Patent Application
20240155533
lin
Examples of embodiments described herein relate to apparatuses, methods, systems, computer programs, computer program products and (non-transitory) computer-readable media usable for controlling a registration of a user equipment having an anonymized subscriber information to a first communication network via a second communication network being different to the first communication network. For instance, some examples of embodiments relate to apparatuses, methods, systems, computer programs, computer program products and (non-transitory) computer-readable media usable for conducting a registration procedure of a user equipment to a first communication network, such as a 3GPP based network, via a second communication network, such as a trusted non-3GPP network wherein the user equipment uses an anonymized subscriber information, such as an anonymous subscription concealed identifier (SUCI), in the initial registration.
The following description of background may include insights, discoveries, understandings or disclosures, or associations, together with disclosures that are not already known, but rather provided herein by the disclosure as one or more examples of embodiments. Some of examples of embodiments may be specifically pointed out below, whereas other of such contributions will be apparent from the related context.
The following meanings for the abbreviations used herein apply:
According to an example of an embodiment, there is provided, for example, an apparatus for a network node acting as a gateway entity of a second communication network providing access to a first communication network being different to the second communication network, the apparatus comprising at least one processor, and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus at least to receive a registration request of a user equipment for a registration to the first communication network via the second communication network, wherein the registration request comprises an anonymized subscriber identification element, to obtain a temporary identification for the user equipment, and to forward the temporary identification for the user equipment to the user equipment.
Furthermore, according to an example of an embodiment, there is provided, for example, a method for a network node acting as a gateway entity of a second communication network providing access to a first communication network being different to the second communication network, the method comprising receiving a registration request of a user equipment for a registration to the first communication network via the second communication network, wherein the registration request comprises an anonymized subscriber identification element, obtaining a temporary identification for the user equipment, and forwarding the temporary identification for the user equipment to the user equipment.
According to further refinements, these examples may include one or more of the following features:
According to an example of an embodiment, there is provided, for example, an apparatus for a network node, the apparatus comprising at least one processor, and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus at least to receive, from a gateway entity of a second communication network providing access to the first communication network, the second communication network being different to the first communication network, a registration request of a user equipment for a registration to the first communication network via the second communication network, wherein the registration request comprises an anonymized subscriber identification element, to generate a temporary identification for the user equipment, and to forward the temporary identification for the user equipment to the gateway entity of the second communication network.
Furthermore, according to an example of an embodiment, there is provided, for example, a method for a network node of a first communication network, the method comprising receiving, from a gateway entity of a second communication network providing access to the first communication network, the second communication network being different to the first communication network, a registration request of a user equipment for a registration to the first communication network via the second communication network, wherein the registration request comprises an anonymized subscriber identification element, generating a temporary identification for the user equipment, and forwarding the temporary identification for the user equipment to the gateway entity of the second communication network.
According to further refinements, these examples may include one or more of the following features:
According to an example of an embodiment, there is provided, for example, an apparatus for a user equipment connecting to a first communication network via a second communication network being different to the first communication network, the apparatus comprising at least one processor, and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus at least to receive, in a registration procedure to the first communication network via the second communication network, wherein an anonymized subscriber identification element is used for the registration request, a temporary identification for the user equipment, and to use the temporary identification for the user equipment in a key exchange procedure with a gateway entity of the second communication network as an identification of the user equipment.
Furthermore, according to an example of an embodiment, there is provided, for example, a method for a user equipment connecting to a first communication network via a second communication network being different to the first communication network, the method comprising receiving, in a registration procedure to the first communication network via the second communication network, wherein an anonymized subscriber identification element is used for the registration request, a temporary identification for the user equipment, and using the temporary identification for the user equipment in a key exchange procedure with a gateway entity of the second communication network as an identification of the user equipment.
According to further refinements, these examples may include one or more of the following features:
According to an example of an embodiment, there is provided, for example, an apparatus for a network node acting as a second access point of a second communication network providing access to the second communication network, the apparatus comprising at least one processor, and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus at least: to conduct an access point mobility procedure for changing connection of a user equipment connected to a first communication network being different to the second communication network via a first access point of the second communication network, wherein the second access point represents a target access point in the access point mobility procedure, to receive a temporary identification for the user equipment having been used with the first access point as an identification of the user equipment, and to forward the temporary identification for the user equipment to a gateway entity of the second communication network as the identification of the user equipment.
Furthermore, according to an example of an embodiment, there is provided, for example, a method for a network node acting as a second access point of a second communication network providing access to the second communication network, the method comprising conducting an access point mobility procedure for changing connection of a user equipment connected to a first communication network being different to the second communication network via a first access point of the second communication network, wherein the second access point represents a target access point in the access point mobility procedure, receiving a temporary identification for the user equipment having been used with the first access point as an identification of the user equipment, and forwarding the temporary identification for the user equipment to a gateway entity of the second communication network as the identification of the user equipment.
According to further refinements, these examples may include one or more of the following features:
According to an example of an embodiment, there is provided, for example, a system comprising: at least one processor and at least one memory storing instructions that, when executed by the at least one processor, cause the system at least: in a network node acting as a gateway entity of a second communication network providing access to a first communication network being different to the second communication network, to receive a registration request of a user equipment for a registration to the first communication network via the second communication network, wherein the registration request comprises an anonymized subscriber identification element, to obtain a temporary identification for the user equipment, and to forward the temporary identification for the user equipment to the user equipment, in a network node of the first communication network, to receive, from the gateway entity of the second communication network providing access to the first communication network, a registration request of a user equipment for a registration to the first communication network via the second communication network, wherein the registration request comprises an anonymized subscriber identification element, to generate a temporary identification for the user equipment, and to forward the temporary identification for the user equipment to the gateway entity of the second communication network; in a user equipment connecting to the first communication network via the second communication network, to receive, in a registration procedure to the first communication network via the second communication network, wherein an anonymized subscriber identification element is used for the registration request, a temporary identification for the user equipment, and to use the temporary identification for the user equipment in a key exchange procedure with a gateway entity of the second communication network as an identification of the user equipment; and in a network node acting as a second access point of the second communication network providing access to the second communication network, to conduct an access point mobility procedure for changing connection of a user equipment connected to a first communication network being different to the second communication network via a first access point of the second communication network, wherein the second access point represents a target access point in the access point mobility procedure, to receive a temporary identification for the user equipment having been used with the first access point as an identification of the user equipment, and to forward the temporary identification for the user equipment to a gateway entity of the second communication network as the identification of the user equipment.
According to an example of an embodiment, there is provided, for example, a system comprising: in a network node acting as a gateway entity of a second communication network providing access to a first communication network being different to the second communication network, means configured to receive a registration request of a user equipment for a registration to the first communication network via the second communication network, wherein the registration request comprises an anonymized subscriber identification element, means configured to obtain a temporary identification for the user equipment, and means configured to forward the temporary identification for the user equipment to the user equipment, in a network node of the first communication network, means configured to receive, from the gateway entity of the second communication network providing access to the first communication network, a registration request of a user equipment for a registration to the first communication network via the second communication network, wherein the registration request comprises an anonymized subscriber identification element, means configured to generate a temporary identification for the user equipment, and means configured to forward the temporary identification for the user equipment to the gateway entity of the second communication network; in a user equipment connecting to the first communication network via the second communication network means configured to receive, in a registration procedure to the first communication network via the second communication network, wherein an anonymized subscriber identification element is used for the registration request, a temporary identification for the user equipment, and means configured to use the temporary identification for the user equipment in a key exchange procedure with a gateway entity of the second communication network as an identification of the user equipment; and in a network node acting as a second access point of the second communication network providing access to the second communication network, means configured to conduct an access point mobility procedure for changing connection of a user equipment connected to a first communication network being different to the second communication network via a first access point of the second communication network, wherein the second access point represents a target access point in the access point mobility procedure, means configured to receive a temporary identification for the user equipment having been used with the first access point as an identification of the user equipment, and means configured to forward the temporary identification for the user equipment to a gateway entity of the second communication network as the identification of the user equipment.
In addition, according to embodiments, there is provided, for example, a computer program product for a computer, including software code portions for performing the steps of the above defined methods, when said product is run on the computer. The computer program product may include a computer-readable medium on which said software code portions are stored. Furthermore, the computer program product may be directly loadable into the internal memory of the computer and/or transmittable via a network by means of: upload; download; and/or push procedures.
In addition, according to embodiments, there is provided, for example, a computer program comprising instructions, which, when executed by an apparatus, cause the apparatus to perform the steps of the above defined methods.
In addition, according to embodiments, there is provided, for example, a computer readable medium comprising instructions, which, when executed by an apparatus, cause the apparatus to perform the steps of the above defined methods.
Some examples of disclosure related to embodiments are described below, by way of example only, with reference to the accompanying drawings, in which:
In the last years, an increasing extension of communication networks, e.g. of wire based communication networks, such as the Integrated Services Digital Network (ISDN), Digital Subscriber Line (DSL), or wireless communication networks, such as the cdma2000 (code division multiple access) system, cellular 3rd generation (3G) like the Universal Mobile Telecommunications System (UMTS), fourth generation (4G) communication networks or enhanced communication networks based e.g. on Long Term Evolution (LTE) or Long Term Evolution-Advanced (LTE-A), fifth generation (5G) communication networks, cellular 2nd generation (2G) communication networks like the Global System for Mobile communications (GSM), the General Packet Radio System (GPRS), the Enhanced Data Rates for Global Evolution (EDGE), or other wireless communication system, such as the Wireless Local Area Network (WLAN), Bluetooth or Worldwide Interoperability for Microwave Access (WiMAX), took place all over the world. Various organizations, such as the European Telecommunications Standards Institute (ETSI), the 3rd Generation Partnership Project (3GPP), Telecoms & Internet converged Services & Protocols for Advanced Networks (TISPAN), the International Telecommunication Union (ITU), 3rd Generation Partnership Project 2 (3GPP2), Internet Engineering Task Force (IETF), the IEEE (Institute of Electrical and Electronics Engineers), the WiMAX Forum and the like are working on standards or specifications for telecommunication network and access environments.
In order to be able to communicate with a communication network, a user equipment (UE) has to register with the corresponding network to get authorized to receive services, to enable mobility tracking and to enable reachability, for example. For this, the UE initiates a registration procedure using, for example, an initial registration to the communication network (e.g. a 5G network), a mobility registration update upon changing to a new Tracking Area (TA) outside the UE's registration area or when the UE is to update its capabilities or protocol parameters that are negotiated in registration procedure with or without changing to a new TA, and the like. Also, other registration scenarios are possible, such as registration update (due to a predefined time period of inactivity), or emergency registration.
It is possible that a communication network enables also registration of a UE via another communication network. For example, in the case of a 5G network, the 5GC supports connectivity of UEs via non-3GPP access networks, e.g., Wireless Local Area Network (WLAN) access networks, wherein untrusted non-3GPP access networks and trusted non-3GPP access networks (TNANs) are applicable. An untrusted non-3GPP access network can be connected to the 5GC via a non-3GPP interworking function (N3IWF), whereas a trusted non-3GPP access network can be connected to the 5GC via a trusted non-3GPP gateway function (TNGF). Both, the N3IWF and the TNGF, interface with the 5GC control plane and user plane functions via N2 and N3 interfaces, respectively.
In the following, different examples of embodiments will be described for illustrating a processing for controlling an access of a user equipment (UE) to a first communication network (e.g. a cellular wireless communication network such as a 3GPP based network) via a second communication network (e.g. a WLAN network based on IEEE 802.11) being different to the first communication network. To this end, as one example of a communication network to which examples of embodiments may be applied, a communication network architecture based on 3GPP standards for a communication network, such as 5G, is used, without restricting the disclosure to such an architecture. It would be apparent to a person skilled in the art that examples of embodiments may also be applied to other kinds of communication networks, e.g. Wi-Fi, worldwide interoperability for microwave access (WiMAX), Bluetooth®, personal communications services (PCS), ZigBee®, wideband code division multiple access (WCDMA), systems using ultra-wideband (UWB) technology, mobile ad-hoc networks (MANETs), wired access, etc. Furthermore, without loss of generality, the description of some examples of embodiments is related to a mobile communication network, but principles of described herein can be extended and applied to any other type of communication network, such as a wired communication networks as well.
The following examples and embodiments are to be understood only as illustrative examples. Although the text herein may refer to “an”, “one”, or “some” example(s) or embodiment(s) in several locations, this does not necessarily mean that each such reference is related to the same example(s) or embodiment(s), or that the feature only applies to a single example or embodiment. Single features of different embodiments may also be combined to provide other embodiments. Furthermore, terms like “comprising” and “including” should be understood as not limiting the described embodiments to consist of only those features that have been mentioned; such examples and embodiments may also comprise features, structures, units, modules etc. that have not been specifically mentioned.
A basic system architecture of a (tele)communication network, including a mobile communication system, where some examples of embodiments are applicable may include an architecture of one or more communication networks including wireless or wired access network subsystem(s) and core network(s). Such an architecture may include network nodes comprising one or more communication network control elements or functions, access network elements, radio access network elements, access service network gateways or base transceiver stations, such as a base station (BS), an access point (AP), a NodeB (NB), an eNB or a gNB, a distributed or a centralized unit, which controls a respective coverage area or cell(s) and with which one or more communication stations such as UEs, e.g. user devices or terminal devices, or another device having a similar function, such as a modem chipset, a chip, a module etc., which can also be part of a station, an element, a function or an application capable of conducting a communication, such as a UE, an element or function usable in a machine-to-machine communication architecture, or attached as a separate element to such an element, function or application capable of conducting a communication, or the like, are capable to communicate via one or more channels via one or more communication beams for transmitting several types of data in a plurality of access domains. Furthermore, core network elements or network functions, such as gateway network elements/functions, mobility management entities, a mobile switching center, servers, databases, and the like may be included.
The general functions and interconnections of the described elements and functions, which also depend on the actual network type, are understood by those skilled in the art and described in corresponding specifications, so that a detailed description thereof is omitted herein. However, it is to be noted that several additional network elements and signaling links may be employed for a communication to or from an element, function or application, like a communication endpoint, a communication network control element, such as a server, a gateway, a radio network controller, and other elements of the same or other communication networks besides those described in detail herein below.
A communication network architecture as being considered in examples of embodiments may also be able to communicate with other networks, such as a public switched telephone network or the Internet, as well as with individual devices or groups of devices being not considered as a part of a network, such as monitoring devices like cameras, sensors, arrays of sensors, and the like. The communication network may also be able to support the usage of cloud services for virtual network elements or functions thereof, wherein it is to be noted that the virtual network part of the telecommunication network can also be provided by non-cloud resources, e.g. an internal network or the like. It should be appreciated that network elements of an access system, of a core network etc., and/or respective functionalities may be implemented by using any node, host, server, access node or entity etc. being suitable for such a usage. Generally, a network function (NF) can be implemented either as a network element on a dedicated hardware, as a software instance running on a dedicated hardware, or as a virtualized network function (VNF) instantiated on an appropriate platform, e.g., a cloud infrastructure.
Furthermore, a network element or network functions, such as a UE, an AMF, an AUSF, an access point, a gateway function or other network elements or network functions, as described herein, and any other elements, functions or applications may be implemented by software, e.g. by a computer program product for a computer, and/or by hardware. For executing their respective processing, correspondingly used devices, nodes, functions or network elements may include several means, modules, units, components, etc. (not shown) which are utilized for control, processing and/or communication/signaling functionality. Such means, modules, units and components may include, for example, one or more processors or processor units including one or more processing portions for executing instructions and/or programs and/or for processing data, storage or memory units or means for storing instructions, programs and/or data, for serving as a work area of the processor or processing portion and the like (e.g. ROM, RAM, EEPROM, and the like), input or interface means for inputting data and instructions by software (e.g. floppy disc, CD-ROM, EEPROM, and the like), a user interface for providing monitor and manipulation possibilities to a user (e.g. a screen, a keyboard and the like), other interface or means for establishing links and/or connections under the control of the processor unit or portion (e.g. wired and wireless interface means, radio interface means including e.g. an antenna unit or the like, means for forming a radio communication part etc.) and the like, wherein respective means forming an interface, such as a radio communication part, can be also located on a remote site (e.g. a radio head or a radio station etc.). It is to be noted herein that processing portions should not be only considered to represent physical portions of one or more processors, but may also be considered as a logical division of the referred processing tasks performed by one or more processors.
It should be appreciated that according to some examples, a so-called “liquid” or flexible network concept may be employed where the operations and functionalities of a network element, a network function, or of another entity of the network, may be performed in different entities or functions, such as in a node, host or server, in a flexible manner. For instance, a “division of labor” between involved network elements, functions or entities may vary case by case.
As used in this application, the term “processor” or “circuitry” may refer to one or more or all of the
following:
5GS is developed, amongst others, for providing enhancements to support various communication applications, such as industrial use cases. One aim is to enable the use of 3GPP 5G technology in non-public networks, also referred to as private networks, for dedicated use cases which offers improvements to flexibility, versatility, usability and efficiency.
Non-public networks (NPNs) are intended for the use by a private service provider such as an enterprise. These networks are not open for use by the general public. For example, one type of NPN is a so-called standalone non-public network (SNPN). A UE is able to access an SNPN by using, for example, either IMSI or NSI as a subscription permanent identifier (SUPI).
In order to enable a mutual authentication between the UE and the network, authentication and key agreement procedures are conducted. Keying material is provided to the serving network and is used between the UE and the serving network to create dedicated keys for subsequent security procedures. In 5GS, access security is managed in a unified manner, for which a AUSF (authentication server function) is used in the home network. As authentication methods, AKA and EAP are employed, for example. Privacy of the UE identity is preserved by registering to the serving network with a subscription concealed identifier (SUCI), which is a one-time useable identifier created from the subscription permanent identifier (SUPI).
As indicated above, 5GS provides enhanced user privacy by protecting the subscription permanent identifier (SUPI) over the air using a privacy preserving identifier that contains the concealed SUPI, i.e. the SUCI.
Regarding SNPN privacy considerations, for example, it is possible that only a part of the network access identifier (NAI) indicating the realm (i.e. the part identifying the network, but not the subscriber) is included in SUCI. That is, an anonymous identifier is provided.
Due to the anonymous identifier being usable in NPNs, such as SNPS, the following situation may arise when providing a non-3gpp access for a UE in an SNPN. That is, SNPN methods like anonymous SUCI has to be considered in specified registration mechanisms.
Specifically, when the identity of the subscriber is not shared, but just an anonymous identification is presented, it is possible that the anonymous identifier is used by a plurality of devices. Thus, the network does not know the user or subscriber. A gateway entity, such as a TNGF of a trusted non-3GPP network, does not know the identity of the USER. Therefore, a situation may arise where the TNGF and the UE assume different identifications for the UE, i.e. the UE uses another identification in a later processing phase of the registration than that known to the TNGF, so that the TNGF cannot link the identification received from the UE in this later phase to any known/unique identifier as it is only aware of the anonymous identifier. Therefore, identification and corresponding usage of a correct key for the mutual authentication may not be possible. This is in particular an issue in case the UE is registering for the first time or does not have, due to any reason, a valid identifier known to the network, such as a GUTI, while an anonymous SUCI is used by the UE.
Another consideration to be made is when a mobility scenario is considered. For example, when the UE switches connection from a source access point of the non-3GPP network, such as a source TNAP, to another access point representing a target TNAP of the same TNGF, once the UE changes the TNAP (and hence the SSID) and connects to another TNAP (the target TNAP), then the TNGF may not be able to identify and correlate the session of the UE in case the UE uses anonymous SUCI. In this case, namely, the UE connects to the new TNAP and provides the anonymous SUCI to the target TNAP, which the target TNAP provides to the TNGF. However, the TNGF is not able to correlate the session already stored for the UE via the former (source) TNAP.
Therefore, according to examples of embodiments, it is desired to provide an improved mechanism for controlling an access to a first communication network via a second communication network being different to the first communication network. For example, in order to enable an appropriate access for a UE using an anonymized subscription identification, such as an anonymous SUCI, the network, for example the TNGF, allocates a temporary identifier for a session, which is comparable to TMSI or GUTI. This temporary identifier, which is referred to hereinafter also a temporary identification for the UE, is then shared with the UE in a suitable signaling. The UE, on the other hand, provides the temporary identifier, i.e. the temporary identification for the UE, in another signaling with the network, in particular the TNGF, e.g. when a key exchange is conducted. The TGNF can then use the temporary identification for the UE to identify required keys so that the mutual authentication can be completed.
The trusted non-3GPP WLAN is represented by the TNAN 20. In the TNAN 20, one or more access points, e.g. TNAP 23-1, 23-2 etc. (only TNAP 23-1 is shown), are provided as an access of the TNAN 20 for connecting to the UE 10. Furthermore, a gateway entity between the first and second communication networks is provided by TNGF 25 which is an interface to the 5GC.
It is to be noted that TNAP 23-1 and TNGF 25 are defined in examples of embodiments as forming the TNAN 20. In practice, when, for example, a wireline operator deploys a TNAP in a residential gateway and the UE is trying to access to a mobile operator (e.g. an SNPN, a PLMN, which is assumed in examples of embodiments as the 5GC), the TNGF may be deployed by the 5GC operator. That is, TNAP may be vendor specific, while the TNGF provides access to the 5GC and is thus to be defined according to 3GPP specifications. Nevertheless, also for clarity reasons, the TNGF 25 is referred to as a communication network element of the second communication network (e.g., the TNAN) providing access to the first communication network (e.g., the 5GC).
With regard to the 5GC, only components and parts are depicted in
Specifically, the TNAN 20, via the TNGF 25, is connected to an AMF 30 representing a network node, such as a communication network control element or function of the 5GC. The AMF 30 is a control plane function within 5GC and performs, for example, registration management (e.g. allows a UE to register/deregister with the 5G system wherein the AMF interacts with other network functions during the registration procedure), connection management (establishing and releasing control plane signaling connection between the UE and the AMF, NAS messages to be exchanged between the UE and the AMF, NAS signaling procedures for registration, authentication, service request and identity request), reachability management (by storing location information as part of the UE context, which includes the registration area, and mobility management (to maintain knowledge of UE's location within the network, for which the UE makes periodic registration updates after initial registration and updates due to mobility, e.g. if it moves out of a Tracking Area with which it is currently registered).
The AMF 30 is connected to an AUSF (authentication server function) 40 which supports authentication for 3GPP and non-3GPP access. The AUSF 40 provides AUSF service to the AMF 30 and serves as an EAP server for non-3GPP access authentication, for example.
As indicated above, according to examples of embodiments, for controlling an access to the first communication network via the second communication network and for enabling an appropriate access for the UE which is using an anonymized subscription identification, such as an anonymous SUCI, a temporary identifier for a session is generated and shared.
Specifically, in the example of
As shown in
On the other hand, as shown in
According to further examples, the temporary identification for the UE, TEMP_UE_IDTNGF, generated by TNGF may be a totally random number or any unique number generated by the TNGF. That is, the temporary identification for the UE, TEMP_UE_IDTNGF, generated by TNGF (or the AMF, as indicated above) may be another number or value allowing to provide a unique temporary identification for the UE, TEMP_UE_IDTNGF.
In the following, examples of embodiments are described in which a processing for a registration procedure of a UE to a first communication network, such as a 3GPP based network, via a second communication network, such as a trusted non-3GPP network, is described by using signaling diagrams illustrating the processing conducted for obtaining and forwarding the temporary identification for the UE, TEMP_UE_IDTNGF, when the user equipment uses an anonymized subscriber information, such as an anonymous SUCI, in the initial registration. It is to be noted that the following examples are only for explanation, while the principles of examples of embodiments are also applicable to other procedures where a UE is registered as described above while an anonymized subscriber information, such as an anonymous SUCI, is used.
That is, in the example of
Initially, the UE selects a PLMN and a TNAN for connecting to this PLMN by using a trusted non-3GPP access network selection procedure. During this procedure, the UE discovers the PLMNs with which the TNAN supports trusted connectivity (e.g. “5G connectivity”).
In S301, a layer-2 (L2) connection is established between the UE and the TNAP 23-1. This corresponds e.g. to an 802.11 association, or a PPP LCP negotiation.
In S302 and S303, an EAP authentication procedure is initiated. EAP messages are encapsulated into L2 packets, for example. The UE provides an NAI that triggers the TNAP to send in S304 an AAA request to the TNGF. It is to be noted that between the TNAP and the TNGF the EAP packets are encapsulated into AAA messages.
In the following, an EAP-5G procedure is executed.
In S305 and S306, the TNGF responds with an AUTH response message which includes an EAP-Request/5G-Start packet. The EAP-Request/5G-Start packet informs the UE to initiate an EAP-5G session, i.e. to start sending NAS messages encapsulated within EAP-5G packets.
In S307 and S308, the UE validates the TNGF certificate and confirms that the TNGF identity matches the selected TNGF. The UE sends an EAP-Response/5G-NAS packet that contains a registration request message containing UE security capabilities and the anonymous SUCI (i.e. the anonymized subscription identification) as the UE ID. It is to be noted that in case the UE would have been registered already with the 5GC over 3GPP access, the UE sends the 5G-GUTI instead of anonymous SUCI.
That is, as indicated above, the TNGF is not aware of the identity of the subscriber, but receives only an anonymous identifier which can be used by a plurality of devices, so that the TNGF does not know the identity of the user.
In S309, the TGNF selects an AMF. Then, in S310, the TGNF forwards the registration request received from the UE to the AMF with an N2 message.
In S311, S312 and S313, an identity request/response procedure is conducted.
In S314 to S316, an authentication process is conducted. The AMF sends a key request to the AUSF in S314. The AUSF may initiate an authentication procedure between the AMF and the UE, wherein the authentication packets are encapsulated within NAS authentication messages and the NAS authentication messages are carried in N2 signaling between the AMF and the TNGF, and then are encapsulated within EAP-5G/5G-NAS packets between the TGNF and the UE.
In the final authentication message, the AUSF sends an anchor key which is used by the AMF to derive NAS security keys. Furthermore, the AUSF includes an EAP-Success indication. The UE also derives the required keys in S317.
Now, following to
After the authentication procedure, in S401, the AMF sends a security mode command (SMC) to the UE in order to activate NAS security. This message is sent to the TGNF within an N2 message. The AMF encapsulates the EAP-Success received from the AUSF within the SMC message.
According to examples of embodiments, since the UE has provided, as the UE ID in S307 an anonymous identifier, the TGNF generates a temporary UE identifier (TEMP_UE_IDTNGF), for example in accordance with the measures described in connection with
Then, in S402 and S403 (via the TNAP), the TNGF forwards the NAS SMC to the UE within an EAP-Request/5G-NAS packet. In this connection, the temporary UE identifier (TEMP_UE_IDTNGF) is also forwarded to the UE.
In S404, the UE completes the authentication and creates or activates an NAS security context based on the information in the NAS SMC. The UE responds to the NAS SMC received from the AMF and encapsulates the NAS SMC Complete in an EAP-5G response sent to the AMF in S405 and S406.
A KTNGF is created in the UE and in the AMF after the successful authentication. The KTNGF is transferred from the AMF to the TNGF in S407 within an N2 initial context setup request.
The TNGF generates a KTNAP transfers it to TNAP in S408 within an AAA message.
Furthermore, after receiving the TNGF key from AMF in S407, the TNGF sends in S408 to the UE an EAP-Request/5G-Notification packet containing the “TNGF Contact Info”, which includes the IP address of TNGF (forwarded in S409 to the UE).
Furthermore, after receiving an EAP-Response/5G-Notification packet from the UE (in S410 and S411), the TNGF sends in S412 the EAP-Success packet being forwarded to the UE in S413.
In S414, a security establishment procedure is executed wherein a common TNAP key is used by the UE and TNAP to derive security keys according to the applied non-3GPP technology and to establish a security association to protect all subsequent traffic. All messages between UE and TNAP are encrypted and integrity protected from this step onwards.
In S415, the UE receives IP configuration information from the TNAN.
In S416, the UE initiates an IKE_INIT exchange with the TNGF. The UE has received the IP address of TNGF during the EAP-5G signaling in S402, S403. Thus. the UE initiates an IKE_AUTH exchange in S418, wherein it includes in S417, when the UE has received the temporary identification for the UE, TEMP_UE_IDTNGF, this temporary identification for the UE, TEMP_UE_IDTNGF, as the UE ID (as indicated above, in case a 5G-GUTI is present, this would be used as in the UE Id provided in step S307).
That is, according to examples of embodiments, when an anonymized subscriber identification is used by the UE, such as an anonymous SUCI, and the temporary identification for the UE has been provided by the network, the UE does not use in S417 and S418 the former (anonymous) user ID as in S307. Thus, the TNGF can link the now used user ID and can use it to identify the correct key for the mutual authentication.
After S418, an IPsec security association is established between the UE and the TNGF and is used to transfer all subsequent NAS messages.
In S419, after the connection is successfully established, the TNGF responds to the AMF with an N2 Initial Context Setup Response message.
Then, in S420 and S421, NAS registration accept message is sent by the AMF and is forwarded to the UE via the established connection.
In S422, a PDU session establishment initiated by the UE is conducted. Then, user plane data for the established PDU session can be transported between the UE and TNGF.
Next, with reference to
It is to be noted that the following description concentrates on the differences between the processing described in
As described above in connection with S307 and S308 of
Now, with reference to
It is to be noted that the generation of the temporary UE identifier (TEMP_UE_IDTNGF), is triggered by a request from the TNGF requesting the AMF to generate temporary UE identifier (TEMP_UE_IDTNGF). In this case, the generation of the temporary UE identifier (TEMP_UE_IDTNGF) is conducted only when required, depending on the information received from the UE. Otherwise, the AMF generates the temporary UE identifier (TEMP_UE_IDTNGF) when a registration request with an anonymized subscription identification is received, for example.
The AMF provides the generated temporary UE identifier (TEMP_UE_IDTNGF) in S502, in which the AMF sends a security mode command (SMC) to the UE in order to activate NAS security. That is, the AMF provides the generated temporary UE identifier (TEMP_UE_IDTNGF), for example, as part of NAS payload towards the UE. As an example for a secured signaling, the SMC request is used, which is integrity protected.
Then, in S503 and S504 (via the TNAP), the TNGF forwards the NAS SMC to the UE within an EAP-Request/5G-NAS packet. In this connection, the temporary UE identifier (TEMP_UE_IDTNGF) received from the AMF is also forwarded to the UE.
S505 to S507 correspond basically to S404 to S406 of
In S508, the AMF transfers to the TNGF the KTNGF within an N2 initial context setup request. In this message, the AMF includes also the generated temporary UE identifier (TEMP_UE_IDTNGF).
After receiving the TNGF key from AMF in S508, the TNGF sends in S509 to the UE (via S510) an EAP-Request/5G-Notification packet containing the “TNGF Contact Info”, which includes the IP address of TNGF and optionally the temporary UE identifier (TEMP_UE_IDTNGF).
The further processing according to S511 to S519 corresponds to the processing according to S410 to S418 in
Thus, the TNGF is able to identify and correlate the session of the UE already stored for the UE via the former (source) TNAP #1.
That is, in TNAP mobility cases (mobility between source TNAP #1 to target TNAP #2) within a TNGF, the temporary UE identifier (TEMP_UE_IDTNGF) assigned by TNGF or AMF is used during initial steps for TNGF to identify the UE. For this, the TNGF stores the temporary UE identifier (TEMP_UE_IDTNGF) assigned to a UE in UE context data in the TNGF for further communications.
Referring to
In S602, TNAP mobility is started so that the UE connects from the TNAP #1 representing a source TNAP to a target TNAP (TNAP #2). In this procedure, the UE provides to the TNAP #2 the temporary UE identifier (TEMP_UE_IDTNGF) being assigned for the session via TNAP #1.
In S603, the target TNAP (i.e. TNAP #2) sends the temporary UE identifier (TEMP_UE_IDTNGF) received from the UE to the TNGF as information related to the TNAP mobility procedure.
In S604, the TNGF uses the received information, i.e. the temporary UE identifier (TEMP_UE_IDTNGF), for correlating the session(s) of the UE between the former (source) TNAP #1 and the present (target) TNAP #2.
In S710, the TNGF receives a registration request of a UE for a registration to the first communication network via the second communication network. The UE uses in the registration request an anonymized subscriber identification element.
In S720, a temporary identification for the UE is obtained, for example the TEMP_UE_IDTNGF described above.
According to examples of embodiments, the temporary identification for the UE is obtained by generating the temporary identification for the UE in the TNGF. For this, at least one of the following is used as a one part of the temporary identification for the UE: an identification element of a network node, such as the communication network control element or communication network control function acting as the gateway entity of the second communication network (for example a global TNGF ID, which includes a PLMN identity and a TNGF ID, for example), a contact information of a network node, such as the communication network control element or communication network control function acting as the gateway entity of the second communication network (for example, an IP address of the TNGF), or a random number. As a second part, which is combined with the first part for generating the temporary identification for the UE, a pre-selected number, or a randomly generated number is used.
According to further examples of embodiments, the TNGF obtains the temporary identification for the UE by receiving a temporary identification for the UE from a network node, such as a communication network control element or communication network control function of the first communication network (e.g. the AMF). The temporary identification for the UE is received, for example, after forwarding the registration request of the UE to a network node, such as the communication network control element or communication network control function of the first communication network (AMF), wherein the registration request contains the anonymized subscriber identification element as the UE ID, for example.
According to further examples of embodiments, the temporary identification for the UE is received in response to a request sent from the TNGF to a network node, such as the communication network control element or communication network control function of the first communication network (e.g. the AMF). The request informs the AMF to provide the TNGF with the temporary identification for the UE.
According to further examples of embodiments, the temporary identification for the UE may also be added to TNGF contact information sent to the UE.
In S730, the temporary identification for the UE is sent to the UE. For example, the temporary identification for the UE is sent to the UE in a secured signaling message, such as a security mode command related message.
According to further examples of embodiments, the TNGF conducts a key exchange procedure with the UE wherein the temporary identification for the UE is used as an identification element of the UE in the corresponding signaling.
Moreover, according to further examples of embodiments, the temporary identification for the UE is stored in UE context information in the TNGF.
Furthermore, in a mobility scenario, according to examples of embodiments, the TNGF receives, from a second access point (i.e. target access point in the mobility procedure) of the second communication network the temporary identification for the UE having been connected to a first access point (i.e. source access point in the mobility procedure) of the second communication network. Then, the TNGF correlates a communication session to the UE via the second access point by using the temporary identification for the UE when receiving a message from the UE including the temporary identification for the UE.
In S810, the AMF receives, from a gateway entity of a second communication network providing access to the first communication network (e.g. the TNGF), a registration request of a UE for a registration to the first communication network via the second communication network. The registration request comprises an anonymized subscriber identification element as the UE ID.
In S820, the AMF generates a temporary identification for the UE.
According to examples of embodiments, the temporary identification for the UE is generated as described in the following. At least one of the following is used as a one part of the temporary identification for the UE: an identification element of a network node, such as the communication network control element or communication network control function acting as the gateway entity of the second communication network (for example a global TNGF ID, which includes a PLMN identity and a TNGF ID, for example), a contact information of a network node, such as the communication network control element or communication network control function acting as the gateway entity of the second communication network (for example, an IP address of the TNGF), or a random number. As a second part, which is combined with the first part for generating the temporary identification for the UE, a pre-selected number, or a randomly generated number is used.
According to examples of embodiments, the AMF receives from the gateway entity a request for providing the temporary identification for the UE when the registration request of the UE is received. The temporary identification for the UE is generated and forwarded in response to the request.
In S830, the AMF forwards the temporary identification for the UE to the gateway entity of the second communication network (e.g. the TNGF). According to examples of embodiments, the temporary identification for the UE is sent to the gateway entity in a secured signaling message, such as a security mode command related message.
In S910, the UE receives, in a registration procedure to the first communication network via the second communication network, wherein an anonymized subscriber identification element is used for the registration request, a temporary identification for the UE.
According to examples of embodiments, the temporary identification for the UE is received in a secured signaling message, such as a security mode command related message.
Furthermore, according to examples of embodiments, the temporary identification for the UE is also received in TNGF contact information.
In S920, the UE uses the temporary identification for the UE in a key exchange procedure with a gateway entity of the second communication network (e.g. the TNGF) as an identification of the UE.
Furthermore, in a mobility scenario, according to examples of embodiments, when the UE conducts an access point mobility procedure for changing connection from a first access point (i.e. source access point in the mobility procedure) to a second access point (i.e. target access point in the mobility procedure) of the second communication network, the UE sends to the second access point (i.e. target access point in the mobility procedure) the temporary identification for the UE having been used with the first access point (i.e. source access point in the mobility procedure) as an identification of the UE.
In S310, when a UE conducts (in S1010) an access point mobility procedure for changing connection from a first access point (i.e. source access point in the mobility procedure) to a second access point (i.e. target access point in the mobility procedure) of the second communication network, the UE sends to the second access point (i.e. target access point in the mobility procedure) the TNAP #2 receives in S1020 a temporary identification for the UE having been used with the first access point (i.e. source access point in the mobility procedure) as an identification of the UE.
Then, in S1030, the TNAP #2 forwards the temporary identification for the UE to a gateway entity of the second communication network (e.g. the TNGF) as the identification of the UE.
The TNGF 25 shown in
The processor or processing function 251 is configured to execute processing related to the above described control procedure. In particular, the processor or processing circuitry or function 251 includes one or more of the following sub-portions. Sub-portion 2511 is a processing portion which is usable as a portion for receiving a registration request. The portion 2511 may be configured to perform processing according to S710 of
The AMF 30 shown in
The processor or processing function 301 is configured to execute processing related to the above described control procedure. In particular, the processor or processing circuitry or function 301 includes one or more of the following sub-portions. Sub-portion 3011 is a processing portion which is usable as a portion for receiving a registration request. The portion 3011 may be configured to perform processing according to S810 of
The UE 10 shown in
The processor or processing function 101 is configured to execute processing related to the above described control procedure. In particular, the processor or processing circuitry or function 101 includes one or more of the following sub-portions. Sub-portion 1011 is a processing portion which is usable as a portion for receiving a temporary identification. The portion 1011 may be configured to perform processing according to S910 of
The TNAP 23 shown in
The processor or processing function 231 is configured to execute processing related to the above described control procedure. In particular, the processor or processing circuitry or function 231 includes one or more of the following sub-portions. Sub-portion 2311 is a processing portion which is usable as a portion for conducting an access point mobility procedure. The portion 2311 may be configured to perform processing according to S1010 of
It is to be noted that examples of embodiments are applicable to various different network configurations. The examples of embodiments shown in the above described figures, which are used as a basis for the examples of embodiments described herein, are only illustrative and are not limiting in any way. That is, additional further existing and proposed new functionalities available in a corresponding operation environment may be used in connection with examples of embodiments based on the principles defined.
According to a further example of embodiments, there is provided, for example, an apparatus for a network node acting as a gateway entity of a second communication network providing access to a first communication network being different to the second communication network, the apparatus comprising means configured to receive a registration request of a user equipment for a registration to the first communication network via the second communication network, wherein the registration request comprises an anonymized subscriber identification element, means configured to obtain a temporary identification for the user equipment, and means configured to forward the temporary identification for the user equipment to the user equipment.
Furthermore, according to some other examples of embodiments, the above defined apparatus may further comprise means for conducting at least one of the processing defined in the above described methods, for example a method according to that described in connection with
According to a further example of embodiments, there is provided, for example, an apparatus for a network node, the apparatus comprising means configured to receive, from a gateway entity of a second communication network providing access to the first communication network, the second communication network being different to the first communication network, a registration request of a user equipment for a registration to the first communication network via the second communication network, wherein the registration request comprises an anonymized subscriber identification element, means configured to generate a temporary identification for the user equipment, and means configured to forward the temporary identification for the user equipment to the gateway entity of the second communication network.
Furthermore, according to some other examples of embodiments, the above defined apparatus may further comprise means for conducting at least one of the processing defined in the above described methods, for example a method according to that described in connection with
According to a further example of embodiments, there is provided, for example, an apparatus for a user equipment connecting to a first communication network via a second communication network being different to the first communication network, the apparatus comprising means configured to receive, in a registration procedure to the first communication network via the second communication network, wherein an anonymized subscriber identification element is used for the registration request, a temporary identification for the user equipment, and means configured to use the temporary identification for the user equipment in a key exchange procedure with a gateway entity of the second communication network as an identification of the user equipment.
Furthermore, according to some other examples of embodiments, the above defined apparatus may further comprise means for conducting at least one of the processing defined in the above described methods, for example a method according to that described in connection with
According to a further example of embodiments, there is provided, for example, an apparatus for a network node acting as a second access point of a second communication network providing access to the second communication network, the apparatus comprising means configured to conduct an access point mobility procedure for changing connection of a user equipment connected to a first communication network being different to the second communication network via a first access point of the second communication network, wherein the second access point represents a target access point in the access point mobility procedure, means configured to receive a temporary identification for the user equipment having been used with the first access point as an identification of the user equipment, and means configured to forward the temporary identification for the user equipment to a gateway entity of the second communication network as the identification of the user equipment.
Furthermore, according to some other examples of embodiments, the above defined apparatus may further comprise means for conducting at least one of the processing defined in the above described methods, for example a method according to that described in connection with
According to a further example of embodiments, there is provided, for example, a non-transitory computer readable medium comprising program instructions for causing an apparatus to perform, when used in a network node acting as a gateway entity of a second communication network providing access to a first communication network being different to the second communication network, a processing comprising receiving a registration request of a user equipment for a registration to the first communication network via the second communication network, wherein the registration request comprises an anonymized subscriber identification element, obtaining a temporary identification for the user equipment, and forwarding the temporary identification for the user equipment to the user equipment.
According to a further example of embodiments, there is provided, for example, a non-transitory computer readable medium comprising program instructions for causing an apparatus to perform, when used in a network node of a first communication network, a processing comprising receiving, from a gateway entity of a second communication network providing access to the first communication network, the second communication network being different to the first communication network, a registration request of a user equipment for a registration to the first communication network via the second communication network, wherein the registration request comprises an anonymized subscriber identification element, generating a temporary identification for the user equipment, and forwarding the temporary identification for the user equipment to the gateway entity of the second communication network.
According to a further example of embodiments, there is provided, for example, a non-transitory computer readable medium comprising program instructions for causing an apparatus to perform, when used in a user equipment connecting to a first communication network via a second communication network being different to the first communication network, a processing comprising receiving, in a registration procedure to the first communication network via the second communication network, wherein an anonymized subscriber identification element is used for the registration request, a temporary identification for the user equipment, and using the temporary identification for the user equipment in a key exchange procedure with a gateway entity of the second communication network as an identification of the user equipment.
According to a further example of embodiments, there is provided, for example, a non-transitory computer readable medium comprising program instructions for causing an apparatus to perform, when used in a network node acting as a second access point of a second communication network providing access to the second communication network, a processing comprising conducting an access point mobility procedure for changing connection of a user equipment connected to a first communication network being different to the second communication network via a first access point of the second communication network, wherein the second access point represents a target access point in the access point mobility procedure, receiving a temporary identification for the user equipment having been used with the first access point as an identification of the user equipment, and forwarding the temporary identification for the user equipment to a gateway entity of the second communication network as the identification of the user equipment.
It should be appreciated that
Although the present disclosure has been described herein before with reference to particular embodiments thereof, the present disclosure is not limited thereto and various modifications can be made thereto.
As used herein, “at least one of the following:” and “at least one of” and similar wording, where the list of two or more elements are joined by “and” or “or”, mean at least any one of the elements, or at least any two or more of the elements, or at least all the elements.
| Number | Date | Country | Kind |
|---|---|---|---|
| 202241063102 | Nov 2022 | IN | national |
