with resources allocated to the enterprise, e.g., an enterprise DNN.

[0050] Traffic generated by the non-allowed non-3GPP devices connected behind the 3GPP UE may not be able to access the resources allocated to the set of one or more subscribers, e.g., enterprise resources, e.g., enterprise VPN connection, as this traffic may get routed through a different PDU session, e.g., a default PDU session, such as an internet DNN.

[0051] The embodiments will now be described more fully hereinafter with reference to the accompanying drawings, in which examples are shown. In this section, embodiments herein are illustrated by exemplary embodiments. It should be noted that these embodiments are not mutually exclusive. Components from one embodiment or example may be tacitly assumed to be present in another embodiment or example and it will be obvious to a person skilled in the art how those components may be used in the other exemplary embodiments. All possible combinations are not described to simplify the description.

[0052] Figure 2 depicts two non-limiting examples, in panels “a” and “b”, respectively, of a communications system 100, in which embodiments herein may be implemented. In some example implementations, such as that depicted in the non-limiting example of Figure 2a, the communications system 100 may be a computer network. In other example implementations, such as that depicted in the non-limiting example of Figure 2b, the communications system 100 may be implemented in a telecommunications system, sometimes also referred to as a telecommunications network, cellular radio system, cellular network, or wireless communications system. In some examples, the telecommunications system may comprise network nodes which may serve receiving nodes, such as wireless devices. The communications system 100 may for example be a network such as a 5G system, or a newer system supporting similar functionality. In some examples, the communications system 100 may be a Long-Term Evolution (LTE) network and may, alternatively or additionally, support other technologies such as a for example, e.g., LTE Frequency Division Duplex (FDD), LTE Time Division Duplex (TDD), LTE Half-Duplex Frequency Division Duplex (HD-FDD), LTE operating in an unlicensed band. The telecommunications system may also support other technologies, such as Wideband Code Division Multiple Access (WCDMA), Universal Mobile Telecommunications System Terrestrial Radio Access (UTRA) TDD, Global System for Mobile communications (GSM) network, GSM / Enhanced Data Rate for GSM Evolution (EDGE) Radio Access Network (GERAN) network, Ultra-Mobile Broadband (UMB), EDGE network, network comprising any combination of Radio Access Technologies (RATs) such as e.g. MultiStandard Radio (MSR) base stations, multi-RAT base stations etc., any 2rd Generation Partnership Project (3GPP) cellular network, Wireless Local Area Network / s (WLAN) or WiFi network / s, Worldwide Interoperability for Microwave Access (WiMax), IEEE 802.15.4-based low-power short-range networks such as IPv6 over Low-Power Wireless Personal Area Networks (6LowPAN), Zigbee, Z-Wave, Bluetooth Low Energy (BLE), or any cellular network or system. The telecommunications system may for example support a Low Power Wide Area Network (LPWAN). LPWAN technologies may comprise Long Range physical layer protocol (LoRa), Haystack, SigFox, LTE-M, and Narrow-Band loT (NB-loT).

[0053] The communications system 100 may comprise a plurality of nodes, whereof a first node 111, a second node 112, a third node 113, and a fourth node 114 are depicted in Figure 2. The communications system 100 may operate in communication with other nodes, such as another node 115 or fifth node 115, also depicted in Figure 2. It may be understood that the communications system 100 may comprise and / or operate in communication with more nodes than those represented on Figure 2. For example, as will be depicted in other figures, the communications system 100 may comprise a sixth node 116, a seventh node 117, etc... The first node 111 , the second node 112, the third node 113 and the fourth node 114 may be comprised in, or be internal to, the communications system 100. The another node 115 is external to the communications system 100 but may operate via the communications system 100.

[0054] Any of the first node 111, the second node 112, the third node 113, the fourth node 114 and the another node 115 may be understood, respectively, as a first computer system, a second computer system, a third computer system, and fourth computer system and a fifth computer system. In some examples, any of the first node 111, the second node 112, the third node 113, the fourth node 114 and the another node 115 may be implemented as a standalone server in e.g., a host computer in the cloud 120, as depicted in the non-limiting example depicted in panel b) of Figure 2 for the first node 111, the second node 112, the third node 113 and the fourth node 114. Any of the first node 111 , the second node 112, the third node 113, the fourth node 114 and the another node 115 may in some examples be a distributed node or distributed server, with some of their respective functions being implemented locally, e.g., by a client manager, and some of their functions implemented in the cloud 120, by e.g., a server manager. Yet in other examples, any of the first node 111, the second node 112, the third node 113, the fourth node 114 and the another node 115 may also be implemented as processing resources in a server farm.

[0055] Any of the first node 111, the second node 112, the third node 113 and fourth node 114 may be co-localized. However, in typical embodiments, the first node 111 , the second node 112, the third node 113, the another node 114 and the another node 115 may be different nodes.

[0056] The first node 111 may be a node having a capability to support different functionality, e.g., different Exposure APIs. As depicted in Figure 2, a particular non-limiting example, wherein the communications system 100 may be a 5G network, the first node 111 may be a NEF. In another non-limiting example of the first node 111, wherein the communications system 100 may be a 4G network, the first node 111 may be a Service Capability Exposure Function (SCEF).

[0057] The second node 112, in some examples may be a node having a capability to store data, grouped into distinct collections of subscription-related information, such as subscription data, policy data, structured data for exposure, and application data. As depicted in Figure 2, a particular non-limiting example, wherein the communications system 100 may be a 5G network, the second node 112 may, in such examples be a UDR. In such examples, wherein the communications system 100 may be a 4G network, the second node 112 may be Subscriber Profile Repository (SPR).

[0058] The third node 113 may be a node having a capability to support a unified policy framework to govern the network behavior. Specifically, the third node 113 may have a capability to provide PCC rules to other nodes that may then enforce policy and charging decisions according to the provisioned PCC rules. As depicted in Figure 2, a particular nonlimiting example, wherein the communications system 100 may be a 5G network, the third node 113 may be a PCF. In another non-limiting example of the third node 113, wherein the communications system 100 may be a 4G network, the third node 113 may be a Policy and Charging Rules Function (PCRF).

[0059] The fourth node 114 may be a node having a capability to support different functionality, e.g., convey information from / to a User Equipment (UE), e.g., through NAS signaling, including the UE Policies provided by the third node 113. As depicted in Figure 2, a particular non-limiting example, wherein the communications system 100 may be a 5G network, the fourth node 114 may be an AMF. In another non-limiting example of the fourth node 114, wherein the communications system 100 may be a 4G network, the fourth node 114 may be a Mobility Management Entity (MME).

[0060] The another node 115 may be a node having a capability to manage service of an application to a device, such as the device 130 described below. The another node 115 may interact with the core network of the communications system 100 through the first node 111. The another node 115 may allow external parties to use the Exposure APIs offered by an operator of the communications system 100. As depicted in Figure 2, a particular non-limiting example, wherein the communications system 100 may be a 5G network, the another node 115 may be an AF / Application Server (AS). In another non-limiting example of the another node 115, wherein the communications system 100 may be a 4G network, the another node 115 may be a Services Capabilities Server (SCS), or an AS. The another node 115 may operate via the communications system 100. That is, the another node 115 may, in some embodiments, be an external node that may communicate with one or more other entities using resources, e.g., the communications network, provided by the communications system 100.

[0061] The communications system 100 may also comprise one or more devices 130 and a first device 131. In the non-limiting examples depicted in Figure 2, the one or more devices 130 comprise a second device 132. It may be understood that the one or more devices 130 may comprise additional devices. This is not depicted in the figure to simplify it. The communications system 100 may further comprise a third device 133. The third device 133 may be one of other devices 135 than the one or more devices 130, comprised in the communications system 100. It may be understood that the other devices 135 may comprise additional devices than the third device 133. This is not depicted in the figure to simplify it. Any of the first device 131 , the one or more devices 130 and the other devices 135 may be also known as a e.g., user equipment (UE), wireless device, mobile terminal, wireless terminal and / or mobile station, mobile telephone, cellular telephone, or laptop with wireless capability, an Internet of Things (loT) device, or a Customer Premises Equipment (CPE), just to mention some further examples. Any of the first device 131 , the one or more devices 130 and the other devices 135 in the present context may be, for example, portable, pocket-storable, handheld, computer-comprised, or a vehicle-mounted mobile device, enabled to communicate voice and / or data, via a RAN, with another entity, such as a server, a laptop, a Personal Digital Assistant (PDA), or a tablet, a Machine-to-Machine (M2M) device, an Internet of Things (loT) device, e.g., a sensor or a camera, a device equipped with a wireless interface, such as a printer or a file storage device, modem, Laptop Embedded Equipped (LEE), Laptop Mounted Equipment (LME), USB dongles, CPE or any other radio network unit capable of communicating over a radio link in the communications system 100. Any of the first device 131 , the one or more devices 130 and the other devices 135 may be wireless, i.e. , it may be enabled to communicate wirelessly in the communications system 100 and, in some particular examples, may be able support beamforming transmission. The communication may be performed e.g., between two devices, between a device and a radio network node, and / or between a device and a server. The communication may be performed e.g., via a RAN and possibly one or more core networks, comprised, respectively, within the communications system 100.

[0062] The first device 131 may be understood to be a device having a subscription to use a set of resources of the communications system 100 by virtue of belonging to a subscriber of a set of one or more subscribers. The set of one or more subscribers may have an SLA with a Mobile Network Operator (MNO) of the communications system 100, that is, an SLA as a group. The set of one or more subscribers may be, for example, one of: an enterprise, an loT group of subscribers, and a Mobile Broad Band (MBB) group of subscribers. These examples of the set of one or more subscribers may be understood to be non-limiting. Any of the one or more devices 130 and the other devices 135 may be devices that may lack a subscription to use communications system 100, e.g., lack a subscription to use resources of the communications system 100. However, any of the one or more devices 130 and the other devices 135 but may be able to connect behind the first device 131 to the communications system 100. Any of the one or more devices 130 and the other devices 135 may be understood to be non-3GPP devices. As will be explained in further detail later, the one or more devices 130 may be devices that are allowed to connect to the first device 131 and use resources of the communications system 100 allocated to the set of one or more subscribers, that is, allowed to use the resources of the communications system 100 allocated to the set of one or more subscribers while connected to the first device 131. The other devices 135 may be devices that may be not allowed, or unallowed, to use the resources of the communications system 100 allocated to the set of one or more subscribers while connected to the first device 131.

[0063] The communications system 100 may comprise one or more radio network nodes, whereof a radio network node 140 is depicted in Figure 2b. The radio network node 140 may typically be a base station or Transmission Point (TP), or any other network unit capable to serve a wireless device or a machine type node in the communications system 100. The radio network node 140 may be e.g., a 5G gNB, a 4G eNB, or a radio network node in an alternative 5G radio access technology, e.g., fixed or WiFi. The radio network node 140 may be e.g., a Wide Area Base Station, Medium Range Base Station, Local Area Base Station, and Home Base Station, based on transmission power and thereby also coverage size. The radio network node 140 may be a stationary relay node or a mobile relay node. The radio network node 140 may support one or several communication technologies, and its name may depend on the technology and terminology used. The radio network node 140 may be directly connected to one or more networks and / or one or more core networks.

[0064] The communications system 100 covers a geographical area which may be divided into cell areas, wherein each cell area may be served by a radio network node, although, one radio network node may serve one or several cells.

[0065] The first node 111 may communicate with the second node 112 over a first link 151 , e.g., a radio link or a wired link. The second node 112 may communicate with the third node

[0066] 113 over a second link 152, e.g., a radio link or a wired link. The third node 113 may communicate with the fourth node 114 over a third link 153, e.g., a radio link or a wired link. The third node 113 may communicate with the another node 115 over a fourth link 154, e.g., a radio link or a wired link. The fourth node 114 may communicate with the first device 131 over a fifth link 155, e.g., a radio link or a wired link. The first node 111 may communicate with the another node 115 over a sixth link 156, e.g., a radio link or a wired link. The first device 131 may communicate with any of the one or more devices 130, e.g., the second device 132 over a respective seventh link 157, e.g., a radio link or a wired link. The first device 131 may communicate with any of the other devices 135, e.g., the third device 133, over an eighth link 158, e.g., a radio link or a wired link. The first device 131 may communicate with the another node 115 over a ninth link 159, e.g., a radio link or a wired link. The first device 131 may communicate with the fourth node 114 over a tenth link 160, e.g., a radio link or a wired link. The radio network node 140 may communicate with the fourth node

[0067] 114 over an eleventh link 161 , e.g., a radio link or a wired link. The first device 131 may communicate with the radio network node 140 over a twelfth link 162, e.g., a radio link or a wired link. The first device 131 may communicate with the another node 115 over a thirteenth link 163, e.g., a radio link or a wired link.

[0068] Any of the first link 151 , the second link 152, the third link 153, the fourth link 154, the fifth link 155, the sixth link 156, the seventh link 157, the eighth link 158, the ninth link 159, the tenth link 160, the eleventh link 161 , the twelfth link 162 and / or the thirteenth link 163 may be a direct link or it may go via one or more computer systems or one or more core networks in the communications system 100, or it may go via an optional intermediate network. The intermediate network may be one of, or a combination of more than one of, a public, private, or hosted network; the intermediate network, if any, may be a backbone network or the Internet, which is not shown in Figure 2.

[0069] Although terminology from Long Term Evolution (LTE) / 5G has been used in this disclosure to exemplify the embodiments herein, this should not be seen as limiting the scope of the embodiments herein to only the aforementioned system. Other wireless systems supporting similar or equivalent functionality may also benefit from exploiting the ideas covered within this disclosure.

[0070] As depicted in the non-limiting examples of Figure 2, in some embodiments wherein the communications system 100 may be a 5G system, the first node 111 may be a NEF, the second node 112 may be a UDR, the third node 113 may be PCF, the fourth node 114 may be an AMF and the another node 115 may be an AS / AF. As explained earlier, embodiments herein may be understood to not only apply to 5G network architecture, but the same mechanisms may be applied to 4G, for example, just by replacing NEF by SCEF, UDR by SPR, PCF by PCRF, and AMF by MME.

[0071] In future telecommunication networks, e.g., in the sixth generation (6G), the terms used herein may need to be reinterpreted in view of possible terminology changes in future technologies. In general, the usage of “first”, “second”, “third”, “fourth”, “fifth”, “sixth”, “seventh”, “eighth”, “ninth”, “tenth”, “eleventh” and / or “twelfth” herein may be understood to be an arbitrary way to denote different elements or entities and may be understood to not confer a cumulative or chronological character to the nouns they modify.

[0072] Some of the embodiments contemplated herein will now be described more fully with reference to the accompanying drawings. Other embodiments, however, are contained within the scope of the subject matter disclosed herein, the disclosed subject matter should not be construed as limited to only the embodiments set forth herein; rather, these embodiments are provided by way of example to convey the scope of the subject matter to those skilled in the art.

[0073] Embodiments of a computer-implemented method, performed by the first node 111, will now be described with reference to the flowchart depicted in Figure 3. The method may be understood to be for handling one or more devices 130. The first node 111 operates in the communications system 100.

[0074] Several embodiments are comprised herein. In some embodiments, all the actions may be performed. In some embodiments, some of the actions may be performed. It should be noted that the examples herein are not mutually exclusive. One or more embodiments may be combined, where applicable. All possible combinations are not described to simplify the description. Components from one embodiment may be tacitly assumed to be present in another embodiment and it will be obvious to a person skilled in the art how those components may be used in the other exemplary embodiments. A non-limiting example of the method performed by the first node 111 is depicted in Figure 3.

[0075] In Figure 3, an optional action is represented with dashed lines.

[0076] Action 301

[0077] Embodiments herein may be understood to aim at handling devices that may be able to connect to the communications system 100 behind the first device 131. As stated earlier, the first device 131 may be understood to be a device having a subscription to use a set of resources of the communications system 100 by virtue of being of a subscriber of a set one or more subscribers. The set of one or more subscribers may have an SLA with the MNO of the communications system 100. The set of one or more subscribers may be, for example, one of: an enterprise, an loT group of subscribers, and an MBB group of subscribers. The set of resources may be, for example, a VPN connection, established according to the SLA of the set of one or more subscribers, which may imply, for example, a certain QoS, traffic optimization such as TCP Optimization, traffic steering, that is, routing, charging, etc. According to the SLA, the MNO may be obligated to provide a certain service to the set of one or more subscribers, which may imply a certain load, e.g., demand of resources, for the communication system 100. As also stated earlier, any of the one or more devices 130 and the other devices 135 may be devices that may lack a subscription to use resources of the communications system 100. However, any of the one or more devices 130 and the other devices 135 may be able to connect behind the first device 131 to the communications system 100. Any of the one or more devices 130 and the other devices 135 may be understood to be non-3GPP devices. As will be explained in further detail later, the one or more devices 130 may be devices that are allowed to connect to the first device 131 and use resources of the communications system 100 allocated to the set of one or more subscribers, that is, use resources of the communications system 100 allocated to the set of one or more subscribers while connected to the first device 131. The other devices 135 may be devices that may be unallowed to use the resources of the communications system 100 allocated to the set of one or more subscribers while connected to the first device 131. Embodiments herein may therefore aim at enabling to manage how the set of resources may be used by devices lacking a subscription in the communications system 100, and yet being able to connect to the communications system 100 behind the first device 131.

[0078] In this Action 301, the first node 111 obtains first information from the another node 115 operating via the communications system 100. The another node 115 may pertain to the set of subscribers, e.g., a certain enterprise.

[0079] The first information may enable to identify which of the devices that may connect to the communications system 100 behind the first device 131 may be allowed to use resources of the communications system 100 allocated to the set of one or more subscribers.

[0080] The first information comprises a first identifier (ID) identifying a first subscriber of the communications system 100. In some examples, the first information may comprise a plurality of first identifiers, e.g., a list, of first identifiers. The first identifier(s) may indicate for which subscriber(s) the first information may apply.

[0081] In some embodiments, the first identifier may be a Subscription Permanent Identifier (SUPI).

[0082] The first information further comprises a respective identifier of the one or more devices 130 that are allowed to connect to the first device 131 of the first subscriber and use resources of the communications system 100 allocated to a set of one or more subscribers. In other words, the respective identifier(s) may indicate the device identifier(s) which may connect to the first device 131 , e.g., a subscriber's UE, and which may use the resources of the set of one or more subscribers. The first information may therefore be understood to explicitly identify the one or more devices 130 that are allowed to connect to the first device 131 of the first subscriber and use resources of the communications system 100 allocated to a set of one or more subscribers. The first subscriber is comprised in the set of one or more subscribers. As stated earlier, the resources may be, e.g., a VPN of the set of one or more subscribers, such as a certain enterprise VPN.

[0083] The respective identifier may be a respective device-identifier (Device-ID). In some examples, the first information may comprise a plurality of respective identifiers, e.g., a list, of respective identifiers. In some embodiments, the one or more devices 130 may be non-3GPP devices.

[0084] In some embodiments, the other devices 135 for which no respective identifier may be comprised in the first information may be implicitly unallowed, that is, not allowed, to use the resources of the communications system 100 allocated to the set of one or more subscribers while connected to the first device 131 of the first subscriber.

[0085] The first information additionally comprises a second identifier of the set of one or more subscribers. The second identifier may identify the set of one or more subscribers, explicitly, e.g., as a unity. The second identifier may indicate the identity of the set of one or more subscribers for which the first information may apply. As a non-limiting example, the second identifier may be an enterprise-1 D. However, the set of one or more subscribers may be other verticals, e.g., loT and even MBB subscribers.

[0086] Optionally, in some embodiments, the first information may further comprise one or more filters to be applied for the usage of the resources.

[0087] The one or more filters may comprise at least one of a DNN, and an S-NSSAI, e.g., DNN / S-NSSAI=enterprise-ID.

[0088] In some embodiments, the first information may further comprise a third identifier of the another node 115.

[0089] In some embodiments, the communications system 100 may be a 5G network.

[0090] The first node 111, e.g., in some of such embodiments, may be a NEF. The another node 115 may be an AF. In some of such embodiments, the third identifier may be e.g., an AF-ID.

[0091] The obtaining may be performed by receiving the first information, e.g., via the sixth link 156.

[0092] According to some embodiments herein, a new API may be defined to enable the first node 111 to obtain the first information.

[0093] In some embodiments, the first information may be comprised in a provision request, e.g., in a provision request message. In such embodiments, the third identifier may indicate the identity of the node triggering the request. The provision request may be understood to be a message to indicate a list of allowed non-3GPP devices connected behind the first device 131, e.g., a UE.

[0094] In some particular embodiments, the new API may be a Nnef API, e.g., Nnef_Device_Provision.

[0095] In particular embodiments, e.g., wherein the first node 111 may be a NEF, the provision request may be an Nnef_Device_Provision Request message.

[0096] The obtaining of the first information may be performed responsive to the another node 115, deciding to provision, through the first node 111 , the allowed non-3GPP devices connected behind the first device 131 on a per subscriber basis, of the one or more subscribers, e.g., on an enterprise subscriber basis.

[0097] In particular non-limiting examples of embodiments herein, the first information may be comprised in a Nnef_Device_Provision Request message including the following information: the third identifier, e.g., AF-ID, the second identifier, e.g., enterprise-ID, a list of the first identifiers, e.g., SlIPI, and a list of the respective identifiers, e.g., Device-ID, for the respective first identifiers. Optionally, the first information may further comprise the one or more filters, DNN and / or S-NSSAI for which the request may apply. By obtaining the first information in this Action 301 , the first node 111 may enable the another node 115, which may be a third party, the possibility to provision the one or more devices 130, e.g., the allowed non-3GPP devices connected behind the first device 131, on a per subscriber basis. This may enable the first node 111 to store the first information in the communications system 100 so that the first information may be eventually provided to the third node 113 and thereby enable the third node 113 to generate one or more rules to manage the traffic of the one or more devices 130 and the other devices 135 accordingly. By enabling to ultimately generate the one or more rules, the first node 111 may allow the MNO to then apply differentiated policies, e.g., traffic management actions, for the one or more devices 130 connected behind the first device 131 , especially in vertical, e.g., enterprise, loT, environments. This may be understood to then allow in turn the MNO to improve security in vertical environments as allowed non-3GPP traffic may be understood to not get routed to the Internet.

[0098] Action 302

[0099] In some embodiments, the first information may be comprised in the provision request and the first information may further comprise the third identifier of the another node 115. In some of these embodiments, in this Action 302, the first node 111 may authorize the provision request based on the third identifier.

[0100] In some examples, after authorizing the request, the first node 111 may answer the another node 115 indicating successful operation.

[0101] By authorizing the request based on the third identifier in this Action 302, the first node 111 may be enabled to ensure the first information obtained in Action 301 does not originate from a source having no authority to provide such information.

[0102] Action 303

[0103] In this Action 303, the first node 111 initiates storage of the obtained first information.

[0104] In some embodiments, the initiating in this Action 303 of the storage of the obtained first information may comprise sending a first indication to the second node 112 operating in the communications system 100. The first indication may indicate to store the first information, e.g., as subscription data.

[0105] Initiating may be understood as triggering, enabling, facilitating, the storing by another node, or starting the storing itself.

[0106] The second node 112 may be a UDR. This may apply to embodiments wherein the communications system 100 may be a 5G network.

[0107] In particular non-limiting examples, in this Action 303, the NEF may request a UDR to store the AF request obtained in Action 301. According to embodiments herein, the subscription data in the second node 112 may be extended with the first information. The first information may comprise: a) the third identifier, e.g., AF-ID, indicating the identity of the another node 115 triggering the request, b) the second identifier, e.g., enterprise-ID, indicating the identity of the set of one or more subscribers for which the request may apply to, c) the first identifier, for example, the list of first identifier(s), e.g., SlIPI, indicating for which subscriber(s) the request may apply to, d) the list of respective identifiers, e.g., Device-ID, indicating the device identifier(s) which may connect to the first device 131, e.g., the subscriber's UE, and which may be allowed to use the resources of the communications system 100 allocated to the set of one or more subscribers, e.g., enterprise resources, such as e.g., enterprise VPN.

[0108] Optionally, the first information may further comprise the one or more filters, e.g., DNN and / or S-NSSAI, e.g., DNN / S-NSSAI=enterprise-ID, for which the request may apply.

[0109] The sending in this Action 303 of the first indication may be performed, e.g., via the first link 151.

[0110] By initiating storing the first information in this Action 303, the stored first information may be enabled to be retrieved from the second node 112 by the third node 113 and thereby eventually enable the third node 113 to generate one or more rules to manage the traffic of the one or more devices 130 and the other devices 135 accordingly. By enabling to ultimately generate the one or more rules, the first node 111 may allow the MNO to then apply differentiated policies, e.g., traffic management actions, for the one or more devices 130 connected behind the first device 131, especially in vertical, e.g., enterprise, loT, environments. This may be understood to then allow in turn the MNO to improve security in vertical environments as allowed non-3GPP traffic may be understood to not get routed to the Internet.

[0111] Embodiments of a computer-implemented method performed by the second node 112, will now be described with reference to the flowchart depicted in Figure 4. The method may be understood to be for handling the one or more devices 130. The second node 112 operates in the communications system 100.

[0112] The method may comprise the following actions. Several embodiments are comprised herein. One or more embodiments may be combined, where applicable. All possible combinations are not described to simplify the description. It should be noted that the examples herein are not mutually exclusive. Components from one example may be tacitly assumed to be present in another example and it will be obvious to a person skilled in the art how those components may be used in the other examples.

[0113] The detailed description of some of the following corresponds to the same references provided above, in relation to the actions described for the first node 111 and will thus not be repeated here to simplify the description. For example, the resources of the communications system 100 allocated to the set of one or more subscribers may be a VPN of the set of one or more subscribers.

[0114] Action 401

[0115] In this Action 401, the second node 112 receives the first indication from the first node 111 operating in the communications system 100. The first indication indicates to store the first information. The first information comprises: i) the first identifier identifying the first subscriber of the communications system 100, ii) the respective identifier of the one or more devices 130 that are allowed to connect to the first device 131 of the first subscriber and use the resources of the communications system 100 allocated to the set of one or more subscribers, wherein the first subscriber is comprised in the set of one or more subscribers, and iii) the second identifier of the set of one or more subscribers.

[0116] The receiving in this Action 401 may be performed, e.g., via the first link 151.

[0117] In some embodiments, the other devices 135 for which no respective identifier may be comprised in the first information may be implicitly unallowed to use the resources of the communications system 100 allocated to the set of one or more subscribers while connected to the first device 131 of the first subscriber. The other devices 135 may lack a subscription to use communications system 100.

[0118] In some embodiments, at least one of the following may apply: a) the first identifier may be the SlIPI, b) the respective identifier may be the respective device-ID, c) the set of one or more subscribers may have the SLA with the MNO of the communications system 100, d) the set of one or more subscribers may be one of: the enterprise, the loT group of subscribers, the MBB group of subscribers, e) the first information may further comprise the one or more filters to be applied for the usage of the resources, f) the one or more filters may comprise at least one of a DNN and a S-NSSAI, g) the first information may further comprise the third identifier of the another node 115 operating via the communications system 100 from which the first information may originate, h) the one or more devices 130 may lack a subscription to use communications system 100, i) the one or more devices 130 may be non-3GPP devices, j) the communications system 100 may be a 5G network, k) the first node 111 may be a NEF, I) the another node 115 may be an AF, m) the second node 112 may be a UDR, n) the first indication may be comprised in the request to store the first information as subscription data, and o) the first indication may be the Nudr_DM_Request. Action 402

[0119] In this Action 402, the second node 112 stores the received first information in Action

[0120] 401.

[0121] Action 403

[0122] In this Action 403, the second node 112 may receive an additional indication from the third node 113 operating in the communications system 100. The additional indication may request to receive subscriber data corresponding to the first identifier. The additional indication may be referred to later as the third indication.

[0123] In an example of embodiments herein, the additional indication may be a Nudr_Get Request comprising the first identifier of the first device 131 , e.g., the SlIPI.

[0124] Action 404

[0125] In this Action 404, the second node 112 may provide at least part of the first information to the third node 113 operating in the communications system 100. The providing of the at least part of the first information may comprise sending another indication comprising the at least part of the first information. The another indication may be responsive to the received additional indication.

[0126] The sending may be performed via the second link 152.

[0127] The part of the first information, in some examples, may comprise the respective identifier, e.g., the list of the respective identifiers, e.g., the list of Device-IDs and the second identifier of the set of one or more subscribers.

[0128] In some embodiments, at least one of the following may apply: a) the first identifier may be the SLIPI, b) the respective identifier may be the respective device-ID, c) the set of one or more subscribers may have the SLA with the MNO of the communications system 100, d) the set of one or more subscribers may be one of: the enterprise, the loT group of subscribers, the MBB group of subscribers, e) the first information may further comprise the one or more filters to be applied for the usage of the resources, f) the one or more filters may comprise at least one of a DNN and a S-NSSAI, g) the first information may further comprise the third identifier of the another node 115 operating via the communications system 100 from which the first information may originate, h) the one or more devices 130 may lack a subscription to use communications system 100, i) the one or more devices 130 may be non-3GPP devices, j) the communications system 100 may be a 5G network, k) the first node 111 may be a NEF, I) the another node 115 may be an AF, m) the second node 112 may be a UDR, n) the first indication may be comprised in the request to store the first information as subscription data, o) the first indication may be the Nudr_DM_Request, p) the providing in this Action 404 of the at least part of the first information may comprise sending the another indication comprising the at least part of the first information, and p) the third node 113 may be a PCF.

[0129] Embodiments of a computer-implemented method performed by the third node 113, will now be described with reference to the flowchart depicted in Figure 5. The method may be understood to be for handling the one or more devices 130. The third node 113 is operating in the communications system 100.

[0130] The method may comprise the following actions. Several embodiments are comprised herein. In some embodiments, the method may comprise all the actions. In other embodiments, the method may comprise one or more actions. One or more embodiments may be combined, where applicable. All possible combinations are not described to simplify the description. It should be noted that the examples herein are not mutually exclusive. Components from one example may be tacitly assumed to be present in another example and it will be obvious to a person skilled in the art how those components may be used in the other examples. In Figure 5, optional actions are depicted with dashed lines.

[0131] The detailed description of some of the following corresponds to the same references provided above, in relation to the actions described for the first node 111 and will thus not be repeated here to simplify the description. For example, the resources of the communications system 100 allocated to the set of one or more subscribers may be a VPN of the set of one or more subscribers.

[0132] Action 501

[0133] In this Action 501 , the third node 113 may receive a second indication from the fourth node 114 operating in the communications system 100. The second indication may request to create a policy. The policy may comprise one or more rules to indicate, to the first device 131, to route traffic generated by the one or more devices 130, while connected to the first device 131 to communicate via the communications system 100, using at least a subset of the resources of the communications system 100 allocated to the set of one or more subscribers.

[0134] The second indication may further indicate the first identifier, e.g., the SlIPI.

[0135] The obtaining in this Action 501 may comprise receiving and be performed, e.g., via the tenth link 160.

[0136] The third node 113 may receive the second indication after the fourth node 114 may be triggered to send the second indication by the first device 131 initiating a registration procedure with the communications system 100. The first device 131 may initiate the registration by triggering a Registration Request message towards the fourth node 114 including the first identifier, e.g., the SLIPI. The fourth node 114 may be an AMF. The third node 113 may be a PCF. In some of such embodiments, the second indication may be a Npcf_AMPolicyControl_Create Request message.

[0137] As a result of the first device 131 triggering the Registration Request message towards the fourth node 114, the fourth node 114, e.g., an AMF, may create the Access and Mobility (AM) policy association by triggering the second indication, e.g., the Npcf_AMPolicyControl_Create Request message towards the third node 113 including the first identifier.

[0138] By obtaining the second indication comprising the first identifier in this Action 501 , the third node 113 may then be enabled to generate the policy based on the first information, e.g., subscription data, that may be stored for that first identifier, and which may enable to manage the traffic of the one or more devices 130 and the other devices 135 accordingly. That is, to generate the policy that may enable the MNO to then apply differentiated policies, e.g., traffic management actions, for the one or more devices 130 connected behind the first device 131 , especially in vertical, e.g., enterprise, loT, environments. This may be understood to then allow in turn the MNO to improve security in vertical environments as allowed non- 3GPP traffic may be understood to not get routed to the Internet.

[0139] Action 502

[0140] The third node 113, in this Action 502, may send, responsive to the received second indication, a third indication to the second node 112 operating in the communications system 100. The third indication may request to receive subscriber data corresponding to the first identifier. The third indication may comprise the first identifier, e.g., the SlIPI.

[0141] The second node 112 may be the UDR. In some embodiments wherein the second node 112 may be a UDR, the third indication may be a Nudr_Get Request message.

[0142] The sending in this Action 502 may be performed, e.g., via the first link 151.

[0143] By sending the third indication in this Action 502, the third node 113 may be enabled to retrieve subscriber data from the second node 112.

[0144] Action 503

[0145] In this Action 503, the third node 113 obtains the first information. The first information indicates, for the first subscriber of the communications system 100, the first identifier identifying the first subscriber of the communications system 100. The first information also indicates, for the first subscriber of the communications system 100, the respective identifier of the one or more devices 130 that are allowed to connect to the first device 131 of the first subscriber and use the resources of the communications system 100 allocated to the set of one or more subscribers. As stated earlier, the first subscriber is comprised in the set of one or more subscribers. The first information further indicates the second identifier of the set of one or more subscribers.

[0146] In some embodiments, at least one of the following may apply: a) the first identifier may be the SlIPI, b) the respective identifier may be the respective device-1 D, c) the set of one or more subscribers may have the SLA with the MNO of the communications system 100, d) the set of one or more subscribers may be one of: the enterprise, the loT group of subscribers, the MBB group of subscribers, e) the first information may further comprise the one or more filters to be applied for the usage of the resources, f) the one or more filters may comprise at least one of a DNN and a S-NSSAI, e.g., filters to indicate to which PDU Sessions, on which network slices or to which Data Networks, the request in the third indication may apply, g) the first information may further comprise the third identifier of the another node 115 operating via the communications system 100 from which the first information may originate, h) the one or more rules may be LIRSP rules, i) the one or more devices 130 may lack a subscription to use communications system 100, j) the one or more devices 130 may be non-3GPP devices, k) the subset of resources may correspond to a PDU session established according to a set of rules applying to the set of one or more subscribers I) the communications system 100 may be a 5G network, m) the first node 111 may be a NEF, n) the another node 115 may be an AF, and o) the third node 113 may be a PCF.

[0147] The obtaining in this Action 501 may comprise receiving, retrieving, fetching or similar and be performed, e.g., via the second link 152 and / or the third link 153. The obtaining in this Action 501 may be performed in a single step, or in a step-wise fashion, by first obtaining at least part of the first information.

[0148] For example, in some embodiments, the first information may be obtained from the second node 112 responsive to the sent third indication.

[0149] The obtaining of the at least part of the first information may comprise receiving the another indication comprising the at least part of the first information. In typical examples, at least a part of the first information, particularly, the respective identifier, e.g., the list of Device- ID, and the second identifier, e.g., the enterprise-ID, may be obtained from the second node 112. The first identifier may be obtained in Action 501 from the fourth node 114, in the second indication.

[0150] The part of the first information that may be obtained from the second node 112 may be the subscriber data which may have been stored in Action 402 for the first identifier, e.g., the SUPI.

[0151] The other devices 135 for which no respective identifier may be comprised in the first information may be implicitly unallowed to use the resources of the communications system 100 allocated to the set of one or more subscribers while connected to the first device 131 of the first subscriber. The other devices 135 may lack a subscription to use communications system 100.

[0152] Action 504

[0153] In this Action 504, the third node 113 generates, based on the obtained first information, a policy. The policy comprises one or more rules. The one or more rules are to indicate to the first device 131 to route traffic generated by the one or more devices 130, while connected to the first device 131 to communicate via the communications system 100, using at least a subset of the resources of the communications system 100 allocated to the set of one or more subscribers. The one or more rules may be URSP rule / s.

[0154] The one or more rules may be to indicate to the first device 131 to, explicitly, route traffic generated by the one or more devices 130, while connected to the first device 131 to communicate via the communications system 100, using at least the subset of the resources of the communications system 100 allocated to the set of one or more subscribers.

[0155] The subset of the resources may be e.g., the corresponding PDU session, e.g., the corresponding DNN and / or S-NSSAI of the set of one or more subscribers.

[0156] For example, the one or more rules may indicate the first device 131 towards which DNN and S-NSSAI to route the first device 131 and traffic of the one or more devices 130, e.g., Device traffic, to. For this, the LIRSP rules may be extended to influence the first device 131 to route the traffic generated by the one or more devices 130, that is, the allowed, e.g., non- 3GPP devices, identified by their respective device identifiers, connected behind the first device 131 , towards the corresponding DNN and / or S-NSSAI. The LIRSP rules may need to be extended as the Traffic Descriptor in the LIRSP rule according to existing methods currently applies to traffic, e.g., App-IDs, generated by UE, not to traffic generated by devices connected to the UE. The URSP extension according to embodiments herein may comprise defining a new type of Traffic Descriptor for the connected devices via shared connection, which may comprise the list of allowed devices with their device identifiers. For example, the URSP extension may comprise the respective identifier of the one or more devices 130 that may be allowed to connect to the first device 131 of the first subscriber and use the resources of the communications system 100 allocated to the set of one or more subscribers.

[0157] Based on that, when one of the one or more devices 130, that is, the allowed devices connects via UE shared connection, all of its traffic may get routed to the corresponding PDU session, e.g., DNN / S-NSSAI=enterprise.

[0158] Action 505

[0159] The third node 113, after having generated the policy in Action 504, e.g., based on the generated URSP rules, may decide to update the policy of the first device 131 and invoke the procedure for UE Configuration Update, e.g., as defined in 3GPP TS 23.502 4.2.4.3, v. 18.4.0, to deliver the one or more rules to the first device 131.

[0160] In this Action 505, the third node 113 provides a further indication of the generated policy towards the first device 131. The further indication may be understood to be a fifth indication.

[0161] The providing in this Action 505 of the further indication may comprise sending the further indication to the fourth node 114. The further indication may be a Namf_Communication_N 1 N2MessageT ransfer message.

[0162] The further indication may comprise a first descriptor of the traffic indicating the respective identifier of the one or more devices 130. The first descriptor may be a Traffic descriptor.

[0163] The further indication may further comprise a second descriptor of a route for the traffic. The second descriptor may indicate the subset of the resources of the communications system 100. The second descriptor may be a Route selection descriptor.

[0164] In a particular example, the further indication may be a Namf_Communication_N1N2MessageT ransfer message including the following information: URSP rule including: a Traffic descriptor list of Device-ID and a Route selection descriptor (DNN / S-NSSAI=enterprise-ID).

[0165] By providing the further indication towards the first device 131 in this Action 505, e.g., via the fourth node 114, enabling the fourth node 114 to deliver the content of the further indication to the first device 131, the third node 113 thereby enables the first device 131 to ultimately manage the traffic of the one or more devices 130 and the other devices 135 accordingly. The first device 131 may then apply differentiated policies, e.g., traffic management actions, for the one or more devices 130 connected behind the first device 131 , especially in vertical, e.g., enterprise, loT, environments. This may be understood to then allow in turn the MNO to improve security in vertical environments as allowed non- 3GPP traffic may be understood to not get routed to the Internet.

[0166] Embodiments of a computer-implemented method performed by the first device 131 , will now be described with reference to the flowchart depicted in Figure 6. The method may be understood to be for handling the one or more devices 130. The first device 131 is operating in the communications system 100. The first device 131 is of the first subscriber of the communications system 100.

[0167] The method may comprise the following actions. Several embodiments are comprised herein. In some embodiments, the method may comprise all the actions. In other embodiments, the method may comprise some of the actions. One or more embodiments may be combined, where applicable. All possible combinations are not described to simplify the description. It should be noted that the examples herein are not mutually exclusive. Components from one example may be tacitly assumed to be present in another example and it will be obvious to a person skilled in the art how those components may be used in the other examples. In Figure 6, optional actions are depicted with dashed lines.

[0168] The detailed description of some of the following corresponds to the same references provided above, in relation to the actions described for the first node 111 and will thus not be repeated here to simplify the description. For example, the resources of the communications system 100 allocated to the set of one or more subscribers may be a VPN of the set of one or more subscribers.

[0169] Action 601

[0170] In this Action 601 , the first device 131 obtains, directly or indirectly, the further indication from the third node 113 operating in a communications system 100. The further indication indicates the one or more rules to route traffic generated by the one or more devices 130. The one or more devices 130 are allowed to connect to the first device 131 and use the resources of the communications system 100 allocated to the set of one or more subscribers. The first subscriber is comprised in the set of one or more subscribers. The one or more rules are to route the traffic generated by the one or more devices 130 while connected to the first device 131 to communicate via the communications system 100, using at least the subset of resources of the communications system 100 allocated to the set of one or more subscribers. The further indication comprises the first descriptor of the traffic indicating the respective identifier of the one or more devices 130. The further indication also comprises the second descriptor of the route for the traffic generated by the one or more devices 130, while connected to the first device 131 to communicate via the communications system 100. The second descriptor indicates the subset of the resources of the communications system 100.

[0171] In some embodiments, the obtaining in this Action 601 of the further indication may comprise receiving the further indication from the fourth node 114 operating in the communications system 100. The fourth node 114 may be an AMF.

[0172] Other devices 135 for which no respective identifier may be comprised in the first descriptor may be implicitly unallowed to use the resources of the communications system 100 allocated to the set of one or more subscribers while connected to the first device 131 of the first subscriber. The other devices 135 may lack a subscription to use communications system 100.

[0173] In some embodiments, at least one of the following may apply: a) the respective identifier may be the respective device-ID, b) the set of one or more subscribers may have the SLA with the MNO of the communications system 100, c) the set of one or more subscribers may be one of: the enterprise, the loT group of subscribers, the MBB group of subscribers, d) the second descriptor may indicate at least one of a DNN and a S-NSSAI, e) the one or more rules may be URSP rules, f) the one or more devices 130 may lack a subscription to use communications system 100, g) the one or more devices 130 may be non-3GPP devices, h) the subset of resources may correspond to the PDU session established according to the set of rules applying to the set of one or more subscribers, i) the communications system 100 may be a 5G network, j) the first node 111 may be a NEF, and k) the third node 113 may be a PCF.

[0174] Action 602

[0175] The first device 131, in this Action 602, may store the one or more rules.

[0176] The method performed by the first device 131 may further comprise at least one of Action 603 and Action 604.

[0177] Action 603

[0178] In this Action 603, the first device 131 may detect first traffic from the second device 132, and may determine whether or not the second device 132 may have one of the respective identifiers of the one or more devices 130 indicated in the first descriptor.

[0179] Action 604

[0180] In this Action 604, the first device 131 may detect second traffic from the third device 133, and may determine whether or not the third device 133 has one of the respective identifiers of the one or more devices 130 indicated in the first descriptor.

[0181] Action 605

[0182] In this Action 605, the first device 131 routes the traffic according to the indicated one or more rules.

[0183] In some embodiments, with the proviso the first device 131 may determine that the second device 132 has one of the respective identifiers of the one or more devices 130, based on the stored one or more rules, the routing in this Action 605 of the traffic may comprise routing the traffic using at least the subset of resources of the communications system 100 allocated to the set of one or more subscribers, e.g., routing the traffic through the established PDU session corresponding to the subset of resources according to the route indicated by the second descriptor.

[0184] In some embodiments, with the proviso the first device 131 may determine that the third device 133 lacks any of the respective identifiers of the one or more devices 130, based on the stored one or more rules, the routing in this Action 605 of the traffic may comprise routing the traffic refraining from using at least the subset of resources of the communications system 100 allocated to the set of one or more subscribers, e.g., routing the traffic through a different PDU session lacking a correspondence to the subset of resources according to the route indicated by the second descriptor.

[0185] Figure 7 is a schematic diagram depicting a non-limiting example of signalling between nodes in the communications system 100, according to embodiments herein. Particularly, Figure 7 depicts an example of a method performed in an enterprise environment. In Figure 7, the communications system 100 is a 5G network, the first node 111 is a NEF, the second node 112 is a UDR, the third node 113 is a PCF, the fourth node 114 is an AMF, the sixth node 116 is a UPF, the first device 131 is a 3GPP UE, the one or more devices 130 are allowed non- 3GPP devices and the other devices 135 are non-allowed non-3GPP devices. It may be understood that in the following example depicted in Figure 7, any reference to the NEF may be understood to equally refer to the first node 111 , any reference to the UDR may be understood to equally refer to the second node 112, any reference to the PCF may be understood to equally refer to the third node 113, any reference to the AMF may be understood to equally refer to the fourth node 114, any reference to the UPF may be understood to equally apply to the sixth node 116, any reference to the 3GPP UE may be understood to equally refer to the first device 131 , any reference to the allowed non-3GPP devices may be understood to equally refer to the one or more devices 130 and any reference to the non-allowed non-3GPP devices may be understood to equally refer to the other devices 135. At 1 a, the first node 111, in accordance with Action 301 , obtains the first information from the another node 115 via an Access Point Name (APN) 701 of the set of one or more subscribers, here enterprise in a provision of allowed devices IDs per SUPI and DNN. At 1b, the first node 111, in accordance with Action 303 and Action 401 , sends the first indication to the second node 112 to store the allowed devices IDs per SUPI and DNN. At 2a, the first device 131 sends a registration request to the fourth node 114, comprising the first identifier, its SUPI, and, later, in a response received from the fourth node 114, in accordance with Action 505 and Action 601 , receives the further indication indicating the Devices IDs of the one or more devices 130 and the one or more rules to route the traffic generated by the one or more devices 130 while connected to the first device 131 to communicate via the communications system 100, using at least the subset of resources of the communications system 100 allocated to the set of one or more subscribers, here a DNN. At 2b, the fourth node 114 sends, in accordance with Action 501 , the second indication to the third node 113 comprising a request for policies for the SUPI of the first device 131, and later receives, in agreement with Action 505, a response indicating the policies generated by the third node 113, comprising the one or more rules to indicate to the first device 131 to route traffic generated by the one or more devices 130, indicated by the Device IDs, while connected to the first device 131 to communicate via the communications system 100, using at least the subset of the resources of the communications system 100 allocated to the set of one or more subscribers, here the DNN. At 2c, the third node 113, in accordance with Action 502, sends the third indication to the second node 112, with a request for the policies for the SlIPI of the first device 131, and then, in accordance with Action 404 and Action 503, the third node 113 receives a response with the policies indicating the Device IDs of the one or more devices 130 and the subset of the resources, here the DNN. At 3, the first device 131 triggers a PDU session establishment including the SLIPI and the requested DNN and S-NSSAI for the enterprise. At 4, the first device 131 also triggers a PDU session establishment including the requested DNN for the internet. At 5b, the first device 131 routes, via the sixth node 116, its own traffic via the APN of the enterprise 701. At 6a, the first device 131 , in accordance with Action 603, detects allowed device traffic from the second device 132 belonging to the one or more devices 130. At 6b, traffic generated by the allowed non-3GPP devices connected behind the 3GPP UE are able to access the enterprise resources, e.g., enterprise VPN connection, as this traffic gets routed, in accordance with Action 605, through the enterprise PDU session, enterprise DNN in the example. At 7a, the first device 131, in accordance with Action 604, detects non-allowed device traffic from the third device 133 belonging to the other devices 135. At 7b, traffic generated by the non-allowed non-3GPP devices connected behind the 3GPP UE are not able to access the enterprise resources, e.g., enterprise VPN connection, as this traffic gets routed, in accordance with Action 605, through the default PDU session, internet DNN in the example, via an APN: internet 702.

[0186] Figure 8 is a schematic diagram depicting another non-limiting example of signalling between nodes in the communications system 100, according to embodiments herein. Particularly, Figure 8 depicts an example of a method of a provisioning procedure via NEF extensions by the another node 115. In Figure 8, the communications system 100 is a 5G network, the first node 111 is a NEF, the second node 112 is a U DR and the another node 115 is an Application Function (AF). It may be understood that in the following example depicted in Figure 8, any reference to the NEF may be understood to equally refer to the first node 111, any reference to the UDR may be understood to equally refer to the second node 112, and any reference to the AF may be understood to equally refer to the another node 115. In Steps 1 and 2), the AF, e.g., an AF pertaining to a certain enterprise, decides to provision, through the NEF, the allowed non-3GPP devices connected behind a UE on a per enterprise subscriber basis. A new Nnef API, e.g., Nnef_Device_Provision, may be defined according to embodiments herein, so that the AF may trigger a Nnef_Device_Provision Request message including the following information: i) AF-ID, which may indicate the identity of the AF triggering the request, ii) enterprise-ID, which may indicate the identity of the enterprise for which the request applies to; in this example it is an enterprise, but it may be another vertical, e.g., loT and even MBB subscribers, iii) a list of SlIPI, which may indicate for which subscriber(s) the request applies to, iv) a list of Device-1 D, which may indicate the device identifier(s) which may connect to the subscriber's UE and which may use the enterprise resources, e.g., enterprise VPN, and v) optionally, the DNN and / or S-NSSAI, e.g., DNN / S- NSSAI=enterprise-ID, for which the request applies. The NEF receives the request in accordance with Action 301. In Steps 3 and 4, the NEF authorizes the request in accordance with Action 302 and answers the AF indicating successful operation. In Steps 5 to 8, the NEF, in accordance with Action 303, decides to store the AF request in the UDR, and requests the UDR to store the AF request, e.g., as subscription data. This is performed by sending a Nudr_DM request to the UDR. According to embodiments herein, the subscription data in the UDR may be extended with the following information: i) the AF-ID, which may indicate the identity of the AF triggering the request, ii) the enterprise-ID, which may indicate the identity of the enterprise for which the request applies to; in this example it is an enterprise, but it may be another vertical, e.g., loT and even MBB subscribers, iii) the list of SUPI, which may indicate for which subscriber(s) the request applies to, iv) the list of Device-ID, which may indicate the device identifier(s) which may connect to the subscriber's UE and which may use the enterprise resources, e.g., enterprise VPN, and v) optionally, the DNN and / or S-NSSAI, e.g., DNN / S-NSSAI=enterprise-ID, for which the request applies. At Step 7, the UDR stores the AF request in accordance with Action 402 and sends a response to the NEF.

[0187] Figure 9 is a schematic diagram depicting another non-limiting example of signalling between nodes in the communications system 100, according to embodiments herein. Particularly, Figure 9 depicts an example of a method performed in an enterprise environment. In Figure 9, the communications system 100 is a 5G network, the second node 112 is a UDR, the third node 113 is a PCF, the fourth node 114 is an AM F, the another node 115 is an Application Server (AS), the sixth node 116 is a UPF, the seventh node 117 is an SMF, the first device 131 is a UE, the second device 132 is an allowed non-3GPP device depicted as Device #1 allowed and the third device 133 is a non-allowed non-3GPP device depicted as Device #2 unknown. It may be understood that in the following example depicted in Figure 9, any reference to the UDR may be understood to equally refer to the second node 112, any reference to the PCF may be understood to equally refer to the third node 113, any reference to the AMF may be understood to equally refer to the fourth node 114, any reference to the Application Server may be understood to equally refer to the another node 115, any reference to the UPF may be understood to equally refer to the sixth node 116, any reference to the SMF may be understood to equally refer to the seventh node 117, any reference to the UE may be understood to equally refer to the first device 131 , any reference to Device #1 may be understood to equally refer to the second device 132 and any reference to Device #2 may be understood to equally refer to the third device 133. It may be understood that the sequence diagram in Figure 9 does not include all the signaling messages involved in the Registration and PDU Session Establishment procedure. Only selected signaling messages are described in subsequent steps. Registration: Starting in panel a), in Step 1) the UE initiates a registration procedure by triggering a Registration Request message towards the AMF including the SlIPI. In Step 2), the AMF creates the AM policy association by triggering a Npcf_AMPolicyControl_Create Request message towards the PCF including the SLIPI, which request is received by the third node 113 in accordance with Action 501. In Steps 3 and 4), in accordance with Action 502 and Action 403, the PCF initiates retrieving subscriber data from the UDR by triggering a Nudr_Get Request message including the SLIPI. In Step 5), the UDR, in accordance with Action 404 and Action 503, answers with the subscriber data, specifically at least part of the first information stored as per the sequence diagram in Figure 8: i) the enterprise-ID, which may indicate the identity of the enterprise for which the request applies to; in this example it is an enterprise, but it may be another vertical, e.g., loT and even MBB subscribers, ii) the list of Device-ID, which may indicate the device identifier(s) which may connect to the subscriber's UE and which may use the enterprise resources, e.g., enterprise VPN, and iii) optionally, the DNN and / or S-NSSAI, as filters to indicate to which PDU Sessions, e.g., on which network slices or to which Data Networks, this request applies. In Step 6), the PCF generates, in accordance with Action 504, URSP rule / s to indicate to the UE towards which DNN and S-NSSAI to route the UE and the traffic of Devices behind the UE to. For this, the URSP rules may be extended according to embodiments herein to influence the UE to route the traffic generated by the allowed non-3GPP devices, as identified by their device identifiers, connected behind the UE towards the corresponding DNN and / or S-NSSAI. As stated earlier, the Traffic Descriptor in the URSP rule may be understood to currently apply to traffic, e.g., App-IDs, generated by UE, not to traffic generated by devices connected to the UE. The URSP extension described according to embodiments herein may comprise defining a new type of Traffic Descriptor, connected devices via shared connection, which may include the list of allowed devices, as identified by their device identifiers. Based on that, when one of the allowed devices may connect via a UE shared connection, all of its traffic may get routed to the corresponding PDU session, e.g., DNN / S-NSSAI=enterprise. The PCF may decide to update the UE policy, as per 3GPP TS 23.502 4.2.4.3, v. 18.4.0. Continuing in panel b), in Step 7), based on the generated URSP rules in Step 7 above, the PCF, in accordance with Action 505 and Action 601 , invokes the procedure for UE Configuration Update, as defined in 3GPP 23.502 section 4.2.4.3, v. 18.4.0, to deliver the URSP rules to the UE, by triggering a Namf_Communication_N1N2MessageTransfer message including the following information: the URSP rule including: a Traffic descriptor list of Device-ID and a Route selection descriptor (DNN / S-NSSAI=enterprise-ID). In Step 8), the AMF triggers delivery of the UE policies by forwarding transparently the message in Step 7 to the UE. In Step 9), in accordance with 602, the UE stores the received URSP rule / s. In Step 10), the PCF triggers towards the AMF a Npcf_AMPolicyControl_Create Response. In Step 11), the AMF triggers a Registration Accept message towards the UE. PDU Session Establishment: In Step 12), the UE triggers PDU session establishment, e.g., DNN / S-NSSAI=enterprise-ID, by sending a PDU Session Establishment Request to the AMF including the SUPI and the requested DNN and S- NSSAI. In Step 13), the AMF triggers a Nsmf PDU Session Create message towards the SMF including the SUPI and the requested DNN and S-NSSAI. In Step 14), the SMF triggers a Npcf_SMPolicyControl_Create Request message towards the PCF including the SUPI and the requested DNN and S-NSSAI. Continuing in panel c), in Steps 15 and 16), based on the information received in Step 5 above, the PCF generates PCC rule / s to apply traffic management actions for enterprise traffic, by triggering a Npcf_SMPolicyControl_Create Response message including the following information: List of PCC rule(s). In Step 17), the SMF selects UPF and in Step 18, the SMF triggers a PFCP Session Establishment Request message including the following information: List of Packet Detection Rules (PDR),

[0188] Forwarding Action Rules (FAR), QoS Enforcement Rules (QER), Usage Reporting Rules (URR). In Step 19), the UPF acknowledges the request by triggering a PFCP Session Establishment Response message towards the SMF. In Step 20), the SMF answers the message in Step 13 indicating successful operation by sending an Nsmf PDU Session Create Response. In Step 21), the AMF answers the message in Step 12 indicating successful operation by sending a PDU Session Establishment Response. Device #1 traffic: Continuing in panel d), in Step 22 and 23) Device #1 connects to the UE via hotspot and generates traffic. In Steps 24 and 25), in accordance with Action 603, the UE detects traffic from Device #1 and based on the URSP rule(s) provisioned in Step 8 above extended in accordance with embodiments herein, routes it, in accordance with Action 605, through the PDU session for

[0189] DNN / S-NSSAI=enterprise-ID. Continuing in panel d), in Steps 26 and 27), the UPF applies traffic management actions for traffic from Device #1 sends the Device#1 traffic to the AS.

[0190] Device #2 traffic: In Steps 28 and 29) Device #2 connects to the UE via hotspot and generates traffic. In Step 30 and 31), the UE, in accordance with Action 604, detects traffic from Device #2 and, in accordance with Action 605, routes it to the AS through a PDU session different to the one for DNN / S-NSSAI=enterprise-ID.

[0191] The 3GPP TS 29.522 specification may be updated to incorporate the new Nnef API described in embodiments herein, relative to provisioning allowed devices, e.g., with device identifiers, connected behind the UE. The 3GPP TS 24.526 specification may be updated to incorporate the new extension of the LIRSP rules, specifically traffic descriptor to support a list of devices, e.g., with device identifiers, connected behind UE described in embodiments herein.

[0192] The UDR may be updated to store as subscriber data the new the list of allowed devices, e.g., with device identifiers, connected behind the UE.

[0193] Certain embodiments disclosed herein may provide one or more of the following technical advantage(s), which may be summarized as follows.

[0194] An advantage of embodiments herein may be understood to be to allow the network operator to offer third parties the possibility to provision a list of allowed devices for vertical environments, e.g., enterprise, loT.

[0195] A further advantage of embodiments herein may be understood to allow the network operator of the communications system 100 to apply differentiated traffic management actions for the devices connected behind the UE, especially in vertical, e.g., enterprise, loT, environments.

[0196] Another advantage of embodiments herein may be understood to allow the network operator of the communications system 100 to improve security in vertical environments, e.g., enterprise, loT, as enterprise traffic may be understood to not get routed to the Internet.

[0197] Embodiments herein may allow to apply differentiated policies for enterprise traffic.

[0198] Another advantage of embodiments herein may be understood to be that enterprise may not require a VPN server as the MNO may be enabled to route traffic directly to the enterprise DNN.

[0199] Figure 10 depicts an example of the arrangement that the first node 111 may comprise to perform the method described in Figure 3, Figure 7 and / or Figure 8. The first node 111 may be understood to be for handling the one or more devices 130. The first node 111 is configured to operate in the communications system 100.

[0200] Several embodiments are comprised herein. It should be noted that the examples herein are not mutually exclusive. One or more embodiments may be combined, where applicable. All possible combinations are not described to simplify the description. Components from one embodiment may be tacitly assumed to be present in another embodiment and it will be obvious to a person skilled in the art how those components may be used in the other exemplary embodiments. The detailed description of some of the following corresponds to the same references provided above, in relation to the actions described for the first node 111 and will thus not be repeated here. For example, the resources of the communications system 100 configured to be allocated to the set of one or more subscribers may be configured to be a VPN of the set of one or more subscribers. The first node 111 is configured to obtain the first information from the another node 115 configured to operate via the communications system 100. The first information is configured to comprise: i) the first identifier configured to identify the first subscriber of the communications system 100, ii) the respective identifier of the one or more devices 130 that are configured to be allowed to connect to the first device 131 of the first subscriber and use the resources of the communications system 100 configured to be allocated to the set of one or more subscribers, wherein the first subscriber is configured to be comprised in the set of one or more subscribers, and iii) the second identifier of the set of one or more subscribers.

[0201] The first node 111 is also configured to initiate storage of the first information configured to be obtained.

[0202] In some embodiments, at least one of the following may apply: a) the first identifier may be configured to be the SlIPI, b) the respective identifier may be configured to be the respective Device-ID, c) the set of one or more subscribers may have the SLA with the MNO of the communications system 100, d) the set of one or more subscribers may be configured to be one of: the enterprise, the loT group of subscribers, and the MBB group of subscribers, e) the first information may be configured to further comprise the one or more filters to be applied for the usage of the resources, f) the one or more filters may be configured to comprise at least one of the DNN, and the S-NSSAI, g) the first information may be configured to further comprise the third identifier of the another node 115, h) the initiating of the storage of the obtained first information may be configured to comprise sending the first indication to the second node 112 configured to operate in the communications system 100, the first indication being configured to indicate to store the first information, i) the one or more devices 130 may be configured to lack a subscription to use communications system 100, j) the one or more devices 130 may be configured to be non-3GPP devices, k) the communications system 100 may be configured to be a 5G network, I) the first node 111 may be configured to be a NEF, m) the another node 115 may be configured to be an AF, n) the second node 112 may be configured to be a UDR, o) the first information may be configured to be comprised in a provision request, and p) the provision request may be configured to be an Nnef_Device_Provision Request.

[0203] In some embodiments, the first information may be configured to be comprised in the provision request and the first information may be configured to further comprise the third identifier of the another node 115, and the first node 111 may be further configured to authorize the provision request based on the third identifier.

[0204] In some embodiments, other devices 135 for which no respective identifier may be configured to be comprised in the first information may be configured to be implicitly unallowed to use the resources of the communications system 100 configured to be allocated to the set of one or more subscribers while connected to the first device 131 of the first subscriber. The other devices 135 may lack a subscription to use communications system 100.

[0205] The embodiments herein in the first node 111 may be implemented through one or more processors, such as a processing circuitry 1001 in the first node 111 depicted in Figure 10, together with computer program code for performing the functions and actions of the embodiments herein. A processor, as used herein, may be understood to be a hardware component. The program code mentioned above may also be provided as a computer program product, for instance in the form of a data carrier carrying computer program code for performing the embodiments herein when being loaded into the first node 111. One such carrier may be in the form of a CD ROM disc. It is however feasible with other data carriers such as a memory stick. The computer program code may furthermore be provided as pure program code on a server and downloaded to the first node 111.

[0206] The first node 111 may further comprise a memory 1002 comprising one or more memory units. The memory 1002 is arranged to be used to store obtained information, store data, configurations, schedulings, and applications etc. to perform the methods herein when being executed in the first node 111.

[0207] In some embodiments, the first node 111 may receive information from, e.g., the second node 112, the third node 113, the fourth node 114, the another node 115, the sixth node 116, the seventh node 117, the radio network node 140, the first device 131, the one or mode devices 130, the second device 132, the other devices 135, the third device 133, another node or user equipment, and / or another structure in the communications system 100, through a receiving port 1003. In some embodiments, the receiving port 1003 may be, for example, connected to one or more antennas in first node 111. In other embodiments, the first node 111 may receive information from another structure in the communications system 100 through the receiving port 1003. Since the receiving port 1003 may be in communication with the processing circuitry 1001 , the receiving port 1003 may then send the received information to the processing circuitry 1001. The receiving port 1003 may also be configured to receive other information.

[0208] The processing circuitry 1001 in the first node 111 may be further configured to transmit or send information to e.g., the second node 112, the third node 113, the fourth node 114, the another node 115, the sixth node 116, the seventh node 117, the radio network node 140, the first device 131, the one or mode devices 130, the second device 132, the other devices 135, the third device 133, another node or user equipment, and / or another structure in the communications system 100, through a sending port 1004, which may be in communication with the processing circuitry 1001, and the memory 1002.

[0209] Those skilled in the art will also appreciate that the units comprised within the first node 111 described above as being configured to perform different actions, may refer to a combination of analog and digital circuits, and / or one or more processors configured with software and / or firmware, e.g., stored in memory, that, when executed by the one or more processors such as the processing circuitry 1001, perform as described above. One or more of these processors, as well as the other digital hardware, may be included in a single Application-Specific Integrated Circuit (ASIC), or several processors and various digital hardware may be distributed among several separate components, whether individually packaged or assembled into a System-on-a-Chip (SoC).

[0210] The first node 111 may be configured to perform any of the Actions described in relation to Figure 3, Figure 7 and / or Figure 8, e.g., by means of the processing circuitry 1001 within the first node 111, configured to perform any of such actions.

[0211] Also, in some embodiments, different units comprised within the first node 111 may be configured to perform the different actions described above, implemented as one or more applications running on one or more processors such as the processing circuitry 1001.

[0212] Thus, the methods according to the embodiments described herein for the first node 111 may be respectively implemented by means of a computer program 1005 product, comprising instructions, i.e. , software code portions, which, when executed on at least one processing circuitry 1001, cause the at least one processing circuitry 1001 to carry out the actions described herein, as performed by the first node 111. The computer program 1005 product may be stored on a computer-readable storage medium 1006. The computer- readable storage medium 1006, having stored thereon the computer program 1005, may comprise instructions which, when executed on at least one processing circuitry 1001, cause the at least one processing circuitry 1001 to carry out the actions described herein, as performed by the first node 111. In some embodiments, the computer-readable storage medium 1006 may be a non-transitory computer-readable storage medium, such as a CD ROM disc, or a memory stick. In other embodiments, the computer program 1005 product may be stored on a carrier containing the computer program 1005 just described, wherein the carrier is one of an electronic signal, optical signal, radio signal, or the computer-readable storage medium 1006, as described above.

[0213] The first node 111 may comprise a communication interface configured to facilitate, or an interface unit to facilitate, communications between the first node 111 and other nodes or devices, e.g., the second node 112, the third node 113, the fourth node 114, the another node 115, the sixth node 116, the seventh node 117, the radio network node 140, the first device 131, the one or mode devices 130, the second device 132, the other devices 135, the third device 133, another node or user equipment, and / or another structure in the communications system 100. The interface may, for example, include a transceiver configured to transmit and receive radio signals over an air interface in accordance with a suitable standard.

[0214] In other embodiments, the first node 111 may comprise a radio circuitry 1007, which may comprise e.g., the receiving port 1003 and the sending port 1004.

[0215] The radio circuitry 1007 may be configured to set up and maintain at least a wireless connection with the second node 112, the third node 113, the fourth node 114, the another node 115, the sixth node 116, the seventh node 117, the radio network node 140, the first device 131 , the one or mode devices 130, the second device 132, the other devices 135, the third device 133, another node or user equipment, and / or another structure in the communications system 100. Circuitry may be understood herein as a hardware component.

[0216] Hence, embodiments herein also relate to the first node 111 operative to operate in the communications system 100. The first node 111 may comprise the processing circuitry 1001 and the memory 1002, said memory 1002 containing instructions executable by said processing circuitry 1001 , whereby the first node 111 is further operative to perform the actions described herein in relation to the first node 111, e.g., in Figure 3, Figure 7 and / or Figure 8.

[0217] Figure 11 depicts an example of the arrangement that the second node 112 may comprise to perform the method described in Figure 4, Figure 7, Figure 8 and / or Figure 9. The second node 112 may be understood to be for handling the one or more devices 130. The second node 112 is configured to operate in the communications system 100.

[0218] Several embodiments are comprised herein. It should be noted that the examples herein are not mutually exclusive. One or more embodiments may be combined, where applicable. All possible combinations are not described to simplify the description. Components from one embodiment may be tacitly assumed to be present in another embodiment and it will be obvious to a person skilled in the art how those components may be used in the other exemplary embodiments. The detailed description of some of the following corresponds to the same references provided above, in relation to the actions described for the second node 112 and will thus not be repeated here. For example, the resources of the communications system 100 configured to be allocated to the set of one or more subscribers may be configured to be a VPN of the set of one or more subscribers.

[0219] The second node 112 is configured to receive the first indication from the first node 111 configured to operate in the communications system 100. The first information is configured to comprise: i) the first identifier configured to identify the first subscriber of the communications system 100, ii) the respective identifier of the one or more devices 130 that are configured to be allowed to connect to the first device 131 of the first subscriber and use the resources of the communications system 100 configured to be allocated to the set of one or more subscribers, wherein the first subscriber is configured to be comprised in the set of one or more subscribers, and iii) the second identifier of the set of one or more subscribers. The second node 112 is also configured to store the first information configured to be received.

[0220] The second node 112 may be further configured to receive the additional indication from the third node 113 configured to operate in the communications system 100. The additional indication may be configured to request to receive the subscriber data corresponding to the first identifier.

[0221] The second node 112 may be additionally configured to provide at least part of the first information to the third node 113 responsive to the additional indication configured to be received.

[0222] In some embodiments, at least one of the following may apply: a) the first identifier may be configured to be the SlIPI, b) the respective identifier may be configured to be the respective Device-ID, c) the set of one or more subscribers may have the SLA with the MNO of the communications system 100, d) the set of one or more subscribers may be configured to be one of: the enterprise, the loT group of subscribers, and the MBB group of subscribers, e) the first information may be configured to further comprise the one or more filters to be applied for the usage of the resources, f) the one or more filters may be configured to comprise at least one of the DNN, and the S-NSSAI, g) the first information may be configured to further comprise the third identifier of the another node 115 configured to operate via the communications system 100 from which the first information may originate, h) the one or more devices 130 may be configured to lack a subscription to use communications system 100, i) the one or more devices 130 may be configured to be non-3GPP devices, j) the communications system 100 may be configured to be a 5G network, k) the first node 111 may be configured to be a NEF, I) the another node 115 may be configured to be an AF, m) the second node 112 may be configured to be a UDR, n) the first indication may be configured to be comprised in the request to store the first information as subscription data, o) the first indication may be configured to be a Nudr_DM_Request, p) the providing of the at least part of the first information may be configured to comprise sending the another indication configured to comprise the at least part of the first information, and q) the third node 113 may be configured to be a Policy Control Function, PCF.

[0223] The another indication may be also understood to be a fourth indication.

[0224] In some embodiments, the other devices 135 for which no respective identifier may be configured to be comprised in the first information may be configured to be implicitly unallowed to use the resources of the communications system 100 configured to be allocated to the set of one or more subscribers while connected to the first device 131 of the first subscriber. The other devices 135 may lack a subscription to use communications system 100.

[0225] The embodiments herein in the second node 112 may be implemented through one or more processors, such as a processing circuitry 1101 in the second node 112 depicted in Figure 11 , together with computer program code for performing the functions and actions of the embodiments herein. A processor, as used herein, may be understood to be a hardware component. The program code mentioned above may also be provided as a computer program product, for instance in the form of a data carrier carrying computer program code for performing the embodiments herein when being loaded into the second node 112. One such carrier may be in the form of a CD ROM disc. It is however feasible with other data carriers such as a memory stick. The computer program code may furthermore be provided as pure program code on a server and downloaded to the second node 112.

[0226] The second node 112 may further comprise a memory 1102 comprising one or more memory units. The memory 1102 is arranged to be used to store obtained information, store data, configurations, schedulings, and applications etc. to perform the methods herein when being executed in the second node 112.

[0227] In some embodiments, the second node 112 may receive information from, e.g., the first node 111 , the third node 113, the fourth node 114, the another node 115, the sixth node 116, the seventh node 117, the radio network node 140, the first device 131, the one or mode devices 130, the second device 132, the other devices 135, the third device 133, another node or user equipment, and / or another structure in the communications system 100, through a receiving port 1103. In some embodiments, the receiving port 1103 may be, for example, connected to one or more antennas in second node 112. In other embodiments, the second node 112 may receive information from another structure in the communications system 100 through the receiving port 1103. Since the receiving port 1103 may be in communication with the processing circuitry 1101, the receiving port 1103 may then send the received information to the processing circuitry 1101. The receiving port 1103 may also be configured to receive other information.

[0228] The processing circuitry 1101 in the second node 112 may be further configured to transmit or send information to e.g., the first node 111 , the third node 113, the fourth node 114, the another node 115, the sixth node 116, the seventh node 117, the radio network node 140, the first device 131 , the one or mode devices 130, the second device 132, the other devices 135, the third device 133, another node or user equipment, and / or another structure in the communications system 100, through a sending port 1104, which may be in communication with the processing circuitry 1101, and the memory 1102.

[0229] Those skilled in the art will also appreciate that the units comprised within the second node 112 described above as being configured to perform different actions, may refer to a combination of analog and digital circuits, and / or one or more processors configured with software and / or firmware, e.g., stored in memory, that, when executed by the one or more processors such as the processing circuitry 1101, perform as described above. One or more of these processors, as well as the other digital hardware, may be included in a single Application-Specific Integrated Circuit (ASIC), or several processors and various digital hardware may be distributed among several separate components, whether individually packaged or assembled into a System-on-a-Chip (SoC).

[0230] The second node 112 may be configured to perform any of the Actions described in relation to Figure 4, Figure 7, Figure 8 and / or Figure 9, e.g., by means of the processing circuitry 1101 within the second node 112, configured to perform any of such actions.

[0231] Also, in some embodiments, different units comprised within the second node 112 may be configured to perform different actions described above, implemented as one or more applications running on one or more processors such as the processing circuitry 1101.

[0232] Thus, the methods according to the embodiments described herein for the second node 112 may be respectively implemented by means of a computer program 1105 product, comprising instructions, i.e. , software code portions, which, when executed on at least one processing circuitry 1101, cause the at least one processing circuitry 1101 to carry out the actions described herein, as performed by the second node 112. The computer program 1105 product may be stored on a computer-readable storage medium 1106. The computer- readable storage medium 1106, having stored thereon the computer program 1105, may comprise instructions which, when executed on at least one processing circuitry 1101, cause the at least one processing circuitry 1101 to carry out the actions described herein, as performed by the second node 112. In some embodiments, the computer-readable storage medium 1106 may be a non-transitory computer-readable storage medium, such as a CD ROM disc, or a memory stick. In other embodiments, the computer program 1105 product may be stored on a carrier containing the computer program 1105 just described, wherein the carrier is one of an electronic signal, optical signal, radio signal, or the computer-readable storage medium 1106, as described above.

[0233] The second node 112 may comprise a communication interface configured to facilitate, or an interface unit to facilitate, communications between the second node 112 and other nodes or devices, e.g., the first node 111, the third node 113, the fourth node 114, the another node 115, the sixth node 116, the seventh node 117, the radio network node 140, the first device 131 , the one or mode devices 130, the second device 132, the other devices 135, the third device 133, another node or user equipment, and / or another structure in the communications system 100. The interface may, for example, include a transceiver configured to transmit and receive radio signals over an air interface in accordance with a suitable standard.

[0234] In other embodiments, the second node 112 may comprise a radio circuitry 1107, which may comprise e.g., the receiving port 1103 and the sending port 1104.

[0235] The radio circuitry 1107 may be configured to set up and maintain at least a wireless connection with the first node 111 , the third node 113, the fourth node 114, the another node 115, the sixth node 116, the seventh node 117, the radio network node 140, the first device 131, the one or mode devices 130, the second device 132, the other devices 135, the third device 133, another node or user equipment, and / or another structure in the communications system 100. Circuitry may be understood herein as a hardware component.

[0236] Hence, embodiments herein also relate to the second node 112, operative to operate in the communications system 100. The second node 112 may comprise the processing circuitry 1101 and the memory 1102, said memory 1102 containing instructions executable by said processing circuitry 1101, whereby the second node 112 is further operative to perform the actions described herein in relation to the second node 112, e.g., in Figure 4, Figure 7, Figure 8 and / or Figure 9.

[0237] Figure 12 depicts an example of the arrangement that the third node 113 may comprise to perform the method described in Figure 5, Figure 7 and / or Figure 9. The third node 113 may be understood to be for handling the one or more devices 130. The third node 113 is configured to operate in the communications system 100.

[0238] Several embodiments are comprised herein. It should be noted that the examples herein are not mutually exclusive. One or more embodiments may be combined, where applicable. All possible combinations are not described to simplify the description. Components from one embodiment may be tacitly assumed to be present in another embodiment and it will be obvious to a person skilled in the art how those components may be used in the other exemplary embodiments. The detailed description of some of the following corresponds to the same references provided above, in relation to the actions described for the third node 113 and will thus not be repeated here. For example, the resources of the communications system 100 configured to be allocated to the set of one or more subscribers may be configured to be a VPN of the set of one or more subscribers.

[0239] The third node 113 is configured to obtain the first information configured to indicate, for a first subscriber of the communications system 100: i) the first identifier configured to identify the first subscriber of the communications system 100, ii) the respective identifier of the one or more devices 130 that are configured to be allowed to connect to the first device 131 of the first subscriber and use the resources of the communications system 100 configured to be allocated to the set of one or more subscribers, wherein the first subscriber is configured to be comprised in the set of one or more subscribers, and iii) the second identifier of the set of one or more subscribers.

[0240] The third node 113 is also configured to generate, based on the first information configured to be obtained, the policy configured to comprise the one or more rules. The one or more rules are configured to be to indicate to the first device 131 to route traffic configured to be generated by the one or more devices 130, while connected to the first device 131 to communicate via the communications system 100, using at least the subset of the resources of the communications system 100 configured to be allocated to the set of one or more subscribers.

[0241] The third node 113 is further configured to provide the further indication of the policy configured to be generated towards the first device 131.

[0242] In some embodiments, at least one of the following may apply: a) the first identifier may be configured to be the SlIPI, b) the respective identifier may be configured to be the respective Device-ID, c) the set of one or more subscribers may have the SLA with the MNO of the communications system 100, d) the set of one or more subscribers may be configured to be one of: the enterprise, the loT group of subscribers, and the MBB group of subscribers, e) the first information may be configured to further comprise the one or more filters to be applied for the usage of the resources, f) the one or more filters may be configured to comprise at least one of the DNN, and the S-NSSAI, g) the first information may be configured to further comprise the third identifier of the another node 115 configured to operate via the communications system 100 from which the first information is configured to originate, h) the one or more rules may be configured to be LIRSP rules, i) the one or more devices 130 may be configured to lack a subscription to use communications system 100, j) the one or more devices 130 may be configured to be non-3GPP devices, k) the subset of resources may be configured to correspond to the PDU Session configured to be established according to the set of rules configured to be apply to the set of one or more subscribers, I) the communications system 100 may be configured to be a 5G network, m) the first node 111 may be configured to be a NEF, n) the another node 115 may be configured to be an AF, and o) the third node 113 may be configured to be a PCF, o) the first information may be configured to be comprised in a provision request, and p) the provision request may be configured to be an Nnef_Device_Provision Request.

[0243] In some embodiments, the third node 113 may be further configured to receive the second indication from the fourth node 114 configured to operate in the communications system 100. The second indication may be configured to request to create the policy. The second indication may be configured to further indicate the first identifier.

[0244] In some embodiments, the third node 113 may be further configured to send, responsive to the second indication configured to be received, the third indication to the second node 112 configured to operate in the communications system 100. The third indication may be configured to request to receive subscriber data configured to correspond to the first identifier. The first information may be configured to be obtained from the second node 112 responsive to the third indication configured to be sent.

[0245] In some embodiments, at least one of the following may apply. According to a first option, the providing of the further indication may be configured to comprise sending the further indication to the fourth node 114. The further indication may be configured to comprise: i) the first descriptor of the traffic configured to indicate the respective identifier of the one or more devices 130, and ii) the second descriptor of the route for the traffic; the second descriptor may be configured to indicate the subset of the resources of the communications system 100. According to a second option, the fourth node 114 may be configured to be an AMF. According to a third option, the second node 112 may be the UDR.

[0246] In some embodiments, the other devices 135 for which no respective identifier may be configured to be comprised in the first information may be configured to be implicitly unallowed to use the resources of the communications system 100 configured to be allocated to the set of one or more subscribers while connected to the first device 131 of the first subscriber. The other devices 135 may lack a subscription to use communications system 100.

[0247] The embodiments herein in the third node 113 may be implemented through one or more processors, such as a processing circuitry 1201 in the third node 113 depicted in Figure 12, together with computer program code for performing the functions and actions of the embodiments herein. A processor, as used herein, may be understood to be a hardware component. The program code mentioned above may also be provided as a computer program product, for instance in the form of a data carrier carrying computer program code for performing the embodiments herein when being loaded into the third node 113. One such carrier may be in the form of a CD ROM disc. It is however feasible with other data carriers such as a memory stick. The computer program code may furthermore be provided as pure program code on a server and downloaded to the third node 113.

[0248] The third node 113 may further comprise a memory 1202 comprising one or more memory units. The memory 1202 is arranged to be used to store obtained information, store data, configurations, schedulings, and applications etc. to perform the methods herein when being executed in the third node 113.

[0249] In some embodiments, the third node 113 may receive information from, e.g., the first node 111, the second node 112, the fourth node 114, the another node 115, the sixth node 116, the seventh node 117, the radio network node 140, the first device 131 , the one or mode devices 130, the second device 132, the other devices 135, the third device 133, another node or user equipment, and / or another structure in the communications system 100, through a receiving port 1203. In some embodiments, the receiving port 1203 may be, for example, connected to one or more antennas in third node 113. In other embodiments, the third node 113 may receive information from another structure in the communications system 100 through the receiving port 1203. Since the receiving port 1203 may be in communication with the processing circuitry 1201, the receiving port 1203 may then send the received information to the processing circuitry 1201. The receiving port 1203 may also be configured to receive other information. The processing circuitry 1201 in the third node 113 may be further configured to transmit or send information to e.g., the first node 111, the second node 112, the fourth node 114, the another node 115, the sixth node 116, the seventh node 117, the radio network node 140, the first device 131, the one or mode devices 130, the second device 132, the other devices 135, the third device 133, another node or user equipment, and / or another structure in the communications system 100, through a sending port 1204, which may be in communication with the processing circuitry 1201, and the memory 1202.

[0250] Those skilled in the art will also appreciate that the units comprised within the third node 113 described above as being configured to perform different actions, may refer to a combination of analog and digital circuits, and / or one or more processors configured with software and / or firmware, e.g., stored in memory, that, when executed by the one or more processors such as the processing circuitry 1201, perform as described above. One or more of these processors, as well as the other digital hardware, may be included in a single Application-Specific Integrated Circuit (ASIC), or several processors and various digital hardware may be distributed among several separate components, whether individually packaged or assembled into a System-on-a-Chip (SoC).

[0251] The third node 113 may be configured to perform any of the Actions described in relation to Figure 5, Figure 7 and / or Figure 9, e.g., by means of the processing circuitry 1201 within the third node 113, configured to perform any of such actions.

[0252] Also, in some embodiments, different units comprised within the third node 113 may be configured to perform the different actions described above, implemented as one or more applications running on one or more processors such as the processing circuitry 1201.

[0253] Thus, the methods according to the embodiments described herein for the third node 113 may be respectively implemented by means of a computer program 1205 product, comprising instructions, i.e. , software code portions, which, when executed on at least one processing circuitry 1201, cause the at least one processing circuitry 1201 to carry out the actions described herein, as performed by the third node 113. The computer program 1205 product may be stored on a computer-readable storage medium 1206. The computer- readable storage medium 1206, having stored thereon the computer program 1205, may comprise instructions which, when executed on at least one processing circuitry 1201 , cause the at least one processing circuitry 1201 to carry out the actions described herein, as performed by the third node 113. In some embodiments, the computer-readable storage medium 1206 may be a non-transitory computer-readable storage medium, such as a CD ROM disc, or a memory stick. In other embodiments, the computer program 1205 product may be stored on a carrier containing the computer program 1205 just described, wherein the carrier is one of an electronic signal, optical signal, radio signal, or the computer-readable storage medium 1206, as described above. The third node 113 may comprise a communication interface configured to facilitate, or an interface unit to facilitate, communications between the third node 113 and other nodes or devices, e.g., the first node 111 , the second node 112, the fourth node 114, the another node 115, the sixth node 116, the seventh node 117, the radio network node 140, the first device 131, the one or mode devices 130, the second device 132, the other devices 135, the third device 133, another node or user equipment, and / or another structure in the communications system 100. The interface may, for example, include a transceiver configured to transmit and receive radio signals over an air interface in accordance with a suitable standard.

[0254] In other embodiments, the third node 113 may comprise a radio circuitry 1207, which may comprise e.g., the receiving port 1203 and the sending port 1204.

[0255] The radio circuitry 1207 may be configured to set up and maintain at least a wireless connection with the first node 111 , the second node 112, the fourth node 114, the another node 115, the sixth node 116, the seventh node 117, the radio network node 140, the first device 131 , the one or mode devices 130, the second device 132, the other devices 135, the third device 133, another node or user equipment, and / or another structure in the communications system 100. Circuitry may be understood herein as a hardware component.

[0256] Hence, embodiments herein also relate to the third node 113 operative to operate in the communications system 100. The third node 113 may comprise the processing circuitry 1201 and the memory 1202, said memory 1202 containing instructions executable by said processing circuitry 1201, whereby the third node 113 is further operative to perform the actions described herein in relation to the third node 113, e.g., in Figure 5, Figure 7 and / or Figure 9.

[0257] Figure 13 depicts an example of the arrangement that the first device 131 may comprise to perform the method described in Figure 6, Figure 7 and / or Figure 9. The first device 131 may be understood to be for handling the one or more devices 130. The first device 131 is configured to operate in the communications system 100. The first device 131 is configured to be of the first subscriber of the communications system 100.

[0258] Several embodiments are comprised herein. It should be noted that the examples herein are not mutually exclusive. One or more embodiments may be combined, where applicable. All possible combinations are not described to simplify the description. Components from one embodiment may be tacitly assumed to be present in another embodiment and it will be obvious to a person skilled in the art how those components may be used in the other exemplary embodiments. The detailed description of some of the following corresponds to the same references provided above, in relation to the actions described for the first device 131 and will thus not be repeated here. For example, the resources of the communications system 100 configured to be allocated to the set of one or more subscribers may be configured to be a VPN of the set of one or more subscribers.

[0259] The first device 131 is configured to obtain, directly or indirectly, the further indication from the third node 113 configured to operate in the communications system 100. The further indication is configured to indicate the one or more rules to route traffic configured to be generated by the one or more devices 130. The one or more devices 130 are configured to be allowed to connect to the first device 131 and use resources of the communications system 100 configured to be allocated to the set of one or more subscribers. The first subscriber is comprised in the set of one or more subscribers. The one or more rules are configured to be to route the traffic configured to be generated by the one or more devices 130 while connected to the first device 131 to communicate via the communications system 100, using at least the subset of resources of the communications system 100 configured to be allocated to the set of one or more subscribers. The further indication is configured to comprise: i) the first descriptor of the traffic indicating the respective identifier of the one or more devices 130, and ii) the second descriptor of the route for the traffic configured to be generated by the one or more devices 130, while connected to the first device 131 to communicate via the communications system 100. The second descriptor is configured to indicate the subset of the resources of the communications system 100.

[0260] The first device 131 is also configured to route the traffic according to the one or more rules configured to be indicated.

[0261] In some embodiments, at least one of the following may apply: a) the respective identifier may be configured to be the respective Device-ID, b) the set of one or more subscribers may have the SLA with the MNO of the communications system 100, c) the set of one or more subscribers may be configured to be one of: the enterprise, the loT group of subscribers, and the MBB group of subscribers, d) the second descriptor may be configured to indicate at least one of the DNN, and the S-NSSAI, e) the one or more rules may be configured to be LIRSP rules, f) the one or more devices 130 may be configured to lack a subscription to use communications system 100, g) the one or more devices 130 may be configured to be non-3GPP devices, h) the subset of resources may be configured to correspond to a PDU session configured to be established according to the set of rules configured to apply to the set of one or more subscribers, i) the communications system 100 may be configured to be a 5G network, j) the first node 111 may be configured to be a NEF, k) the third node 113 may be configured to be a PCF.

[0262] In some embodiments, the first device 131 may be store the one or more rules. The first device 131 may be further configured with at least one of the following two configurations.

[0263] In some embodiments, the first device 131 may be further configured to detect the first traffic from the second device 132, and determine whether or not the second device 132 has one of the respective identifiers of the one or more devices 130 configured to be indicated in the first descriptor. With the proviso the first device 131 determines that the second device 132 has one of the respective identifiers of the one or more devices 130, based on the stored one or more rules, the routing of the traffic may be configured to comprise routing the traffic through the established PDU session corresponding to the subset of resources according to the route configured to be indicated by the second descriptor.

[0264] In some embodiments, the first device 131 may be further configured to detect the second traffic from the third device 133, and determine whether or not the third device 133 has one of the respective identifiers of the one or more devices 130 configured to be indicated in the first descriptor. With the proviso the first device 131 determines that the third device 133 lacks any of the respective identifiers of the one or more devices 130, based on the stored one or more rules, the routing of the traffic may be configured to comprise routing the traffic through a different PDU session configured to lack a correspondence to the subset of resources according to the route configured to be indicated by the second descriptor.

[0265] In some embodiments, the obtaining of the further indication may be configured to comprise receiving the further indication from the fourth node 114 configured to operate in the communications system 100. The fourth node 114 may be configured to be an AMF.

[0266] In some embodiments, the other devices 135 for which no respective identifier may be configured to be comprised in the first descriptor may be configured to be implicitly unallowed to use the resources of the communications system 100 configured to be allocated to the set of one or more subscribers while connected to the first device 131 of the first subscriber. The other devices 135 may lack a subscription to use communications system 100.

[0267] The embodiments herein in the first device 131 may be implemented through one or more processors, such as a processing circuitry 1301 in the first device 131 depicted in Figure 13, together with computer program code for performing the functions and actions of the embodiments herein. A processor, as used herein, may be understood to be a hardware component. The program code mentioned above may also be provided as a computer program product, for instance in the form of a data carrier carrying computer program code for performing the embodiments herein when being loaded into the first device 131. One such carrier may be in the form of a CD ROM disc. It is however feasible with other data carriers such as a memory stick. The computer program code may furthermore be provided as pure program code on a server and downloaded to the first device 131.

[0268] The first device 131 may further comprise a memory 1302 comprising one or more memory units. The memory 1302 is arranged to be used to store obtained information, store data, configurations, schedulings, and applications etc. to perform the methods herein when being executed in the first device 131. In some embodiments, the first device 131 may receive information from, e.g., the first node 111, the second node 112, the third node 113, the fourth node 114, the another node 115, the sixth node 116, the seventh node 117, the radio network node 140, the one or mode devices 130, the second device 132, the other devices 135, the third device 133, another node or user equipment, and / or another structure in the communications system 100, through a receiving port 1303. In some embodiments, the receiving port 1303 may be, for example, connected to one or more antennas in first device 131. In other embodiments, the first device 131 may receive information from another structure in the communications system 100 through the receiving port 1303. Since the receiving port 1303 may be in communication with the processing circuitry 1301, the receiving port 1303 may then send the received information to the processing circuitry 1301. The receiving port 1303 may also be configured to receive other information.

[0269] The processing circuitry 1301 in the first device 131 may be further configured to transmit or send information to e.g., the first node 111 , the second node 112, the third node 113, the fourth node 114, the another node 115, the sixth node 116, the seventh node 117, the radio network node 140, the one or mode devices 130, the second device 132, the other devices 135, the third device 133, another node or user equipment, and / or another structure in the communications system 100, and / or another structure in the communications system 100, through a sending port 1304, which may be in communication with the processing circuitry 1301 , and the memory 1302.

[0270] Those skilled in the art will also appreciate that the units comprised within the first device 131 described above as being configured to perform different actions, may refer to a combination of analog and digital circuits, and / or one or more processors configured with software and / or firmware, e.g., stored in memory, that, when executed by the one or more processors such as the processing circuitry 1301, perform as described above. One or more of these processors, as well as the other digital hardware, may be included in a single Application-Specific Integrated Circuit (ASIC), or several processors and various digital hardware may be distributed among several separate components, whether individually packaged or assembled into a System-on-a-Chip (SoC).

[0271] The first device 131 may be configured to perform any of the Actions described in relation to Figure 6, Figure 7 and / or Figure 9, e.g., by means of the processing circuitry 1301 within the first device 131, configured to perform any of such actions.

[0272] Also, in some embodiments, different units comprised within the first device 131 may be configured to perform the different actions described above, implemented as one or more applications running on one or more processors such as the processing circuitry 1301.

[0273] Thus, the methods according to the embodiments described herein for the first device 131 may be respectively implemented by means of a computer program 1305 product, comprising instructions, i.e., software code portions, which, when executed on at least one processing circuitry 1301, cause the at least one processing circuitry 1301 to carry out the actions described herein, as performed by the first device 131. The computer program 1305 product may be stored on a computer-readable storage medium 1306. The computer- readable storage medium 1306, having stored thereon the computer program 1305, may comprise instructions which, when executed on at least one processing circuitry 1301 , cause the at least one processing circuitry 1301 to carry out the actions described herein, as performed by the first device 131. In some embodiments, the computer-readable storage medium 1306 may be a non-transitory computer-readable storage medium, such as a CD ROM disc, or a memory stick. In other embodiments, the computer program 1305 product may be stored on a carrier containing the computer program 1305 just described, wherein the carrier is one of an electronic signal, optical signal, radio signal, or the computer-readable storage medium 1306, as described above.

[0274] The first device 131 may comprise a communication interface configured to facilitate, or an interface unit to facilitate, communications between the first device 131 and other nodes or devices, e.g., the first node 111, the second node 112, the third node 113, the fourth node 114, the another node 115, the sixth node 116, the seventh node 117, the radio network node 140, the one or mode devices 130, the second device 132, the other devices 135, the third device 133, another node or user equipment, and / or another structure in the communications system 100. The interface may, for example, include a transceiver configured to transmit and receive radio signals over an air interface in accordance with a suitable standard.

[0275] In other embodiments, the first device 131 may comprise a radio circuitry 1307, which may comprise e.g., the receiving port 1303 and the sending port 1304.

[0276] The radio circuitry 1307 may be configured to set up and maintain at least a wireless connection with the first node 111 , the second node 112, the third node 113, the fourth node 114, the another node 115, the sixth node 116, the seventh node 117, the radio network node 140, the one or mode devices 130, the second device 132, the other devices 135, the third device 133, another node or user equipment, and / or another structure in the communications system 100. Circuitry may be understood herein as a hardware component.

[0277] Hence, embodiments herein also relate to the first device 131 operative to operate in the communications system 100. The first device 131 may comprise the processing circuitry 1301 and the memory 1302, said memory 1302 containing instructions executable by said processing circuitry 1301, whereby the first device 131 is further operative to perform the actions described herein in relation to the first device 131 , e.g., in Figure 6, Figure 7 and / or Figure 9. Embodiments herein may also comprise the communications system 100 comprising one or more of: the first node 111 configured as described in relation to Figure 10, the second node 112 configured as described in relation to Figure 11, the third node 113 configured as described in relation to Figure 12, and the first device 131 configured as described in Figure 13.

[0278] When using the word "comprise" or “comprising”, it shall be interpreted as non- limiting, i.e. , meaning "consist at least of".

[0279] The embodiments herein are not limited to the above-described preferred embodiments. Various alternatives, modifications and equivalents may be used. Therefore, the above embodiments should not be taken as limiting the scope of the invention.

[0280] Generally, all terms used herein are to be interpreted according to their ordinary meaning in the relevant technical field, unless a different meaning is clearly given and / or is implied from the context in which it is used. All references to a / an / the element, apparatus, component, means, step, etc. are to be interpreted openly as referring to at least one instance of the element, apparatus, component, means, step, etc., unless explicitly stated otherwise. The steps of any methods disclosed herein do not have to be performed in the exact order disclosed, unless a step is explicitly described as following or preceding another step and / or where it is implicit that a step must follow or precede another step. Any feature of any of the embodiments disclosed herein may be applied to any other embodiment, wherever appropriate. Likewise, any advantage of any of the embodiments may apply to any other embodiments, and vice versa. Other objectives, features and advantages of the enclosed embodiments will be apparent from the following description.

[0281] As used herein, the expression “at least one of:” followed by a list of alternatives separated by commas, and wherein the last alternative is preceded by the “and” term, may be understood to mean that only one of the list of alternatives may apply, more than one of the list of alternatives may apply or all of the list of alternatives may apply. This expression may be understood to be equivalent to the expression “at least one of:” followed by a list of alternatives separated by commas, and wherein the last alternative is preceded by the “or” term.

[0282] Any of the terms processor and circuitry may be understood herein as a hardware component.

[0283] As used herein, the expression “in some embodiments” has been used to indicate that the features of the embodiment described may be combined with any other embodiment or example disclosed herein.

[0284] As used herein, the expression “in some examples” has been used to indicate that the features of the example described may be combined with any other embodiment or example disclosed herein. REFERENCES

[0285] 1. 3GPP Rel19 SID on User Identities.

[0286] 2. 3GPP TS 29.522 v18.3.0 (Sept 2023): 5G System; Network Exposure Function Northbound APIs; Stage 3.

[0287] 3. 3GPP TS 24.526 v18.4.0 (Sept 2023) “User Equipment (UE) policies for 5G System (5GS); Stage 3”.

Claims

CLAIMS:1 . A computer-implemented method, performed by a first node (111), for handling one or more devices (130), the first node (111) operating in a communications system (100), the method comprising:- obtaining (301) first information from another node (115) operating via the communications system (100), the first information comprising: i. a first identifier identifying a first subscriber of the communications system (100), ii. a respective identifier of the one or more devices (130) that are allowed to connect to a first device (131) of the first subscriber and use resources of the communications system (100) allocated to a set of one or more subscribers, wherein the first subscriber is comprised in the set of one or more subscribers, and iii. a second identifier of the set of one or more subscribers, and- initiating (303) storage of the obtained first information.

2. The method according to claim 1 , wherein at least one of: a. the first identifier is a subscription permanent identifier, b. the respective identifier is a respective device-identifier, Device-ID, c. the set of one or more subscribers have a service level agreement, SLA, with a mobile network operator of the communications system (100), d. the set of one or more subscribers is one of: an enterprise, an Internet of Things group of subscribers, and a Mobile Broad Band, MBB, group of subscribers, e. the first information further comprises one or more filters to be applied for the usage of the resources, f. the one or more filters comprise at least one of a Data Network Name, DNN, and a Serving Network Slice Selection Assistance Information, S-NSSAI, g. the first information further comprises a third identifier of the another node (115), h. the initiating (303) of the storage of the obtained first information comprises sending a first indication to a second node (112) operating in the communications system (100), the first indication indicating to store the first information, i. the one or more devices (130) lack a subscription to use communications system (100),j. the one or more devices (130) are non-Third Generation Partnership Project, 3GPP, devices, k. the communications system (100) is a Fifth Generation, 5G, network, l. the first node (111) is a Network Exposure Function, m. the another node (115) is an Application Function, AF, n. the second node (112) is a Unified Data Repository, UDR, o. the first information is comprised in a provision request, and p. the provision request is an Nnef_Device_Provision Request.

3. The method according to claim 2, wherein the first information is comprised in the provision request and the first information further comprises the third identifier of the another node (115), and wherein the method further comprises:- authorizing (302) the provision request based on the third identifier.

4. The method according to any of claims 1-3, wherein other devices (135) for which no respective identifier is comprised in the first information are implicitly unallowed to use the resources of the communications system (100) allocated to the set of one or more subscribers while connected to the first device (131) of the first subscriber, wherein the other devices (135) lack a subscription to use communications system (100).

5. A computer-implemented method, performed by a second node (112), for handling one or more devices (130), the second node (112) operating in a communications system (100), the method comprising:- receiving (401) a first indication from a first node (111) operating in the communications system (100), the first indication indicating to store the first information, the first information comprising: i. a first identifier identifying a first subscriber of the communications system (100), ii. a respective identifier of the one or more devices (130) that are allowed to connect to a first device (131) of the first subscriber and use resources of the communications system (100) allocated to a set of one or more subscribers, wherein the first subscriber is comprised in the set of one or more subscribers, and iii. a second identifier of the set of one or more subscribers, and- storing (402) the received first information.

6. The method according to claim 5, further comprising:- receiving (403) an additional indication from a third node (113) operating in the communications system (100), the additional indication requesting to receive subscriber data corresponding to the first identifier, and- providing (404) at least part of the first information to the third node (113) responsive to the received additional indication.

7. The method according to claim 6, wherein at least one of: a. the first identifier is a subscription permanent identifier, b. the respective identifier is a respective device-identifier, Device-ID, c. the set of one or more subscribers have a service level agreement, SLA, with a mobile network operator of the communications system (100), d. the set of one or more subscribers is one of: an enterprise, an Internet of Things group of subscribers, and a Mobile Broad Band, MBB, group of subscribers, e. the first information further comprises one or more filters to be applied for the usage of the resources, f. the one or more filters comprise at least one of a Data Network Name, DNN, and a Serving Network Slice Selection Assistance Information, S-NSSAI, g. the first information further comprises a third identifier of another node (115) operating via the communications system (100) from which the first information originates, h. the one or more devices (130) lack a subscription to use communications system (100), i. the one or more devices (130) are non-Third Generation Partnership Project, 3GPP, devices, j. the communications system (100) is a Fifth Generation, 5G, network, k. the first node (111) is a Network Exposure Function, l. the another node (115) is an Application Function, AF, m. the second node (112) is a Unified Data Repository, UDR, n. the first indication is comprised in a request to store the first information as subscription data, o. the first indication is a Nudr_DM_Request, p. the providing (404) of the at least part of the first information comprises sending another indication comprising the at least part of the first information, and q. the third node (113) is a Policy Control Function, PCF.

8. The method according to any of claims 5-7, wherein other devices (135) for which no respective identifier is comprised in the first information are implicitly unallowed to use the resources of the communications system (100) allocated to the set of one or more subscribers while connected to the first device (131) of the first subscriber, wherein the other devices (135) lack a subscription to use communications system (100).

9. A computer-implemented method, performed by a third node (113), for handling one or more devices (130), the third node (113) operating in a communications system (100), the method comprising:- obtaining (503) first information indicating, for a first subscriber of the communications system (100): i. a first identifier identifying a first subscriber of the communications system (100), ii. a respective identifier of the one or more devices (130) that are allowed to connect to a first device (131) of the first subscriber and use resources of the communications system (100) allocated to a set of one or more subscribers, wherein the first subscriber is comprised in the set of one or more subscribers, and iii. a second identifier of the set of one or more subscribers, and- generating (504), based on the obtained first information, a policy comprising one or more rules, the one or more rules being to indicate to the first device (131) to route traffic generated by the one or more devices (130), while connected to the first device (131) to communicate via the communications system (100), using at least a subset of the resources of the communications system (100) allocated to the set of one or more subscribers, and- providing (505) a further indication of the generated policy towards the first device (131).

10. The method according to claim 8, wherein at least one of: a. the first identifier is a subscription permanent identifier, b. the respective identifier is a respective device-identifier, Device-ID, c. the set of one or more subscribers have a service level agreement, SLA, with a mobile network operator of the communications system (100), d. the set of one or more subscribers is one of: an enterprise, an Internet of Things group of subscribers, and a Mobile Broad Band, MBB, group of subscribers,e. the first information further comprises one or more filters to be applied for the usage of the resources, f. the one or more filters comprise at least one of a Data Network Name, DNN, and a Serving Network Slice Selection Assistance Information, S-NSSAI, g. the first information further comprises a third identifier of another node (115) operating via the communications system (100) from which the first information originates, h. the one or more rules are User Equipment Route Selection Policy, URSP, rules, i. the one or more devices (130) lack a subscription to use communications system (100), j. the one or more devices (130) are non-Third Generation Partnership Project, 3GPP, devices, k. the subset of resources correspond to a Packet Data Unit Session established according to a set of rules applying to the set of one or more subscribers, l. the communications system (100) is a Fifth Generation, 5G, network, m. the first node (111) is a Network Exposure Function, n. the another node (115) is an Application Function, AF, o. the third node (113) is a Policy Control Function, PCF.

11. The method according to any of claims 8-9, further comprising:- receiving (501) a second indication from a fourth node (114) operating in the communications system (100), the second indication requesting to create the policy, the second indication further indicating the first identifier,- sending (502), responsive to the received second indication, a third indication to a second node (112) operating in the communications system (100), the third indication requesting to receive subscriber data corresponding to the first identifier, and wherein the first information is obtained from the second node (112) responsive to the sent third indication.

12. The method according to claim 10, wherein one of: a. the providing (505) of the further indication comprises sending the further indication to the fourth node (114), the further indication comprising: i. a first descriptor of the traffic indicating the respective identifier of the one or more devices (130), and ii. a second descriptor of a route for the traffic, the second descriptor indicating the subset of the resources of the communications system (100), andb. the fourth node (114) is an Access and Mobility Function, AMF and c. the second node (112) is a Unified Data Repository, UDR.

13. The method according to any of claims 8-11, wherein other devices (135) for which no respective identifier is comprised in the first information are implicitly unallowed to use the resources of the communications system (100) allocated to the set of one or more subscribers while connected to the first device (131) of the first subscriber, wherein the other devices (135) lack a subscription to use communications system (100).

14. A computer-implemented method, performed by a first device (131), for handling one or more devices (130), the first device (131) operating in a communications system (100), the first device (131) being of a first subscriber of the communications system (100), the method comprising:- obtaining (601), directly or indirectly, a further indication from a third node (113) operating in a communications system (100), the further indication indicating one or more rules to route traffic generated by the one or more devices (130), wherein the one or more devices (130) are allowed to connect to the first device (131) and use resources of the communications system (100) allocated to a set of one or more subscribers, wherein the first subscriber is comprised in the set of one or more subscribers, and wherein the one or more rules are to route the traffic generated by the one or more devices (130) while connected to the first device (131) to communicate via the communications system (100), using at least a subset of resources of the communications system (100) allocated to the set of one or more subscribers, the further indication comprising: i. a first descriptor of the traffic indicating a respective identifier of the one or more devices (130), and ii. a second descriptor of a route for the traffic generated by the one or more devices (130), while connected to the first device (131) to communicate via the communications system (100), the second descriptor indicating the subset of the resources of the communications system (100), and- routing (605) the traffic according to the indicated one or more rules.

15. The method according to claim 13, wherein at least one of: a. the respective identifier is a respective device-identifier, Device-ID, b. the set of one or more subscribers have a service level agreement, SLA, with a mobile network operator of the communications system (100),c. the set of one or more subscribers is one of: an enterprise, an Internet of Things group of subscribers, and a Mobile Broad Band, MBB, group of subscribers, d. the second descriptor indicates at least one of a Data Network Name, DNN, and a Serving Network Slice Selection Assistance Information, S-NSSAI, e. the one or more rules are User Equipment Route Selection Policy, URSP, rules, f. the one or more devices (130) lack a subscription to use communications system (100), g. the one or more devices (130) are non-Third Generation Partnership Project, 3GPP, devices, h. the subset of resources correspond to a Packet Data Unit, PDU, session established according to a set of rules applying to the set of one or more subscribers, i. the communications system (100) is a Fifth Generation, 5G, network, j. the first node (111) is a Network Exposure Function, and k. the third node (113) is a Policy Control Function, PCF.

16. The method according to any of claims 13-14, further comprising:- storing (602) the one or more rules, and at least one of:- detecting (603) first traffic from a second device (132), determining whether or not the second device (132) has one of the respective identifiers of the one or more devices (130) indicated in the first descriptor, and wherein with the proviso the first device (131) determines that the second device (132) has one of the respective identifiers of the one or more devices (130), based on the stored one or more rules, the routing (605) of the traffic comprises routing the traffic through the established PDU session corresponding to the subset of resources according to the route indicated by the second descriptor, and- detecting (604) second traffic from a third device (133), determining whether or not the third device (133) has one of the respective identifiers of the one or more devices (130) indicated in the first descriptor, and wherein with the proviso the first device (131) determines that the third device (133) lacks any of the respective identifiers of the one or more devices (130), based on the stored one or more rules, the routing (605) of the traffic comprises routing the traffic through a different PDU session lacking a correspondence to the subset of resources according to the route indicated by the second descriptor.

17. The method according to any of claims 13-15, wherein the obtaining (601) of the further indication comprises receiving the further indication from a fourth node (114) operating in the communications system (100), wherein the fourth node (114) is an Access and Mobility Function, AMF.

18. The method according to any of claims 13-16, wherein other devices (135) for which no respective identifier is comprised in the first descriptor are implicitly unallowed to use the resources of the communications system (100) allocated to the set of one or more subscribers while connected to the first device (131) of the first subscriber, wherein the other devices (135) lack a subscription to use communications system (100).

19. A first node (111), for handling one or more devices (130), the first node (111) being configured to operate in a communications system (100), the first node (111) being further configured to:- obtain first information from another node (115) configured to operate via the communications system (100), the first information being configured to comprise: i. a first identifier configured to identify a first subscriber of the communications system (100), ii. a respective identifier of the one or more devices (130) that are configured to be allowed to connect to a first device (131) of the first subscriber and use resources of the communications system (100) configured to be allocated to a set of one or more subscribers, wherein the first subscriber is configured to be comprised in the set of one or more subscribers, and iii. a second identifier of the set of one or more subscribers, and- initiate storage of the first information configured to be obtained.

20. The first node (111) according to claim 19, wherein at least one of: a. the first identifier is configured to be a subscription permanent identifier, b. the respective identifier is configured to be a respective device-identifier, Device-ID, c. the set of one or more subscribers have a service level agreement, SLA, with a mobile network operator of the communications system (100), d. the set of one or more subscribers is configured to be one of: an enterprise, an Internet of Things group of subscribers, and a Mobile Broad Band, MBB, group of subscribers,e. the first information is configured to further comprise one or more filters to be applied for the usage of the resources, f. the one or more filters are configured to comprise at least one of a Data Network Name, DNN, and a Serving Network Slice Selection Assistance Information, S-NSSAI, g. the first information is configured to further comprise a third identifier of the another node (115), h. the initiating of the storage of the obtained first information is configured to comprise sending a first indication to a second node (112) configured to operate in the communications system (100), the first indication being configured to indicate to store the first information, i. the one or more devices (130) are configured to lack a subscription to use communications system (100), j. the one or more devices (130) are configured to be non-Third Generation Partnership Project, 3GPP, devices, k. the communications system (100) is configured to be a Fifth Generation, 5G, network, l. the first node (111) is configured to be a Network Exposure Function, m. the another node (115) is configured to be an Application Function, AF, n. the second node (112) is configured to be a Unified Data Repository, UDR, o. the first information is configured to be comprised in a provision request, and p. the provision request is configured to be an Nnef_Device_Provision Request.

21. The first node (111) according to claim 20, wherein the first information is configured to be comprised in the provision request and the first information is configured to further comprise the third identifier of the another node (115), and wherein the first node (111) is further configured to:- authorize the provision request based on the third identifier.

22. The first node (111) according to any of claims 19-21 , wherein other devices (135) for which no respective identifier is configured to be comprised in the first information are configured to be implicitly unallowed to use the resources of the communications system (100) configured to be allocated to the set of one or more subscribers while connected to the first device (131) of the first subscriber, wherein the other devices (135) lack a subscription to use communications system (100).

23. A second node (112), for handling one or more devices (130), the second node (112) being configured to operate in a communications system (100), the second node (112) being further configured to:- receive a first indication from a first node (111) configured to operate in the communications system (100), the first indication being configured to indicate to store the first information, the first information being configured to comprise: i. a first identifier configured to identify a first subscriber of the communications system (100), ii. a respective identifier of the one or more devices (130) that are configured to be allowed to connect to a first device (131) of the first subscriber and use resources of the communications system (100) configured to be allocated to a set of one or more subscribers, wherein the first subscriber is configured to be comprised in the set of one or more subscribers, and iii. a second identifier of the set of one or more subscribers, and- store the first information configured to be received.

24. The second node (112) according to claim 23, being further configured to:- receive an additional indication from a third node (113) configured to operate in the communications system (100), the additional indication being configured to request to receive subscriber data corresponding to the first identifier, and- provide at least part of the first information to the third node (113) responsive to the additional indication configured to be received.

25. The second node (112) according to claim 24, wherein at least one of: a. the first identifier is configured to be a subscription permanent identifier, b. the respective identifier is configured to be a respective device-identifier, Device-ID, c. the set of one or more subscribers have a service level agreement, SLA, with a mobile network operator of the communications system (100), d. the set of one or more subscribers is configured to be one of: an enterprise, an Internet of Things group of subscribers, and a Mobile Broad Band, MBB, group of subscribers, e. the first information is configured to further comprise one or more filters to be applied for the usage of the resources,f. the one or more filters are configured to comprise at least one of a Data Network Name, DNN, and a Serving Network Slice Selection Assistance Information, S-NSSAI, g. the first information is configured to further comprise a third identifier of another node (115) configured to operate via the communications system (100) from which the first information originates, h. the one or more devices (130) lack a subscription to use communications system (100), i. the one or more devices (130) are configured to be non-Third Generation Partnership Project, 3GPP, devices, j. the communications system (100) is configured to be a Fifth Generation, 5G, network, k. the first node (111) is configured to be a Network Exposure Function, l. the another node (115) is configured to be an Application Function, AF, m. the second node (112) is configured to be a Unified Data Repository, UDR, n. the first indication is configured to be comprised in a request to store the first information as subscription data, o. the first indication is configured to be a Nudr_DM_Request, p. the providing of the at least part of the first information is configured to comprise sending another indication configured to comprise the at least part of the first information, and q. the third node (113) is configured to be a Policy Control Function, PCF.

26. The second node (112) according to any of claims 23-25, wherein other devices (135) for which no respective identifier is configured to be comprised in the first information are configured to be implicitly unallowed to use the resources of the communications system (100) configured to be allocated to the set of one or more subscribers while connected to the first device (131) of the first subscriber, wherein the other devices (135) are configured to lack a subscription to use communications system (100).

27. A third node (113), for handling one or more devices (130), the third node (113) being configured to operate in a communications system (100), the third node (113) being further configured to:- obtain first information configured to indicate, for a first subscriber of the communications system (100): i. a first identifier configured to identify a first subscriber of the communications system (100),ii. a respective identifier of the one or more devices (130) that are configured to be allowed to connect to a first device (131) of the first subscriber and use resources of the communications system (100) configured to be allocated to a set of one or more subscribers, wherein the first subscriber is configured to be comprised in the set of one or more subscribers, and iii. a second identifier of the set of one or more subscribers, and- generate, based on the first information configured to be obtained, a policy configured to comprise one or more rules, the one or more rules being configured to be to indicate to the first device (131) to route traffic configured to be generated by the one or more devices (130), while connected to the first device (131) to communicate via the communications system (100), using at least a subset of the resources of the communications system (100) configured to be allocated to the set of one or more subscribers, and- provide a further indication of the policy configured to be generated towards the first device (131).

28. The third node (113) according to claim 27, wherein at least one of: a. the first identifier is configured to be a subscription permanent identifier, b. the respective identifier is configured to be a respective device-identifier, Device-ID, c. the set of one or more subscribers have a service level agreement, SLA, with a mobile network operator of the communications system (100), d. the set of one or more subscribers is configured to be one of: an enterprise, an Internet of Things group of subscribers, and a Mobile Broad Band, MBB, group of subscribers, e. the first information is configured to further comprise one or more filters to be applied for the usage of the resources, f. the one or more filters are configured to comprise at least one of a Data Network Name, DNN, and a Serving Network Slice Selection Assistance Information, S-NSSAI, g. the first information is configured to further comprise a third identifier of another node (115) configured to operate via the communications system (100) from which the first information is configured to originate, h. the one or more rules are configured to be User Equipment Route Selection Policy, URSP, rules,i. the one or more devices (130) lack a subscription to use communications system (100), j. the one or more devices (130) are configured to be non-Third Generation Partnership Project, 3GPP, devices, k. the subset of resources is configured to correspond to a Packet Data Unit Session configured to be established according to a set of rules configured to be apply to the set of one or more subscribers, l. the communications system (100) is configured to be a Fifth Generation, 5G, network, m. the first node (111) is configured to be a Network Exposure Function, n. the another node (115) is configured to be an Application Function, AF, o. the third node (113) is configured to be a Policy Control Function, PCF.

29. The third node (113) according to any of claims 27-28, being further configured to:- receive a second indication from a fourth node (114) configured to operate in the communications system (100), the second indication being configured to request to create the policy, the second indication being configured to further indicate the first identifier,- send, responsive to the second indication configured to be received, a third indication to a second node (112) configured to operate in the communications system (100), the third indication being configured to request to receive subscriber data configured to correspond to the first identifier, and wherein the first information is configured to be obtained from the second node (112) responsive to the third indication configured to be sent.

30. The third node (113) according to claim 29, wherein at least one of: a. the providing of the further indication is configured to comprise sending the further indication to the fourth node (114), the further indication being configured to comprise: i. a first descriptor of the traffic configured to indicate the respective identifier of the one or more devices (130), and ii. a second descriptor of a route for the traffic, the second descriptor being configured to indicate the subset of the resources of the communications system (100), b. the fourth node (114) is configured to be an Access and Mobility Function, AMF, and c. the second node (112) is configured to be a Unified Data Repository, UDR.

31. The third node (113) according to any of claims 27-30, wherein other devices (135) for which no respective identifier is configured to be comprised in the first information are configured to be implicitly unallowed to use the resources of the communications system (100) configured to be allocated to the set of one or more subscribers while connected to the first device (131) of the first subscriber, wherein the other devices (135) lack a subscription to use communications system (100).

32. A first device (131), for handling one or more devices (130), the first device (131) being configured to operate in a communications system (100), the first device (131) being configured to be of a first subscriber of the communications system (100), the first device (131) being further configured to:- obtain, directly or indirectly, a further indication from a third node (113) configured to operate in a communications system (100), the further indication being configured to indicate one or more rules to route traffic configured to be generated by the one or more devices (130), wherein the one or more devices (130) are configured to be allowed to connect to the first device (131) and use resources of the communications system (100) configured to be allocated to a set of one or more subscribers, wherein the first subscriber is comprised in the set of one or more subscribers, and wherein the one or more rules are configured to be to route the traffic configured to be generated by the one or more devices (130) while connected to the first device (131) to communicate via the communications system (100), using at least a subset of resources of the communications system (100) configured to be allocated to the set of one or more subscribers, the further indication being configured to comprise: i. a first descriptor of the traffic indicating a respective identifier of the one or more devices (130), and ii. a second descriptor of a route for the traffic configured to be generated by the one or more devices (130), while connected to the first device (131) to communicate via the communications system (100), the second descriptor being configured to indicate the subset of the resources of the communications system (100), and- route the traffic according to the one or more rules configured to be indicated.

33. The first device (131) according to claim 32, wherein at least one of: a. the respective identifier is configured to be a respective device-identifier, Device-ID,b. the set of one or more subscribers have a service level agreement, SLA, with a mobile network operator of the communications system (100), c. the set of one or more subscribers is configured to be one of: an enterprise, an Internet of Things group of subscribers, and a Mobile Broad Band, MBB, group of subscribers, d. the second descriptor is configured to indicate at least one of a Data Network Name, DNN, and a Serving Network Slice Selection Assistance Information, S- NSSAI, e. the one or more rules are configured to be User Equipment Route Selection Policy, URSP, rules, f. the one or more devices (130) are configured to lack a subscription to use communications system (100), g. the one or more devices (130) are configured to be non-Third Generation Partnership Project, 3GPP, devices, h. the subset of resources is configured to correspond to a Packet Data Unit, PDU, session configured to be established according to a set of rules configured to apply to the set of one or more subscribers, i. the communications system (100) is configured to be a Fifth Generation, 5G, network, j. the first node (111) is configured to be a Network Exposure Function, and k. the third node (113) is configured to be a Policy Control Function, PCF.

34. The first device (131) according to any of claims 32-33, being further configured to:- store the one or more rules, and at least one of:- detect first traffic from a second device (132), determine whether or not the second device (132) has one of the respective identifiers of the one or more devices (130) configured to be indicated in the first descriptor, and wherein with the proviso the first device (131) determines that the second device (132) has one of the respective identifiers of the one or more devices (130), based on the stored one or more rules, the routing of the traffic is configured to comprise routing the traffic through the established PDU session corresponding to the subset of resources according to the route configured to be indicated by the second descriptor, and- detect second traffic from a third device (133), determine whether or not the third device (133) has one of the respective identifiers of the one or more devices (130) configured to be indicated in the first descriptor, and wherein with the proviso the first device (131) determines that the third device (133) lacks any of the respective identifiers of the one or more devices (130), based on the stored one or morerules, the routing of the traffic is configured to comprise routing the traffic through a different PDU session configured to lack a correspondence to the subset of resources according to the route configured to be indicated by the second descriptor.

35. The first device (131) according to any of claims 32-34, wherein the obtaining of the further indication is configured to comprise receiving the further indication from a fourth node (114) configured to operate in the communications system (100), wherein the fourth node (114) is configured to be an Access and Mobility Function, AMF.

36. The first device (131) according to any of claims 32-35, wherein other devices (135) for which no respective identifier is configured to be comprised in the first descriptor are configured to be implicitly unallowed to use the resources of the communications system (100) configured to be allocated to the set of one or more subscribers while connected to the first device (131) of the first subscriber, wherein the other devices (135) lack a subscription to use communications system (100).

37. A communications system (100) comprising one or more of: a first node (111) according to any of the claims 19-22, a second node (112) according to any of the claims 23-26, a third node (113) according to any of the claims 27-31 and a first device (131) according to any of claims 32-36.

Images