Authentication method and apparatus for satellite communication in store and forward mode

Abstract

The present disclosure relates to a 5G or 6G communication system for supporting a higher data transmission rate, wherein an operating method of a user equipment (UE) (100) in a wireless communication system, according to an embodiment of the present disclosure, may comprise the steps of: transmitting a first attach request message to a satellite device (200) through a service link; receiving, from the satellite device (200) through the service link, retry information indicating at least one of a reattach time, a rettach method, and a reattach target; and transmitting a second attach request message to the satellite device (200) on the basis of the retry information.

Description

Authentication method and device for satellite communication in store and transmit mode

[0001] The present disclosure relates to a method and device for enabling authentication in a wireless communication system using a satellite as a component when the communication system operates in a store and forward mode.

[0002] 5G mobile communication technology defines a wide frequency band to enable fast transmission speeds and new services, and can be implemented not only in the sub-6GHz frequency band such as 3.5 gigahertz (3.5GHz), but also in the ultra-high frequency band called millimeter wave (mmWave) such as 28GHz and 39GHz ('Above 6GHz'). In addition, for 6G mobile communication technology, which is called the system after 5G communication (Beyond 5G), implementation in the terahertz band (for example, the 3 terahertz (3THz) band at 95GHz) is being considered to achieve a transmission speed that is 50 times faster than 5G mobile communication technology and an ultra-low latency time that is reduced to one-tenth.

[0003] In the early stages of 5G mobile communication technology, the goal is to support services and satisfy performance requirements for enhanced Mobile Broadband (eMBB), Ultra-Reliable Low-Latency Communications (URLLC), and massive Machine-Type Communications (mMTC). These include beamforming and massive MIMO to mitigate path loss of radio waves in ultra-high frequency bands and increase the transmission distance of radio waves, support for various numerologies (such as operation of multiple subcarrier intervals) and dynamic operation of slot formats for efficient use of ultra-high frequency resources, initial access technology to support multi-beam transmission and wideband, definition and operation of BWP (Bidth Part), new channel coding methods such as LDPC (Low Density Parity Check) codes for large-capacity data transmission and Polar Code for reliable transmission of control information, and L2 pre-processing (L2). Standardization has been made for network slicing, which provides dedicated networks specialized for specific services, and pre-processing.

[0004] Currently, discussions are underway to improve and enhance the initial 5G mobile communication technology in consideration of the services that 5G mobile communication technology was intended to support, and physical layer standardization is in progress for technologies such as V2X (Vehicle-to-Everything) to help autonomous vehicles make driving decisions and increase user convenience based on their own location and status information transmitted by vehicles, NR-U (New Radio Unlicensed) for the purpose of system operation that complies with various regulatory requirements in unlicensed bands, NR terminal low power consumption technology (UE Power Saving), Non-Terrestrial Network (NTN), which is direct terminal-satellite communication to secure coverage in areas where communication with terrestrial networks is impossible, and Positioning.

[0005] In addition, standardization of wireless interface architecture / protocols is in progress for technologies such as intelligent factories (Industrial Internet of Things, IIoT) to support new services through linkage and convergence with other industries, Integrated Access and Backhaul (IAB) that provides nodes for expanding network service areas by integrating wireless backhaul links and access links, Mobility Enhancement technology including Conditional Handover and Dual Active Protocol Stack (DAPS) handover, and 2-step random access (2-step RACH for NR) that simplifies random access procedures. Standardization is also in progress for system architecture / services such as 5G baseline architecture (e.g., Service-based Architecture, Service-based Interface) for grafting Network Functions Virtualization (NFV) and Software-Defined Networking (SDN) technologies, and Mobile Edge Computing (MEC) that provides services based on the location of the terminal.

[0006] Once these 5G mobile communication systems are commercialized, an explosive increase in connected devices will be connected to the communication network, necessitating enhanced functionality and performance of 5G mobile communication systems and integrated operation of these connected devices. To this end, new research will be conducted on improving 5G performance and reducing complexity, supporting AI services, supporting metaverse services, and drone communications by utilizing eXtended Reality (XR), Artificial Intelligence (AI), and Machine Learning (ML) to efficiently support Augmented Reality (AR), Virtual Reality (VR), and Mixed Reality (MR).

[0007] In addition, the development of these 5G mobile communication systems includes new waveforms to ensure coverage in the terahertz band of 6G mobile communication technology, multi-antenna transmission technologies such as Full Dimensional MIMO (FD-MIMO), Array Antenna, and Large Scale Antenna, metamaterial-based lenses and antennas to improve the coverage of terahertz band signals, high-dimensional spatial multiplexing technology using Orbital Angular Momentum (OAM), Reconfigurable Intelligent Surface (RIS) technology, as well as full duplex technology to improve the frequency efficiency and system network of 6G mobile communication technology, satellite, AI (Artificial Intelligence) from the design stage and AI-based communication technology that realizes system optimization by internalizing end-to-end AI support functions, and ultra-high-performance communication and computing resources to provide services with complexity that exceeds the limits of terminal computing capabilities. It can serve as a basis for the development of next-generation distributed computing technologies that can be realized by utilizing them.

[0008] Based on the above discussion, the present disclosure seeks to address the following issues. To ensure legitimate use of a communication system, terminals and networks must authenticate each other. However, in a satellite communication system operating in store-and-forward mode, real-time communication between the terminal and the network may not be possible, making existing authentication systems inapplicable. Furthermore, these satellite communication systems may pose new security threats that did not previously exist. Therefore, to authenticate a satellite communication system operating in store-and-forward mode, modifications and improvements to existing authentication methods are necessary. The present disclosure seeks to provide the aforementioned modifications and disclosures.

[0009] A method of operating a UE (user equipment) (100) in a communication system according to an embodiment of the present disclosure may include: transmitting a first attach request message to a satellite device (200) through a service link; receiving retry information (retry info) indicating at least one of a reconnection time, a reconnection method, or a reconnection target from the satellite device (200) through the service link; and transmitting a second attach request message to the satellite device (200) based on the retry information.

[0010] The first connection request message may be transmitted in response to a first S&F indication received from the satellite device (200). The first S&F indication may be a parameter indicating that the satellite device (200) supports a store and forward mode.

[0011] The above first connection request message may be transmitted in response to a random value (SAT.RN) generated by the satellite device (200) received from the satellite device (200).

[0012] The first connection request message may include a second S&F indicator, which is a parameter indicating that the UE (100) supports store and forward mode.

[0013] The first connection request message may include an identifier (UE.ID) of the UE (100) and a signature (UE.Sig) generated by the UE (100).

[0014] The first connection request message may include a random value (UE.RN) generated by the UE (100) based on a random value (SAT.RN) received from the satellite device (200).

[0015] The above retry information may include an identifier (SAT.ID) of the satellite device (200) and a signature (SAT.Sig) generated by the satellite device (200).

[0016] The signature (SAT.Sig) generated by the satellite device (200) can be generated based on a random value (UE.RN) generated by the UE (100).

[0017] The above operating method may include a step of verifying the validity of a signature (SAT.Sig) generated by the satellite device (200).

[0018] The above method of operation may include a step of completing authentication for the satellite device (200) when the validity is verified.

[0019] The second connection request message may include an identifier (UE.ID) of the UE (100) and a signature (UE.Sig) generated by the UE (100).

[0020] A method of operating a satellite device (200) in a communication system according to an embodiment of the present disclosure may include: receiving a first attach request message from a user equipment (UE) (100) via a service link; transmitting retry information (retry info) indicating at least one of a reconnection time, a reconnection method, or a reconnection target to the UE (100) via the service link; and receiving a second attach request message from the UE (100) in response to the retry information.

[0021] The first connection request message may be transmitted in response to a first S&F indication transmitted from the satellite device (200) to the UE (100). The first S&F indication may be a parameter indicating that the satellite device (200) supports a store and forward mode.

[0022] The above first connection request message may be transmitted in response to a random value (SAT.RN) generated by the satellite device (200) transmitted from the satellite device (200) to the UE (100).

[0023] The first connection request message may include a second S&F indicator, which is a parameter indicating that the UE (100) supports store and forward mode.

[0024] The first connection request message may include an identifier (UE.ID) of the UE (100) and a signature (UE.Sig) generated by the UE (100).

[0025] The first connection request message may include a random value (UE.RN) generated by the UE (100) based on a random value (SAT.RN) transmitted by the satellite device (200) to the UE (100).

[0026] The above retry information may include an identifier (SAT.ID) of the satellite device (200) and a signature (SAT.Sig) generated by the satellite device (200).

[0027] The signature (SAT.Sig) generated by the satellite device (200) can be generated based on a random value (UE.RN) generated by the UE (100).

[0028] The above method of operation may include a step of verifying the validity of a signature (UE.Sig) generated by the UE (100).

[0029] The above method of operation may include a step of completing authentication for the UE (100) when the validity is verified.

[0030] The second connection request message may include an identifier (UE.ID) of the UE (100) and a signature (UE.Sig) generated by the UE (100).

[0031] Various embodiments of the present disclosure may provide an authentication method and device for ensuring legitimate use of a communication system in a satellite communication in a store-and-forward mode.

[0032] The effects that can be obtained from the present disclosure are not limited to the effects mentioned in the various embodiments, and other effects that are not mentioned can be clearly understood by a person having ordinary skill in the art to which the present disclosure belongs from the description below.

[0033] FIG. 1 is a conceptual diagram illustrating two different modes of satellite communication in a communication system according to an embodiment of the present disclosure.

[0034] FIG. 2 is a conceptual diagram illustrating a preprocessing process for using an identity-based digital signature scheme in a communication system according to an embodiment of the present disclosure.

[0035] FIG. 3 is a conceptual diagram illustrating an identity-based digital signature scheme in a communication system according to an embodiment of the present disclosure.

[0036] FIG. 4 is a conceptual diagram illustrating an EPS network to be used in the embodiment of FIG. 5 in a communication system according to an embodiment of the present disclosure.

[0037] FIG. 5 is a flowchart illustrating the flow of an authentication method for satellite communication in a storage and transmission mode based on the network illustrated in FIG. 4 in a communication system according to an embodiment of the present disclosure.

[0038] FIG. 6 is a flowchart illustrating a 5G network and a basic authentication process to be used in the embodiment of FIG. 7 in a communication system according to an embodiment of the present disclosure.

[0039] FIG. 7 is a flowchart illustrating the flow of an authentication method for satellite communication in a storage and transmission mode based on the network illustrated in FIG. 6 in a communication system according to an embodiment of the present disclosure.

[0040] FIG. 8 is a flowchart illustrating a connection request process disclosed as part of FIG. 5 or FIG. 7 in a communication system according to an embodiment of the present disclosure.

[0041] FIG. 9 is a flowchart illustrating a connection request process disclosed as part of FIG. 5 or FIG. 7 in a communication system according to an embodiment of the present disclosure.

[0042] FIG. 10 is a flowchart illustrating a connection request process disclosed as part of FIG. 5 or FIG. 6 to FIG. 7 in a communication system according to an embodiment of the present disclosure.

[0043] FIG. 11 is a block diagram illustrating a UE (100) in a communication system according to an embodiment of the present disclosure.

[0044] FIG. 12 is a block diagram illustrating a satellite device (200) in a communication system according to an embodiment of the present disclosure.

[0045] FIG. 13 is a block diagram illustrating a GN device (300) in a communication system according to an embodiment of the present disclosure.

[0046] The terms used in this disclosure are used only to describe specific embodiments and may not be intended to limit the scope of other embodiments. The singular expression may include plural expressions unless the context clearly indicates otherwise. Terms used herein, including technical or scientific terms, may have the same meaning as commonly understood by those of ordinary skill in the art described in this disclosure. Terms defined in general dictionaries among the terms used in this disclosure may be interpreted as having the same or similar meaning in the context of the relevant technology, and shall not be interpreted in an idealized or overly formal sense unless explicitly defined in this disclosure. In some cases, even if a term is defined in this disclosure, it cannot be interpreted to exclude embodiments of the present disclosure.

[0047] The various embodiments of the present disclosure described below illustrate a hardware-based approach as an example. However, since the various embodiments of the present disclosure include techniques utilizing both hardware and software, the various embodiments of the present disclosure do not exclude a software-based approach.

[0048] Hereinafter, various embodiments will be described in detail with reference to the accompanying drawings. Furthermore, when describing embodiments of the present disclosure, detailed descriptions of related known functions or configurations will be omitted if they are deemed to unnecessarily obscure the gist of the embodiments. Furthermore, the terms described below are defined in consideration of their functions in the embodiments, and may vary depending on the intent or custom of the user or operator. Therefore, their definitions should be based on the contents throughout this specification.

[0049] For the same reason, some components in the attached drawings are exaggerated, omitted, or schematically depicted. Furthermore, the dimensions of each component do not entirely reflect its actual size.

[0050] The advantages and features of the present disclosure, and methods for achieving them, will become clearer with reference to the embodiments described below in detail with the accompanying drawings. However, the present disclosure is not limited to the embodiments disclosed below and may be implemented in various different forms. These embodiments are provided solely to ensure the completeness of the present disclosure and to fully inform those skilled in the art of the scope of the disclosure, and the present disclosure is defined solely by the scope of the claims.

[0051] At this time, it will be understood that each block of the processing flowchart drawings and combinations of the flowchart drawings can be performed by computer program instructions. These computer program instructions can be installed in a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing equipment, so that the instructions executed by the processor of the computer or other programmable data processing equipment create a means for performing the functions described in the flowchart block(s). These computer program instructions can also be stored in a computer-available or computer-readable memory that can direct a computer or other programmable data processing equipment to implement the functions in a specific manner, so that the instructions stored in the computer-available or computer-readable memory can also produce a manufactured item that includes an instruction means for performing the functions described in the flowchart block(s). Since the computer program instructions may be installed on a computer or other programmable data processing device, a series of operational steps may be performed on the computer or other programmable data processing device to create a computer-executable process, and the instructions that cause the computer or other programmable data processing device to perform the steps for performing the functions described in the flowchart block(s) may also provide steps for performing the functions described in the flowchart block(s).

[0052] Additionally, each block may represent a module, segment, or portion of code that contains one or more executable instructions for performing a specific logical function(s). It should also be noted that in some alternative implementation examples, the functions described in the blocks may occur out of order. For example, two blocks depicted in succession may actually be executed substantially concurrently, or the blocks may sometimes be executed in reverse order, depending on their respective functions.

[0053] Here, the term '~ unit' used in various embodiments of the present disclosure means a software or hardware component such as an FPGA or ASIC, and the '~ unit' can perform certain roles. However, the '~ unit' is not limited to software or hardware. The '~ unit' may be configured to be on an addressable storage medium and may be configured to play one or more processors. Accordingly, as an example, the '~ unit' may include components such as software components, object-oriented software components, class components, and task components, processes, functions, properties, procedures, subroutines, segments of program code, drivers, firmware, microcode, circuits, data, databases, data structures, tables, arrays, and variables. The functions provided within the components and '~ units' may be combined into a smaller number of components and '~ units' or further separated into additional components and '~ units'. Additionally, components and '~parts' may be implemented to regenerate one or more CPUs within a device or secure multimedia card.

[0054] FIG. 1 is a conceptual diagram illustrating two different modes of satellite communication in a communication system according to an embodiment of the present disclosure.

[0055] The definitions of the UE (user equipment) (100), satellite (200), and GN (ground network) (300) illustrated in FIG. 1 can be found in FIG. 5 or FIG. 7.

[0056] The communication between the UE (100) and the satellite (200) illustrated in Fig. 1 may be collectively referred to as a service link. The communication between the satellite (200) and the GN (300) illustrated in Fig. 1 may be collectively referred to as a feeder link.

[0057] The two different modes of satellite communication are as follows:

[0058] 1. Normal mode

[0059] When both the service link and feeder link are available simultaneously, real-time communication between the UE (100) and the GN (300) can be possible.

[0060] 2. Store and Forward mode

[0061] There is a time when both the service link and the feeder link are not available at the same time. At this time, real-time communication between the UE (100) and the GN (300) may not be possible. That is, when the service link is available but the feeder link is not available, the message that the UE (100) sends to the GN (300) cannot be transmitted to the GN (300) in real time, and the satellite (200) stores the message and can transmit the message to the GN (300) when the feeder link becomes available. Or, conversely, if the feeder link is available but the service link is not available, the message that the GN (300) sends to the UE (100) cannot be transmitted to the UE (100) in real time, and the satellite (200) stores the message and can transmit the message to the UE (100) when the service link becomes available.

[0062] FIG. 2 is a conceptual diagram illustrating a preprocessing process for using an identity-based digital signature scheme in a communication system according to an embodiment of the present disclosure.

[0063] The Key Management Service (KMS) (1100) illustrated in FIG. 2 may be an entity that generates / distributes security materials necessary for an identity-based digital signature scheme to operate. The signer (12000) illustrated in FIG. 2 may be an entity that generates an electronic signature using an identity-based digital signature scheme. The verifier (1300) illustrated in FIG. 2 may be an entity that verifies an electronic signature using an identity-based digital signature scheme.

[0064] The preprocessing process for using the identity-based digital signature scheme disclosed in FIG. 2, i.e., the process of generating / distributing security materials required for the identity-based digital signature scheme to operate, may be as follows.

[0065] - KMS (1100) may have its own (public key, private key) pair (KPAK (KMS Public Authentication Key), KSAK (KMS Secret Authentication Key).

[0066] - KMS (1100) can generate a (Public Validation Token), v), which is a (public key, private key) pair, for a specific signer (Signer (1200).

[0067] - KMS (1100) can generate an SSK for a specific signer (Singer) (1200). At this time, one or more of the following information can be used to generate the SSK.

[0068] ■ KPAK

[0069] ■ V

[0070] ■ KSAK

[0071] ■ Signer (1200) ID

[0072] ■ PVT

[0073] - KMS (1100) can send one or more of the following information to Signer (1200).

[0074] ■ SSK (Secret Signing Key)

[0075] ■ PVT

[0076] ■ KPAK

[0077] - KMS (1100) can transmit one or more of the following information to Verifier (1300).

[0078] ■ KPAK

[0079] FIG. 3 is a conceptual diagram illustrating an identity-based digital signature scheme in a communication system according to an embodiment of the present disclosure.

[0080] The signer (1200) illustrated in FIG. 3 may be an entity that generates an electronic signature using an identity-based digital signature scheme. The verifier (1300) illustrated in FIG. 3 may be an entity that verifies an electronic signature using an identity-based digital signature scheme.

[0081] The identity-based digital signature scheme disclosed in FIG. 3, i.e., the process in which a signer (1200) creates an electronic signature and a verifier (1300) verifies the electronic signature, may be as follows. (The preprocessing process for performing the following process will be referred to FIG. 2.)

[0082] In step 1, the signer (1200) may perform one or more of the following steps:

[0083] - The signer (1200) can select a message M on which to perform signing.

[0084] - The signer (Singer) (1200) can create a signature message targeting the selected M. At this time, one or more of the following information may be used.

[0085] ■ M

[0086] ■ KPAK

[0087] ■ Signer (1200) ID

[0088] ■ PVT

[0089] ■ SSK

[0090] - The signer (1200) can generate an electronic signature value. At this time, one or more of the following information may be included in the electronic signature.

[0091] ■ The signature message generated above

[0092] ■ PVT

[0093] In step 2, one or more of the following processes may be performed:

[0094] - The Signer (1200) may transmit one or more of the following information to the Verifier (1300):

[0095] ■ ID of the signer (Singer) (1200)

[0096] ■ M

[0097] ■ Electronic signature

[0098] In step 3, the verifier (1300) may perform one or more of the following processes.

[0099] - The verifier (1300) can verify the received electronic signature. The above process can be understood as a process of verifying the validity of the signature message included in the electronic signature. The validity of the signature message can be verified using one or more of the following information.

[0100] ■ Signer (1200) ID

[0101] ■ M

[0102] ■ KPAK

[0103] ■ PVT

[0104] FIG. 4 is a conceptual diagram illustrating an EPS network to be used in the embodiment of FIG. 5 in a communication system according to an embodiment of the present disclosure.

[0105] The UE (100) illustrated in FIG. 4 is an abbreviation for user equipment, and is also collectively called a terminal, and may include a mobile station (MS), a cellular phone, a smartphone, a computer, an IoT device, or a multimedia system capable of performing a communication function.

[0106] The eNB (400) illustrated in FIG. 4 is a subject that performs resource allocation of the UE (100), and may be at least one of an eNode B, a Node B, a BS (base station), a RAN (radio access network), an AN (access network), a RAN node, a NR NB, a gNB, a wireless access unit, a base station controller, or a node on a network.

[0107] The MME (Mobility Management Entity) (500) illustrated in FIG. 4 may be an entity that provides mobility management functions and session management functions of the UE (100).

[0108] The HSS (Home Subscriber Server) (600) illustrated in FIG. 4 may be an entity that provides data management functions such as subscriber data and policy control data.

[0109] Although this disclosure describes various embodiments using terms used in certain communication standards (e.g., 3rd Generation Partnership Project (3GPP)), particularly the Evolved Packet System (EPS), these are merely illustrative examples. That is, the various embodiments of this disclosure can also be applied to other communication systems with similar technical backgrounds or channel types. Therefore, the terms and / or concepts used in this disclosure are not limited to the terms and / or concepts used in this disclosure, and can be equally applied to objects having equivalent technical meanings.

[0110] FIG. 5 is a flowchart illustrating the flow of an authentication method for satellite communication in a storage and transmission mode based on the network illustrated in FIG. 4 in a communication system according to an embodiment of the present disclosure.

[0111] The UE (100) illustrated in FIG. 5 may be the UE (100) illustrated in FIG. 4. The satellite (200) illustrated in FIG. 5 may include the eNB (400) disclosed in FIG. 4. The satellite (200) illustrated in FIG. 5 may include a part and / or the entirety of the MME (500) disclosed in FIG. 4. The GN (300) illustrated in FIG. 5 may include a part and / or the entirety of the MME (500) disclosed in FIG. 4. The GN (300) illustrated in FIG. 5 may include the HSS (600) disclosed in FIG. 4.

[0112] The authentication process of Fig. 5 may be as follows.

[0113] STEP 1. (Service Link is available / Feeder Link is unavailable)

[0114] STEP 1 is collectively referred to as the Attach Request Procedure, and a detailed description of the process will be provided in FIGS. 8 to 10. Below, only a brief description of STEP 1 is provided.

[0115] - UE (100) can transmit an Attach Request message to satellite (200). At this time, authentication between UE (100) and the network cannot be completed immediately because the feeder link is not available. In this case, UE (100) may have to wait until STEP 3, which will be described later, and then attempt an attachment request again in step 4.

[0116] - In order to guide the operation of the UE (100) during the above-mentioned reconnection, the satellite (200) may transmit retry information (Retry Info) to the UE (100). The retry information may include one or more of the following information. For a more detailed description of the information listed below, refer to the disclosures of FIGS. 8 to 10.

[0117] ■ Reconnection Time: Information on when reconnection is possible

[0118] ■ Reconnection method: Information on how reconnection will be triggered.

[0119] ■ Reconnection target: Information on the satellite(s) (200) that will be the target of the request when requesting reconnection.

[0120] STEP 2. (Service Link is unavailable / Feeder Link is available)

[0121] In step 1, one or more of the following processes may be performed:

[0122] - Satellite (200) can transmit an authentication request message to GN (300).

[0123] In step 2, one or more of the following processes may be performed:

[0124] - GN (300) can prepare AV (Authentication Vector) for authentication. The AV can include AUTH (authentication) and XRES (eXpected RESponse).

[0125] In step 3, one or more of the following processes may be performed:

[0126] - GN (300) can transmit AUTH and XRES to satellite (200).

[0127] STEP 3. (Service Link is available / Feeder Link is unavailable)

[0128] The satellite of STEP 3 may be a satellite belonging to the list of reconnection targets initiated in STEP 1. Therefore, the satellite of STEP 3 and the satellite of STEP 1 may be the same satellite or different satellites.

[0129] In step 4, one or more of the following processes may be performed:

[0130] - The UE (100) can re-transmit an Attach Request message to the satellite (200). At this time, the UE (100) can make a re-attachment request based on the retry information (Retry Info) received in STEP 1. In other words, the UE (200) can make an attachment request based on the re-attachment time, method, and target information included in the retry information (Retry Info).

[0131] In step 5, one or more of the following processes may be performed:

[0132] - Satellite (200) can transmit AUTH to UE (100).

[0133] In step 6, one or more of the following processes may be performed:

[0134] - UE (100) can verify AUTH. Through the above process, UE (100) can authenticate the network.

[0135] In step 7, one or more of the following processes may be performed:

[0136] - UE (100) can generate a RES message.

[0137] - UE (100) can transmit a RES message to a satellite (Satellite) 200).

[0138] In step 8, one or more of the following processes may be performed:

[0139] - The satellite (200) can verify the RES message. Through the above process, the network and UE (100) can be authenticated.

[0140] In step 9, one or more of the following processes may be performed:

[0141] - The UE (100) and satellite (200) can perform the remaining procedures for secure NAS communication.

[0142] FIG. 6 is a flowchart illustrating a 5G network and a basic authentication process to be used in the disclosure of FIG. 7 in a wireless communication system according to an embodiment of the present disclosure.

[0143] The UE (100) illustrated in FIG. 6 is an abbreviation for user equipment, and is also collectively called a terminal, and may include a mobile station (MS), a cellular phone, a smartphone, a computer, an IoT device, or a multimedia system capable of performing a communication function.

[0144] SEAF (700) illustrated in Fig. 6 is an abbreviation for Security Anchor Function and can act as a middleman in the authentication process.

[0145] AUSF (800) illustrated in Fig. 6 is an abbreviation for Authentication Server Function and may be a network function responsible for authentication with a terminal (100).

[0146] UDM (900) illustrated in Fig. 6 is an abbreviation for Unified Data Management and may be an entity that provides data management functions such as subscriber data and policy control data.

[0147] Although various embodiments are described in this disclosure using terms used in certain communication standards (e.g., 3rd Generation Partnership Project (3GPP)), particularly those related to 5G systems, these are merely illustrative examples. That is, the various embodiments of this disclosure can also be applied to other communication systems with similar technical backgrounds or channel types. Therefore, the terms and / or concepts used in this disclosure are not limited to the terms and / or concepts used in this disclosure, and can be equally applied to objects having equivalent technical meanings.

[0148] The basic authentication process disclosed in Fig. 6 may be as follows.

[0149] In step 1, one or more of the following processes may be performed:

[0150] - UE (100) can request connection to SEAF (700).

[0151] In step 2, one or more of the following processes may be performed:

[0152] - SEAF (700) can request authentication initiation to AUSF (800). AUSF (800) can request data for authentication from UDM (900).

[0153] In step 3, one or more of the following processes may be performed:

[0154] - The UDM (900) can generate data AV (Authentication Vector) for authentication. The AV can include AUTH and XRES. The AUTH can be information used when the terminal (100) authenticates the network. The XRES can be information used when the network authenticates the terminal (100).

[0155] In step 4, one or more of the following processes may be performed:

[0156] - UDM (900) can transmit AUTH and XRES to AUSF (800).

[0157] In step 5, one or more of the following processes may be performed:

[0158] - AUSF (800) can generate HXRES (Hash eXpected RESponse) from the received XRES.

[0159] In step 6, one or more of the following processes may be performed:

[0160] - AUSF (800) can transmit AUTH and HXRES to SEAF (700).

[0161] In step 7, one or more of the following processes may be performed:

[0162] - SEAF (700) can transmit AUTH to UE (100).

[0163] In step 8, one or more of the following processes may be performed:

[0164] - UE (100) can authenticate the network using AUTH.

[0165] - UE (100) can generate RES.

[0166] In step 9, one or more of the following processes may be performed:

[0167] - UE (100) can transmit RES to SEAF (700).

[0168] In step 10, one or more of the following processes may be performed:

[0169] - SEAF (700) can authenticate the terminal by verifying the RES. However, this authentication may not complete the terminal authentication of the network.

[0170] In step 11, one or more of the following processes may be performed:

[0171] - SEAF (700) can transmit RES to AUSF (800). The above process can be performed when the 10-step authentication is successful.

[0172] In step 12, one or more of the following processes may be performed:

[0173] - AUSF (800) can authenticate RES. This process can terminate UE authentication in the network.

[0174] In step 13, one or more of the following processes may be performed:

[0175] - AUSF (800) can notify SEAF (700) that terminal authentication of the network has been successful.

[0176] In step 14, one or more of the following processes may be performed:

[0177] - UE (100) and SEAF (700) can perform the remaining procedures for secure NAS communication (secure NAS (Network Attached Storage) communication).

[0178] FIG. 7 is a flowchart illustrating the flow of an authentication method for satellite communication in a storage and transmission mode based on the network illustrated in FIG. 6 in a communication system according to an embodiment of the present disclosure.

[0179] The UE (100) illustrated in FIG. 7 may be the UE (100) illustrated in FIG. 6. The satellite (200) illustrated in FIG. 7 may include a part and / or the entirety of the SEAF (700) disclosed in FIG. 6. The satellite (200) illustrated in FIG. 7 may include a part and / or the entirety of the ASUF (800) disclosed in FIG. 6. The GN (300) illustrated in FIG. 7 may include a part and / or the entirety of the SEAF (700) disclosed in FIG. 6. The GN (300) illustrated in FIG. 7 may include a part and / or the entirety of the AUSF (800) disclosed in FIG. 6. The GN (300) illustrated in FIG. 7 may include the UDM (900) illustrated in FIG. 6.

[0180] The authentication process disclosed in FIG. 7 may be a modified process for satellite communication in storage and transmission mode based on the authentication process disclosed in FIG. 6. The modified process may be as follows.

[0181] STEP 1. (Service Link is available / Feeder Link is unavailable)

[0182] STEP 1 is collectively referred to as the Attach Request Procedure, and a detailed description of the process will be provided in FIGS. 8 to 10. Below, only a brief description of STEP 1 is provided.

[0183] - The UE (100) can transmit an Attach Request message to the satellite (200). At this time, since the feeder link is not available, authentication between the terminal (100) and the network cannot be completed immediately. In this case, the UE (100) can wait until STEP 3, which will be described later, and then attempt an attachment request again in step 3.

[0184] - In order to guide the operation of the UE (100) during the above-mentioned reconnection, the satellite (200) may transmit retry information (Retry Info) to the UE (100). The retry information may include one or more of the following information. For a more detailed description of the information listed below, refer to the disclosures of FIGS. 8 to 10.

[0185] ■ Reconnection Time: Information on when reconnection is possible

[0186] ■ Reconnection method: Information on how reconnection will be triggered.

[0187] ■ Reconnection target: Information on the satellite(s) (200) that will be the target of the request when requesting reconnection.

[0188] STEP 2. (Service Link is unavailable / Feeder Link is available)

[0189] In step 1, one or more of the following processes may be performed:

[0190] - A process corresponding to step 2 of Fig. 6 can be performed.

[0191] In step 2, one or more of the following processes may be performed:

[0192] - A process corresponding to steps 3 to 6 of FIG. 6 can be performed.

[0193] STEP 3. (Service Link is available / Feeder Link is unavailable)

[0194] The satellite (200) of STEP 3 may be a satellite (200) belonging to the reconnection target list initiated in STEP 1. Therefore, the satellite (200) of STEP 3 and the satellite (200) of STEP 1 may be the same satellite or different satellites.

[0195] In step 3, one or more of the following processes may be performed:

[0196] - The UE (100) can re-transmit an Attach Request message to the satellite (200). At this time, the UE (100) can make a re-attachment request based on the retry information (Retry Info) received in STEP 1. In other words, the UE (100) can make an attachment request based on the re-attachment time, method, and target information included in the retry information (Retry Info).

[0197] After step 3, processes corresponding to steps 7 to 14 of FIG. 6 can be performed.

[0198] Let's define two concepts that will be commonly used in Figures 8 through 10, which will be described later. One is the S&F indication, and the other is retry information. The two concepts can be explained as follows.

[0199] [S&F indication]

[0200] - The S&F indication can be transmitted by the UE (100) or the satellite (200).

[0201] - The meaning of S&F indication may include one or more of the following meanings.

[0202] ■ S&F indication may be a parameter indicating that the transmitting entity supports store and forward mode.

[0203] ■ The S&F indication may be a parameter indicating that the transmitting entity will operate in store and forward mode.

[0204] [Retry Info]

[0205] - Retry information (Retry Info) may be information sent from a satellite (200) to guide the process when the UE (100) requests to connect to the network again in order to complete authentication when the UE (100) requests to connect to the network but authentication is not completed due to the store and forward mode operation. The retry information (Retry Info) may include one or more of the following information.

[0206] ■ Reconnection time

[0207] ◆ The above information may be information about when the UE (100) will attempt to reconnect to the network.

[0208] ● The above information may be information about the time when the UE (100) attempts to reconnect to the network.

[0209] ● The above information may be information about the time that the UE (100) must wait before attempting to reconnect to the network.

[0210] ■ How to reconnect

[0211] ◆ The above information may be information on how the UE (100) becomes a trigger to attempt to reconnect to the network.

[0212] ● The above information may mean that the UE (100) must attempt reconnection after receiving a broadcasting message (e.g., SIB (System Information Block)) from the satellite (200).

[0213] ● The above information may mean that the UE (100) must attempt reconnection after receiving a paging message from the satellite (200).

[0214] ■ Reconnection target

[0215] ◆ The above information may be information about a satellite (200) that the UE (100) will contact to attempt to reconnect to the network.

[0216] ● The above information may be list information specifying a single satellite or multiple satellites. The list containing the single or multiple satellite information may or may not include the satellite transmitting the list.

[0217] ● The UE (100) may attempt to reconnect when it receives a broadcasting message transmitted by the satellite(s) included in the above list. The UE (100) may attempt to reconnect when it receives a paging message transmitted by the satellite(s) included in the above list.

[0218] FIG. 8 is a flowchart illustrating a connection request process disclosed as part of FIG. 5 or FIG. 7 in a wireless communication system according to an embodiment of the present disclosure.

[0219] That is, the disclosure of FIG. 8 may be a process corresponding to the attach request procedure of FIG. 5 or FIG. 7. At this time, the definitions of the UE (100) and the satellite (200) may follow the definitions disclosed in FIG. 5 and FIG. 7.

[0220] The connection request process of Fig. 8 may be as follows.

[0221] In step 1, one or more of the following processes may be performed:

[0222] - Satellite (200) can transmit S&F indication to UE (100).

[0223] - The satellite (200) can transmit SAT.RN to the UE (100). The SAT.RN may be a random number generated by the satellite (200).

[0224] In step 2, one or more of the following processes may be performed:

[0225] - UE (100) can transmit S&F indication to satellite (200).

[0226] - UE (100) can transmit UE.ID and UE.Sig to satellite (200). The UE.ID may be the ID of the UE (100). (The ID is an ID for performing the process disclosed in FIGS. 2 and 3, and any form / type of ID may be used as long as the purpose can be technically achieved.) The UE.Sig may be an electronic signature generated by the UE (100). The UE.Sig may be an electronic signature generated through the process disclosed in FIG. 3. When the process disclosed in FIG. 3 is used, the ID used by the UE (100) is UE.ID, and the M used by the UE (100) may include SAT.RN. The M used by the UE (100) may further include any message transmitted by the UE (100). For example, the M used by the UE (100) may further include at least one of an S&F indication and UE.RN.

[0227] - UE (100) can transmit UE.RN to satellite (200). The UE.RN may be a random number generated by UE (100).

[0228] - The satellite (200) can authenticate the UE (100) by verifying the validity of the received UE.Sig. The verification method can follow the process of FIG. 3.

[0229] In step 3, one or more of the following processes may be performed:

[0230] - The satellite (200) can transmit retry information (Retry Info) to the UE (100).

[0231] - The satellite (200) can transmit SAT.ID and SAT.Sig to the UE (100). The SAT.ID may be an ID of the satellite (200). (The ID is an ID for performing the process disclosed in FIGS. 2 and 3, and any form / type of ID may be used as long as the purpose can be technically achieved.) The SAT.Sig may be an electronic signature generated by the satellite (200). The SAT.Sig may be an electronic signature generated through the process disclosed in FIG. 3. When the process disclosed in FIG. 3 is used, the ID used by the satellite (200) is SAT.ID, and the M used by the satellite (200) may include UE.RN. The M used by the satellite (200) may further include any message transmitted by the satellite (200). For example, M used by Satellite (200) may further include Retry Info.

[0232] - The UE (100) can authenticate the satellite (200) by verifying the validity of the received SAT.Sig. The verification method can follow the process of FIG. 3.

[0233] The above-described operation may be an embodiment in which the operation described in FIG. 8 is applied to STEP 1 of FIG. 5 or STEP 1 of FIG. 7. The above-described operation may be applied to STEP 3 of FIG. 5 or STEP 3 of FIG. 7. In the case of application as described above, some of the operations of 'STEP 3 of FIG. 5 or STEP 3 of FIG. 7' described above may vary as follows. (Operations of 'STEP 3 of FIG. 5 or STEP 3 of FIG. 7' that are not described below may be substantially the same as or similar to the operations of 'STEP 3 of FIG. 5 or STEP 3 of FIG. 7' described above.)

[0234] [When the operation described in Fig. 8 is applied to STEP 3 of Fig. 5]

[0235] The operation described in Fig. 8 can be applied to STEP3 of Fig. 5 according to the method described below.

[0236] Step 1 of FIG. 8 may be performed before step 4 of FIG. 5 is executed.

[0237] Step 4 of FIG. 5 and Step 2 of FIG. 8 can be combined as follows: UE (100) can transmit the message described in Step 4 of FIG. 5 to Satellite (200). UE (100) can further transmit the message described in Step 2 of FIG. 8 to Satellite (200). At this time, M, which is used for generating UE.Sig among the messages described in Step 2 of FIG. 8, can further include the message described in Step 4 of FIG. 5.

[0238] Step 5 of FIG. 5 and Step 3 of FIG. 8 can be combined as follows: The satellite (200) can transmit the message described in Step 5 of FIG. 5 to the UE (100). The satellite (200) can further transmit the message described in Step 3 of FIG. 8 to the UE (100). At this time, among the messages described in Step 3 of FIG. 8, M used for generating SAT.Sig can further include the message described in Step 5 of FIG. 5.

[0239] [When the disclosure of Fig. 8 is applied to STEP 3 of Fig. 7]

[0240] As described above, STEP 3 of FIG. 7 can be composed of the sequential progression of ‘Step 3 of FIG. 7’ and ‘Steps 7 to 14 of FIG. 6’.

[0241] The operation described in Fig. 8 can be applied to STEP3 of Fig. 7 according to the method described below.

[0242] Step 1 of FIG. 8 may be performed before step 3 of FIG. 7 is executed.

[0243] Step 3 of FIG. 7 and Step 2 of FIG. 8 can be combined as follows: UE (100) can transmit the message described in Step 3 of FIG. 7 to Satellite (200). UE (100) can further transmit the message described in Step 2 of FIG. 8 to Satellite (200). At this time, M, which is used for generating UE.Sig among the messages described in Step 2 of FIG. 8, can further include the message described in Step 3 of FIG. 7.

[0244] During the operation after step 3 of FIG. 7, 'step 7 of FIG. 6' and step 3 of FIG. 8 can be combined as follows: The satellite (200) can transmit the message described in step 7 of FIG. 6 to the UE (100). The satellite (200) can further transmit the message described in step 3 of FIG. 8 to the UE (100). At this time, among the messages described in step 3 of FIG. 8, M used for generating SAT.Sig can further include the message described in step 7 of FIG. 6.

[0245] FIG. 9 is a flowchart illustrating a connection request process disclosed as part of FIG. 5 or FIG. 6 to FIG. 7 in a communication system according to an embodiment of the present disclosure.

[0246] That is, the disclosure of FIG. 9 may be a process corresponding to the attach request procedure of FIG. 5 or FIG. 7. At this time, the definitions of the UE (100) and the satellite (200) may follow the definitions disclosed in FIG. 5 and FIG. 7.

[0247] The connection request process of Fig. 9 may be as follows.

[0248] In step 1, one or more of the following processes may be performed:

[0249] - Satellite (200) can transmit S&F indication to UE (100)

[0250] In step 2, one or more of the following processes may be performed:

[0251] - UE (100) can transmit an S&F (store and forward) indication to a satellite (200).

[0252] - UE (100) can transmit UE.RN to satellite (200). The UE.RN may be a random number generated by UE (100).

[0253] In step 3, one or more of the following processes may be performed:

[0254] - The satellite (200) can transmit retry information (Retry Info) to the UE (100).

[0255] - The satellite (200) can transmit SAT.ID and SAT.Sig to the UE (100). The SAT.ID may be an ID of the satellite (200). (The ID is an ID for performing the process disclosed in FIGS. 2 and 3, and any form / type of ID may be used as long as the purpose can be technically achieved.) The SAT.Sig may be an electronic signature generated by the satellite (200). The SAT.Sig may be an electronic signature generated through the process disclosed in FIG. 3. When the process disclosed in FIG. 3 is used, the ID used by the satellite (200) is SAT.ID, and the M used by the satellite (200) may include UE.RN. The M used by the satellite (200) may further include any message transmitted by the satellite (200). For example, the M used by the satellite (200) may further include at least one of Retry Info and SAT.RN.

[0256] - The satellite (200) can transmit SAT.RN to the UE (100). The SAT.RN may be a random number generated by the satellite (200).

[0257] - The UE (100) can authenticate the satellite (200) by verifying the validity of the received SAT.Sig. The verification method can follow the process of FIG. 3.

[0258] In step 4, one or more of the following processes may be performed:

[0259] - UE (100) can transmit UE.ID and UE.Sig to satellite (200). The UE.ID may be the ID of UE (100). The UE.Sig may be an electronic signature generated by UE (100). The UE.Sig may be an electronic signature generated through the process disclosed in FIG. 3. When the process disclosed in FIG. 3 is used, the ID used by UE (100) is UE.ID, and the M used by UE (100) may include SAT.RN.

[0260] - The satellite (200) can authenticate the UE (100) by verifying the validity of the received UE.Sig. The verification method can follow the process of FIG. 3.

[0261] The above-described operation may be an embodiment in which the operation described in FIG. 9 is applied to STEP 1 of FIG. 5 or STEP 1 of FIG. 7. The above-described operation may be applied to STEP 3 of FIG. 5 or STEP 3 of FIG. 7. In such a case, some of the operations of 'STEP 3 of FIG. 5 or STEP 3 of FIG. 7' described above may vary as follows. (Operations of 'STEP 3 of FIG. 5 or STEP 3 of FIG. 7' that are not described below may be substantially the same as or similar to the operations of 'STEP 3 of FIG. 5 or STEP 3 of FIG. 7' described above.)

[0262] [When the operation described in Fig. 9 is applied to STEP 3 of Fig. 5]

[0263] The operation described in Fig. 9 can be applied to STEP3 of Fig. 5 according to the method described below.

[0264] Step 1 of FIG. 9 may be performed before step 4 of FIG. 5 is executed.

[0265] Step 4 of FIG. 5 and Step 2 of FIG. 9 can be combined as follows: UE (100) can transmit the message described in Step 4 of FIG. 5 to Satellite (200). UE (100) can further transmit the message described in Step 2 of FIG. 9 to Satellite (200).

[0266] Step 5 of FIG. 5 and Step 3 of FIG. 9 can be combined as follows: The satellite (200) can transmit the message described in Step 5 of FIG. 5 to the UE (100). The satellite (200) can further transmit the message described in Step 3 of FIG. 9 to the UE (100). At this time, among the messages described in Step 3 of FIG. 9, M used for generating SAT.Sig can further include the message described in Step 5 of FIG. 5.

[0267] Step 7 of FIG. 5 and Step 4 of FIG. 9 can be combined as follows: UE (100) can transmit the message described in Step 7 of FIG. 5 to Satellite (200). UE (100) can further transmit the message described in Step 4 of FIG. 9 to Satellite (200). At this time, M, which is used for generating UE.Sig among the messages described in Step 4 of FIG. 9, can further include the message described in Step 7 of FIG. 5.

[0268] [When the operation of Fig. 9 is applied to STEP 3 of Fig. 7]

[0269] As described above, STEP 3 of FIG. 7 can be composed of the sequential progression of ‘Step 3 of FIG. 7’ and ‘Steps 7 to 14 of FIG. 6’.

[0270] The operation described in Fig. 9 can be applied to STEP3 of Fig. 7 according to the method described below.

[0271] Step 1 of FIG. 9 may be performed before step 3 of FIG. 7 is executed.

[0272] Step 3 of FIG. 7 and Step 2 of FIG. 9 can be combined as follows: UE (100) can transmit the message described in Step 3 of FIG. 7 to Satellite (200). UE (100) can further transmit the message described in Step 2 of FIG. 9 to Satellite (200).

[0273] During the operation after step 3 of FIG. 7, 'step 7 of FIG. 6' and step 3 of FIG. 9 can be combined as follows: The satellite (200) can transmit the message described in step 7 of FIG. 6 to the UE (100). The satellite (200) can further transmit the message described in step 3 of FIG. 9 to the UE (100). At this time, among the messages described in step 3 of FIG. 9, M used for generating SAT.Sig can further include the message described in step 7 of FIG. 6.

[0274] After step 3 of FIG. 7, the operation of 'step 9 of FIG. 6' and step 4 of FIG. 9 can be combined as follows: UE (100) can transmit the message described in step 9 of FIG. 6 to satellite (200). UE (100) can further transmit the message described in step 4 of FIG. 9 to satellite (200). At this time, M used for generating UE.Sig among the messages described in step 4 of FIG. 9 can further include the message described in step 9 of FIG. 6.

[0275] FIG. 10 is a flowchart illustrating a connection request process disclosed as part of FIG. 5 or FIG. 6 to FIG. 7 in a communication system according to an embodiment of the present disclosure.

[0276] That is, the disclosure of FIG. 10 may be a process corresponding to the attach request procedure of FIG. 5 or FIG. 7. At this time, the definitions of the UE (100) and the satellite (200) may follow the definitions disclosed in FIG. 5 and FIG. 7.

[0277] The connection request process of Fig. 10 may be as follows.

[0278] In step 1, one or more of the following processes may be performed:

[0279] - Satellite (200) can transmit S&F indication to UE (100).

[0280] In step 2, one or more of the following processes may be performed:

[0281] - UE (100) can transmit an S&F indication to a satellite (200).

[0282] - UE (100) can transmit UE.ID and UE.Sig to satellite (200). The UE.ID may be the ID of the UE (100). (The ID is an ID for performing the process disclosed in FIGS. 2 and 3, and any form / type of ID may be used as long as the purpose can be technically achieved.) The UE.Sig may be an electronic signature generated by the UE (100). The UE.Sig may be an electronic signature generated through the process disclosed in FIG. 3. When the process disclosed in FIG. 3 is used, the ID used by the UE (100) is UE.ID, and the M used by the UE (100) may be any information that can prevent a replay attack. A possible M may be one of the examples presented below.

[0283] ■ M may be current time information. When current time information is used as M, various verification mechanisms utilizing it may be used. As an example, a UE (100), which is a signer (1200), may generate an electronic signature using current time information, and a satellite (200), which is a verifier (1300), may verify whether the received time information is acceptable within a specific error range. The M used by the UE (100) may further include any message transmitted by the UE (100). For example, the M used by the UE (100) may further include an S&F indication.

[0284] - The satellite (200) can authenticate the UE (100) by verifying the validity of the received UE.Sig. (The validity verification may include verification of whether the value of the signed message included in the electronic signature is correct. The validity verification may include verification of whether the content of the message that is the target of the signature is acceptable.) The method for verifying the validity of the signed message may follow the process of FIG. 3.

[0285] In step 3, one or more of the following processes may be performed:

[0286] - The satellite (200) can transmit retry information (Retry Info) to the UE (100).

[0287] - The satellite (200) can transmit SAT.ID and SAT.Sig to the UE (100). The SAT.ID may be an ID of the satellite (Satellite). (The ID is an ID for performing the process disclosed in FIGS. 2 and 3, and any form / type of ID may be used as long as the purpose can be technically achieved.) The SAT.Sig may be an electronic signature generated by the satellite (Satellite) (200). The SAT.Sig may be an electronic signature generated through the process disclosed in FIG. 3. When the process disclosed in FIG. 3 is used, the ID used by the satellite (Satellite) (200) is SAT.ID, and the M used by the satellite (Satellite) (200) may be any information that can prevent a replay attack. A possible M may be one of the examples presented below.

[0288] ■ M may be current time information. When current time information is used as M, various verification mechanisms utilizing it may be used. For example, a satellite (200), which is a signer (1200), may generate an electronic signature using current time information, and a UE (100), which is a verifier (1300), may verify whether the received time information is acceptable within a specific error range. The M used by the satellite (200) may further include any message transmitted by the satellite (200). For example, the M used by the satellite (200) may further include Retry Info.

[0289] - The UE (100) can authenticate the satellite (200) by verifying the validity of the received SAT.Sig. (The validity verification may include verification of whether the value of the signed message included in the electronic signature is correct. The validity verification may include verification of whether the content of the message that is the target of the signature is acceptable.) The method for verifying the validity of the signed message may follow the process of FIG. 3.

[0290] The above-described operation may be an embodiment in which the operation described in FIG. 10 is applied to STEP 1 of FIG. 5 or STEP 1 of FIG. 7. The above-described operation may be applied to STEP 3 of FIG. 5 or STEP 3 of FIG. 7. In such a case, some of the operations of 'STEP 3 of FIG. 5 or STEP 3 of FIG. 7' described above may vary as follows. (Operations of 'STEP 3 of FIG. 5 or STEP 3 of FIG. 7' that are not described below may be substantially the same as or similar to the operations of 'STEP 3 of FIG. 5 or STEP 3 of FIG. 7' described above.)

[0291] [If the operation described in Fig. 10 is applied to STEP 3 of Fig. 5]

[0292] The operation described in Fig. 10 can be applied to STEP3 of Fig. 5 according to the method described below.

[0293] Step 1 of FIG. 10 may be performed before step 4 of FIG. 5 is executed.

[0294] Step 4 of FIG. 5 and Step 2 of FIG. 10 can be combined as follows: UE (100) can transmit the message described in Step 4 of FIG. 5 to Satellite (200). UE (100) can further transmit the message described in Step 2 of FIG. 10 to Satellite (200). At this time, M used for generating UE.Sig among the messages described in Step 2 of FIG. 10 can further include the message described in Step 4 of FIG. 5.

[0295] Step 5 of FIG. 5 and Step 3 of FIG. 10 can be combined as follows: The satellite (200) can transmit the message described in Step 5 of FIG. 5 to the UE (100). The satellite (200) can further transmit the message described in Step 3 of FIG. 10 to the UE (100). At this time, among the messages described in Step 3 of FIG. 10, M used for generating SAT.Sig can further include the message described in Step 5 of FIG. 5.

[0296] [If the operation described in Fig. 10 is applied to STEP 3 of Fig. 7]

[0297] As described above, STEP 3 of FIG. 7 can be composed of the sequential progression of ‘Step 3 of FIG. 7’ and ‘Steps 7 to 14 of FIG. 6’.

[0298] The operation described in Fig. 10 can be applied to STEP3 of Fig. 7 according to the method described below.

[0299] Step 1 of FIG. 10 may be performed before step 3 of FIG. 7 is executed.

[0300] Step 3 of FIG. 7 and Step 2 of FIG. 10 can be combined as follows: UE (100) can transmit the message described in Step 3 of FIG. 7 to Satellite (200). UE (100) can further transmit the message described in Step 2 of FIG. 10 to Satellite (200). At this time, M, which is used for generating UE.Sig among the messages described in Step 2 of FIG. 10, can further include the message described in Step 3 of FIG. 7.

[0301] During the operation after step 3 of FIG. 7, 'step 7 of FIG. 6' and step 3 of FIG. 10 can be combined as follows: The satellite (200) can transmit the message described in step 7 of FIG. 6 to the UE (100). The satellite (200) can further transmit the message described in step 3 of FIG. 10 to the UE (100). At this time, among the messages described in step 3 of FIG. 10, M used for generating SAT.Sig can further include the message described in step 7 of FIG. 6.

[0302] FIG. 11 is a block diagram illustrating a UE (100) in a communication system according to an embodiment of the present disclosure.

[0303] Referring to FIG. 11, the UE (100) may include a processor (110) that controls the overall operation of the UE (100), a transceiver (120) including a transmitter and a receiver, and a memory (130) according to one or a combination of two or more of the embodiments of FIGS. 1 to 10. Of course, the present invention is not limited to the above example, and the UE (100) may include more or fewer components than the components illustrated in FIG. 11. According to the present disclosure, the transceiver (130) may transmit and receive signals with at least one of other network entities or terminals. The signals transmitted and received with at least one of other network entities or terminals may include at least one of control information and data.

[0304] In FIG. 11, the processor (110) can control the overall operation of the UE (100) to perform operations according to one or a combination of two or more of the embodiments of FIGS. 1 to 10 described above. Meanwhile, the processor (110), the transceiver (120), and the memory (130) do not necessarily have to be implemented as separate modules, and of course, they can be implemented in the form of a single chip. The processor (110) and the transceiver (120) can be electrically connected. In addition, the processor (110) can be an Application Processor (AP), a Communication Processor (CP), a circuit, an application-specific circuit, or at least one processor. The transceiver (120) can include a communication interface for transmitting and receiving signals with other network entities via wired / wireless.

[0305] According to the present disclosure, the memory (130) can store data such as a basic program, an application program, and setting information for the operation of the UE (100). In addition, the memory (130) provides the stored data upon request of the processor (110). The memory (130) can be configured as a storage medium or a combination of storage media such as a ROM, a RAM, a hard disk, a CD-ROM, and a DVD. In addition, there can be a plurality of memories (130). In addition, the processor (110) can perform at least one of the above-described embodiments based on a program for performing an operation according to at least one of the above-described embodiments of the present disclosure stored in the memory (130).

[0306] Additionally, the program may be stored in an attachable storage device that is accessible via a communication network such as the Internet, an intranet, a local area network (LAN), a wide local area network (WLAN), a storage area network (SAN), or a combination thereof. Such a storage device may be connected to a device performing an embodiment of the present disclosure via an external port. Additionally, a separate storage device on the communication network may be connected to a device performing an embodiment of the present disclosure.

[0307] FIG. 12 is a block diagram illustrating a satellite device (200) in a communication system according to an embodiment of the present disclosure.

[0308] Referring to FIG. 12, the satellite device (200) may include a processor (210) for controlling the overall operation of the satellite device (200), a transceiver (220) including a transmitter and a receiver, and a memory (230) according to one or a combination of two or more of the embodiments of FIGS. 1 to 10. Of course, the present invention is not limited to the above example, and the satellite device (200) may include more or fewer components than the components illustrated in FIG. 12. According to the present disclosure, the transceiver (230) may transmit and receive signals with at least one of other network entities or terminals. The signals transmitted and received with at least one of other network entities or terminals may include at least one of control information and data.

[0309] In FIG. 12, the processor (210) may control the overall operation of the satellite device (200) to perform operations according to one or a combination of two or more of the embodiments of FIGS. 1 to 10 described above. Meanwhile, the processor (210), the transceiver (220), and the memory (230) do not necessarily have to be implemented as separate modules, and may of course be implemented in the form of a single chip. The processor (210) and the transceiver (220) may be electrically connected. In addition, the processor (210) may be an Application Processor (AP), a Communication Processor (CP), a circuit, an application-specific circuit, or at least one processor. The transceiver (220) may include a communication interface for transmitting and receiving signals with other network entities via wired / wireless.

[0310] According to the present disclosure, the memory (230) can store data such as a basic program, an application program, and setting information for the operation of the satellite device (200). In addition, the memory (230) provides the stored data according to a request of the processor (210). The memory (230) can be configured as a storage medium or a combination of storage media such as a ROM, a RAM, a hard disk, a CD-ROM, and a DVD. In addition, there can be a plurality of memories (230). In addition, the processor (210) can perform at least one of the above-described embodiments based on a program for performing an operation according to at least one of the above-described embodiments of the present disclosure stored in the memory (230).

[0311] Additionally, the program may be stored in an attachable storage device that is accessible via a communication network such as the Internet, an intranet, a local area network (LAN), a wide local area network (WLAN), a storage area network (SAN), or a combination thereof. Such a storage device may be connected to a device performing an embodiment of the present disclosure via an external port. Additionally, a separate storage device on the communication network may be connected to a device performing an embodiment of the present disclosure.

[0312] FIG. 13 is a block diagram illustrating a GN device (300) in a communication system according to an embodiment of the present disclosure.

[0313] Referring to FIG. 13, the GN device (300) may include a processor (310) that controls the overall operation of the GN device (300), a transceiver (320) including a transmitter and a receiver, and a memory (330) according to one or a combination of two or more of the embodiments of FIGS. 1 to 10. Of course, the present invention is not limited to the above example, and the GN device (300) may include more or fewer components than the components illustrated in FIG. 13. According to the present disclosure, the transceiver (330) may transmit and receive signals with at least one of other network entities or terminals. The signals transmitted and received with at least one of other network entities or terminals may include at least one of control information and data.

[0314] In FIG. 13, the processor (310) can control the overall operation of the GN device (300) to perform operations according to one or a combination of two or more of the embodiments of FIGS. 1 to 10 described above. Meanwhile, the processor (310), the transceiver (320), and the memory (330) do not necessarily have to be implemented as separate modules, and of course, they can be implemented in the form of a single chip. The processor (310) and the transceiver (320) can be electrically connected. In addition, the processor (310) can be an Application Processor (AP), a Communication Processor (CP), a circuit, an application-specific circuit, or at least one processor. The transceiver (320) can include a communication interface for transmitting and receiving signals with other network entities via wired / wireless.

[0315] According to the present disclosure, the memory (330) can store data such as a basic program, an application program, and setting information for the operation of the GN device (300). In addition, the memory (330) provides the stored data upon request of the processor (310). The memory (330) can be configured as a storage medium or a combination of storage media such as a ROM, a RAM, a hard disk, a CD-ROM, and a DVD. In addition, there can be a plurality of memories (330). In addition, the processor (310) can perform at least one of the above-described embodiments based on a program for performing an operation according to at least one of the above-described embodiments of the present disclosure stored in the memory (330).

[0316] Additionally, the program may be stored in an attachable storage device that is accessible via a communication network such as the Internet, an intranet, a local area network (LAN), a wide local area network (WLAN), a storage area network (SAN), or a combination thereof. Such a storage device may be connected to a device performing an embodiment of the present disclosure via an external port. Additionally, a separate storage device on the communication network may be connected to a device performing an embodiment of the present disclosure.

[0317] It should be noted that the configuration diagrams, exemplary diagrams of control / data signal transmission / reception methods, and exemplary diagrams of operating procedures illustrated in FIGS. 1 to 13 are not intended to limit the scope of the embodiments of the present disclosure. That is, not all components, entities, or operational steps described in FIGS. 1 to 13 should be construed as essential components for the implementation of the disclosure, and the disclosure may be implemented without detriment to the essence of the disclosure even if only some components are included.

[0318] The operations of the embodiments described above can be realized by providing a memory device storing the corresponding program code in any component within the device. That is, the control unit within the device can execute the operations described above by reading and executing the program code stored in the memory device through a processor or a CPU (Central Processing Unit).

[0319] The various components and modules of the entity or terminal device described in the present disclosure may be operated using hardware circuits, such as logic circuits based on complementary metal oxide semiconductors, firmware, software, and / or hardware and firmware and / or software embedded in a machine-readable medium. For example, various electrical structures and methods may be implemented using electrical circuits such as transistors, logic gates, and application-specific semiconductors.

[0320] The methods according to the embodiments described in the claims or specification of the present disclosure may be implemented in the form of hardware, software, or a combination of hardware and software.

[0321] When implemented in software, a computer-readable storage medium storing one or more programs (software modules) may be provided. The one or more programs stored in the computer-readable storage medium are configured for execution by one or more processors within an electronic device. The one or more programs include instructions that cause the electronic device to execute methods according to embodiments described in the claims or specification of the present disclosure.

[0322] These programs (software modules, software) may be stored in random access memory, non-volatile memory including flash memory, read only memory (ROM), electrically erasable programmable read only memory (EEPROM), magnetic disc storage devices, compact disc-ROMs (CD-ROMs), digital versatile discs (DVDs) or other forms of optical storage devices, magnetic cassettes, or may be stored in memories formed by a combination of some or all of these. In addition, each configuration memory may include multiple copies.

[0323] Additionally, the program may be stored on an attachable storage device that is accessible via a communication network, such as the Internet, an intranet, a local area network (LAN), a wide area network (WAN), a storage area network (SAN), or a combination thereof. Such a storage device may be connected to a device implementing an embodiment of the present disclosure via an external port. Additionally, a separate storage device on the communication network may be connected to a device implementing an embodiment of the present disclosure.

[0324] In the specific embodiments of the present disclosure described above, components included in the disclosure are expressed singularly or plurally, depending on the specific embodiment presented. However, the singular or plural expressions are selected to suit the presented situation for convenience of explanation, and the present disclosure is not limited to singular or plural components. Components expressed in plural may be composed of singular elements, or components expressed in singular may be composed of plural elements.

[0325] While the detailed description of this disclosure has described specific embodiments, it should be understood that various modifications are possible without departing from the scope of this disclosure. Therefore, the scope of this disclosure should not be limited to the described embodiments, but should be defined not only by the scope of the claims described below, but also by equivalents thereof.

Claims

1. In a method of operating a UE (user equipment) (100) in a communication system, A step of transmitting a first attach request message to a satellite device (200) via a service link; A step of receiving retry information (retry info) indicating at least one of a reconnection time, a reconnection method, or a reconnection target from the satellite device (200) through the service link; and An operating method comprising the step of transmitting a second connection request message to the satellite device (200) based on the retry information.

2. In paragraph 1, The first connection request message is transmitted in response to the first S&F indication received from the satellite device (200), The above first S&F indicator is a parameter indicating that the satellite device (200) supports a store and transmit mode, and the method of operation.

3. In paragraph 1, The method of operation is such that the first connection request message is transmitted in response to a random value (SAT.RN) generated by the satellite device (200) received from the satellite device (200).

4. In paragraph 1, A method of operation, wherein the first connection request message includes a second S&F indicator, which is a parameter indicating that the UE (100) supports a store and forward mode.

5. In paragraph 1, The method of operation, wherein the first connection request message includes an identifier (UE.ID) of the UE (100) and a signature (UE.Sig) generated by the UE (100).

6. In paragraph 1, The method of operation, wherein the first connection request message includes a random value (UE.RN) generated by the UE (100) based on a random value (SAT.RN) received from the satellite device (200).

7. In paragraph 1, The method of operation, wherein the retry information includes an identifier (SAT.ID) of the satellite device (200) and a signature (SAT.Sig) generated by the satellite device (200).

8. In paragraph 7, An operating method in which a signature (SAT.Sig) generated by the satellite device (200) is generated based on a random value (UE.RN) generated by the UE (100).

9. In paragraph 7, A step of verifying the validity of the signature (SAT.Sig) generated by the satellite device (200); and An operating method comprising a step of completing authentication for the satellite device (200) when the above validity is verified.

10. In paragraph 1, The method of operation, wherein the second connection request message includes an identifier (UE.ID) of the UE (100) and a signature (UE.Sig) generated by the UE (100).

11. In the method of operating a satellite device (200) in a communication system, A step of receiving a first attach request message from a UE (user equipment) (100) through a service link; A step of transmitting retry information (retry info) indicating at least one of a reconnection time, a reconnection method, or a reconnection target to the UE (100) through the service link; and An operating method comprising the step of receiving a second connection request message from the UE (100) in response to the retry information.

12. In paragraph 11, The first connection request message is transmitted in response to the first S&F indication transmitted from the satellite device (200) to the UE (100), The above first S&F indicator is a parameter indicating that the satellite device (200) supports a store and transmit mode, and the method of operation.

13. In paragraph 11, The method of operation is such that the first connection request message is transmitted in response to a random value (SAT.RN) generated by the satellite device (200) transmitted from the satellite device (200) to the UE (100).

14. In paragraph 11, A method of operation, wherein the first connection request message includes a second S&F indicator, which is a parameter indicating that the UE (100) supports a store and forward mode.

15. In paragraph 11, The method of operation, wherein the first connection request message includes an identifier (UE.ID) of the UE (100) and a signature (UE.Sig) generated by the UE (100).

Images