Nec Corporation

Lenovo (singapore) Pte. Ltd.

Motorola Mobility LLC

Sap Se

Nec Europe Ltd.

Lenovo (beijing) Limited

Nec C Orporation

Nec Laboratories Europe Gmbh

Lenovo Limited

Andreas Kunz

Genadi Velev

Toshiyuki Tamura

Anand Raghawa Prasad

Dimitrios Karampatsis

Prateek Basu Mallick

Hironori Ito

Roozbeh Atarius

Ravi Kuchibhotla

Apostolis K Salkintzis

Iskren Ianev

Sheeba Backia Mary Baskaran

Joachim Loehr

Sivabalan Arumugam

Sivakamy Lakshminarayanan

Xiaowei Zhang

Joachim Löhr

Hans-Joerg Kolbe

Alexander Johann Maria Golitschek Edler Von Elbwart

Zhuoyun Zhang

Karthikeyan Ganesan

Joachim Lohr

Gottfried Punz

Naoaki Suzuki

Konstantinos Samdanis

Stefan Schmid

Thilo Ewald

Andreas Maeder

Ishan Vaishnavi

Emmanouil Pateromichelakis

Vincenzo Sciancalepore

Marco Liebsch

Xavier Costa-Perez

Tingfang Tang

Frank Weigel

JaeSeung Song

Thomas Dietz

Bernd Lamparter

Paulo Ferrer Loureiro

Prakash Ponshankaarchinnusamy

Jens Pflueger

Peter Muessig

Clement Selvaraj

Santosh Kumar Addanki

Hena Mau

Ralf Kaltenmaier

Filipe Alexandre-Rodrigues De Moura Leitao

Filipe Leitao

Mohammad Istiak Hossain

Tashiyuki Tamura

Surendran Palanimuthu

Thomas Marz

Jianning Liu

Ravi Kuchbhota

Atarius Roozbeh

Embodiments of the present application are directed to a method and apparatus for providing onboarding and provisioning services. A method according to an embodiment of the present application may include: receiving a registration request for a user equipment (UE), wherein the register request indicates an identity of the UE, an onboarding and provisioning flag, and an onboarding and provisioning function (OPF) identity; selecting an OPF entity at least based on the OPF identity in the case of an onboarding request being supported for the UE; and transmitting the onboarding request at least indicating the identity of the UE to the selected OPF entity.

Method and apparatus for providing onboarding and provisioning services

Apparatuses, methods, and systems are disclosed for determining and enforcing service specific network slice security. One apparatus in a mobile communication network includes processor that performs primary authentication with a mobile communication network and a transceiver that receives a SMC message comprising SSI. The processor applies slice security for control plane and user plane traffic related to a network slice according to a Security Requirement Type indicated in the SSI.

Slice-specific security requirement information

Apparatuses, methods, and systems are disclosed for Digital Identifier-based subscription onboarding. One apparatus includes a memory coupled to a processor, the memory storing instructions executable by the processor to control the apparatus to acquire a Digital Identifier ('DIG-ID') comprising a verifiably secure identity, and to generate a digital signature of the DIG-ID and a timestamp using a private key. The instructions are executable by the processor to control the apparatus to send a first request to a mobile communication network and to receive a response containing an onboarding authentication success indication and a verified DIG-ID, the first request including the DIG-ID, the timestamp and the digital signature. The instructions are executable by the processor to establish a provisioning connection to the mobile communication network and to receive a subscription credential and/or a user subscription profile via the provisioning connection.

Subscription onboarding using a verified digital identity

Apparatuses, methods, and systems are disclosed for indicating a network for a remote unit. One method includes transmitting a first message including a first registration request from a remote unit. The first message includes a discovery indication indicating that the remote unit is attempting to discover a network configured for use by the remote unit. The method includes receiving a second message including a list of networks configured for use by the remote unit. The second message is received in response to transmitting the first message. The method includes transmitting a third message including a second registration request from the remote unit. The second registration request includes an indication of a network selected from the list of networks configured for use by the remote unit.

Indicating a network for a remote unit

Apparatuses, methods, and systems are disclosed for using a pseudonym for access authentication over non-3GPP access. One apparatus includes a processor and a transceiver that communicates with a mobile communication network using a 3GPP access network and a non-3GPP access network. The processor sends a registration message to a first network function in the mobile communication network via the 3GPP access network, the first authentication message comprising a first indicator and a SUCI for the apparatus, wherein the first indicator comprises an indication that the apparatus has the capability for access authentication for non-3GPP access in an EPS. The processor receives a first identity pseudonym for the apparatus in response to the registration message comprising the first indicator and performs access authentication via a non-3GPP access network using the first identify pseudonym.

Using a pseudonym for access authentication over non-3GPP access

Apparatuses, methods, and systems are disclosed for supporting remote unit reauthentication. One apparatus includes a network interface that receives a first authentication message for reauthenticating a remote unit and a processor that verifies a first domain-name. The first domain-name identifies a key management domain name and an associated gateway function holding a reauthentication security context. Here, the first authentication message includes a NAI containing a first username and the first domain-name. The processor validates the first authentication message using at least the first username and generates a second authentication message in response to successfully validating the first authentication message. Via the network interface, the processor responds to the first authentication message by sending the second authentication message.

Supporting remote unit reauthentication

Apparatuses, methods, and systems are disclosed for determining remote unit behavior parameters. One method includes receiving a message including parameters associated with an application in a remote unit. The method includes determining a first set of parameters including a first portion of the parameters, wherein each parameter of the first set of parameters corresponds to a remote unit behavior. The method includes determining a second set of parameters including a second portion of the parameters, wherein each parameter of the second set of parameters corresponds to a service behavior. The method includes associating the second set of parameters with a data network name, a single network slice selection assistance information, or a combination thereof.

Determining remote unit behavior parameters

Apparatuses, methods, and systems are disclosed for securing communications between user equipment devices. One apparatus includes a processor that derives, at a first user equipment ('UE') device in communication with a mobile wireless communication network, a security key for securing communications between the first UE and a second UE via the mobile wireless communication network, the security key derived based on at least one parameter associated with the first UE and the second UE. The processor establishes a secure communication between the first UE and the second UE via a first network function of the mobile wireless communication network using the derived security key.

Securing communications between user equipment devices

A communication terminal () according to the present disclosure includes: a control unit () configured to, in a case of a movement from a communication area formed by the 5GS to a communication area formed by the EPS or a movement from a communication area formed by the EPS to a communication area formed by the 5GS, determine whether or not a communication system forming a communication area at a movement destination can satisfy requirements of services; and a communication unit () configured to, when it is determined that the communication system forming the communication area at the movement destination can satisfy the requirements of the services, send a connection request message to the communication system forming the communication area at the movement destination.

Communication terminal, network device, communication method, and non-transitory computer readable medium

Apparatuses, methods, and systems are disclosed for security context handling during AMF reallocation. One apparatus in a mobile communication network includes a network interface and a processor that derives a Reroute Security Context and derives a first authentication parameter for authenticating a Target AMF. The network interface receives a Key Request message from a SEAF co-located with the Target AMF following an AMF reallocation during a UE Registration procedure. The processor verifies the Key Request message by determining whether the second authentication parameter matches the first authentication parameter derived for authenticating the Target AMF. The processor derives a new security context for the Target AMF/SEAF in response to successfully verifying the Key Request message. The network interface sends a Key Response message to the Target AMF/SEAF.

Security context for target AMF

Apparatuses, methods, and systems are disclosed for establishing a connection with a dual registered device. One method includes receiving a first request to establish an internet protocol multimedia subsystem session with a first device, wherein the first device is dual registered to: a first network access supporting 5G core network connectivity; and a second network access supporting evolved packet core network connectivity and circuit switched network connectivity, wherein the first device has connectivity to an internet protocol multimedia subsystem via either the first network access or the second network access. The method includes determining first information corresponding to a network access connectivity selected from the first network access and the second network access through which the first device has internet protocol connectivity with the internet protocol multimedia subsystem. The method includes transmitting a second request to a first network function to retrieve second information.

Establishing a connection with a dual registered device

Apparatuses, methods, and systems are disclosed for deriving a key based on an edge enabler client identifier. One method includes receiving, at a network function, a request message from an edge server function. The request message includes: an edge server identifier; and an edge enabler client identifier (EEC-ID), wherein the EEC-ID includes: an unencrypted EEC-ID; or an encrypted EEC-ID. The encrypted EEC-ID is encrypted with an authentication and key management (AKMA) key (K). The method includes deriving a unique key (K) based on the edge server identifier and the EEC-ID. The method includes transmitting a response message to the edge server function. The response message includes: the K; and an unencrypted EEC-ID.

Deriving a key based on an edge enabler client identifier

Apparatuses, methods, and systems are disclosed for paging multi-SIM devices in the same network. One apparatus includes a first subscriber identity module ('SIM'), a second SIM, a processor and a transceiver that communicates with at least one communication network. The processor registers with a first communication network using the first SIM and registers with a second communication network using the second SIM. Here, the registration with the first communication network is associated with a first identifier, wherein registering with the second communication network includes indicating the first identifier to the second communication network upon determining that the first communication network and the second communication network are the same communication network.

Paging for multiple SIMS

Apparatuses, methods, and systems are disclosed for enabling roaming with authentication and key management for applications. An apparatus includes a processor that determines a serving network of a user equipment ('UE') device, the serving network comprising a visited public land mobile network (“VPLMN”) that is different from a home PLMN (“HPLMN”) associated with the UE. The processor selects a network function within the serving network for provisioning an authentication and key management for applications (“AKMA”) security context for an application function (“AF”) based on a name for the serving network. The apparatus includes a transceiver that sends the security context to the network function.

Enabling roaming with authentication and key management for applications

Apparatuses, methods, and systems are disclosed for indicating the IMS capability for EPS fallback. One apparatus in a mobile communication network includes a processor and a transceiver that transmits to an IMS network entity a first SIP message comprising a request for establishing a data session, where the first SIP message contains a first contact header field. The transceiver receives a second SIP message from the IMS network entity for establishing the data session, where the second SIP message contains an indicator. The processor determines an IMS network capability from a combination of the first contact header field and the indicator.

Determining an IP multimedia system (IMS) capability

Growing community of inventors

Heidelberg, Germany

Andreas Kunz