Lenovo (Singapore) Pte. Ltd.

Nec Corporation

Motorola Mobility LLC

Sap Se

Nec Europe Ltd.

Lenovo (Beijing) Limited

Nec C Orporation

Nec Laboratories Europe Gmbh

Lenovo Limited

Andreas Kunz

Genadi Velev

Toshiyuki Tamura

Anand Raghawa Prasad

Dimitrios Karampatsis

Sheeba Backia Mary Baskaran

Prateek Basu Mallick

Roozbeh Atarius

Apostolis K Salkintzis

Hironori Ito

Ravi Kuchibhotla

Iskren Ianev

Joachim Loehr

Sivabalan Arumugam

Sivakamy Lakshminarayanan

Xiaowei Zhang

Joachim Löhr

Hans-Joerg Kolbe

Alexander Johann Maria Golitschek Edler Von Elbwart

Zhuoyun Zhang

Karthikeyan Ganesan

Joachim Lohr

Gottfried Punz

Naoaki Suzuki

Konstantinos Samdanis

Stefan Schmid

Thilo Ewald

Andreas Maeder

Ishan Vaishnavi

Emmanouil Pateromichelakis

Vincenzo Sciancalepore

Marco Liebsch

Xavier Costa-Perez

Tingfang Tang

Frank Weigel

JaeSeung Song

Thomas Dietz

Bernd Lamparter

Paulo Ferrer Loureiro

Prakash Ponshankaarchinnusamy

Jens Pflueger

Peter Muessig

Clement Selvaraj

Santosh Kumar Addanki

Hena Mau

Ralf Kaltenmaier

Filipe Alexandre-Rodrigues De Moura Leitao

Filipe Leitao

Mohammad Istiak Hossain

Tashiyuki Tamura

Surendran Palanimuthu

Thomas Marz

Jianning Liu

Sheeba Backia Mary Baskara

Ravi Kuchbhota

Atarius Roozbeh

Apparatuses, methods, and systems are disclosed for accessing an NPN using external credentials. One apparatus in a mobile communication network includes a processor and a transceiver that receives a registration request for a UE. Here, the UE does not have a subscription with the mobile communication network. The processor identifies a service provider of the UE and controls the transceiver to send an authentication message to an AAA server of the identified service provider. The processor receives an authentication response containing a master session key from the AAA server in response to successful authentication of the UE and derives a set of security keys (e.g., K, K) using the master session key.

Authenticating a device not having a subscription in a network

Apparatuses, methods, and systems are disclosed for supporting TNGF reauthentication. One apparatus includes a processor that establishes connectivity with a first access point in a non-3GPP access network. The processor sends a first EAP message containing a NAI. If the NAI indicates a request to reauthenticate with a gateway function in the non-3GPP access network, then the processor receives a first EAP challenge packet used to authenticate the gateway function. If the NAI indicates a request to initiate a NAS signaling procedure with a mobile communication network, then the processor receives an EAP start packet. Here, the EAP start packet triggers the processor to send a first NAS message to the mobile communication network. The processor completes an EAP session initiated by one of the first EAP challenge packet and the EAP start packet.

Gateway function reauthentication

Apparatuses, methods, and systems are disclosed for a factor for multiple device registrations. One method includes receiving, at a network device from a first device, a first session initiation protocol message including an identity for establishing a data session. The method includes determining a factor based on a first registration performed by a second device and a second registration performed by a third device. The method includes transmitting a second session initiation protocol message including the identity and the factor to the second device. The method includes establishing the data session between the first device and the second device. The identity is: registered for the first registration; registered for the second registration; not registered for the first registration; not registered for the second registration; or some combination thereof.

Factor for multiple device registrations

Apparatuses, methods, and systems are disclosed for authentication for a network service. One method includes receiving, at a first network device from a second network device, a network function service request to execute a service on a third network device. The request includes first credentials for authentication with a first network device and second credentials for authentication with the third network device. The method includes determining whether the first credentials provided are valid and execute the service request by determining the third network device to execute the service requested from the second network device. The method includes transmitting, to a fourth network device, a request for authentication with the third network device. The request includes an identifier of the third network device and second credentials of the second network device.

Authentication for a network service

Apparatuses, methods, and systems are disclosed for authorizing and configuring pairing of unmanned aerial system. An apparatus includes a transceiver that receives, at a first network function of a mobile wireless communication network, a first authorization of unmanned aerial vehicle ('UAV') operations and a second authorization for associating a UAV-controller with the UAV, the first and second authorizations associated with a first identifier. An apparatus includes a processor that creates a 5G local area network (“LAN”) group within the mobile wireless communication for facilitating communications between the UAV and the UAV-controller and associating a second identifier with the 5G LAN group, configures the 5G LAN group based on at least at least one parameter associated with the UAV and updates a third network function with information for the 5G LAN group for establishing a protocol data unit (“PDU”) session between the UAV and the UAV controller.

Authorizing and configuring pairing of unmanned aerial system

Embodiments of the present application are directed to a method and apparatus for providing onboarding and provisioning services. A method according to an embodiment of the present application may include: receiving a registration request for a user equipment (UE), wherein the register request indicates an identity of the UE, an onboarding and provisioning flag, and an onboarding and provisioning function (OPF) identity; selecting an OPF entity at least based on the OPF identity in the case of an onboarding request being supported for the UE; and transmitting the onboarding request at least indicating the identity of the UE to the selected OPF entity.

Method and apparatus for providing onboarding and provisioning services

Apparatuses, methods, and systems are disclosed for determining and enforcing service specific network slice security. One apparatus in a mobile communication network includes processor that performs primary authentication with a mobile communication network and a transceiver that receives a SMC message comprising SSI. The processor applies slice security for control plane and user plane traffic related to a network slice according to a Security Requirement Type indicated in the SSI.

Slice-specific security requirement information

Apparatuses, methods, and systems are disclosed for Digital Identifier-based subscription onboarding. One apparatus includes a memory coupled to a processor, the memory storing instructions executable by the processor to control the apparatus to acquire a Digital Identifier ('DIG-ID') comprising a verifiably secure identity, and to generate a digital signature of the DIG-ID and a timestamp using a private key. The instructions are executable by the processor to control the apparatus to send a first request to a mobile communication network and to receive a response containing an onboarding authentication success indication and a verified DIG-ID, the first request including the DIG-ID, the timestamp and the digital signature. The instructions are executable by the processor to establish a provisioning connection to the mobile communication network and to receive a subscription credential and/or a user subscription profile via the provisioning connection.

Subscription onboarding using a verified digital identity

Apparatuses, methods, and systems are disclosed for indicating a network for a remote unit. One method includes transmitting a first message including a first registration request from a remote unit. The first message includes a discovery indication indicating that the remote unit is attempting to discover a network configured for use by the remote unit. The method includes receiving a second message including a list of networks configured for use by the remote unit. The second message is received in response to transmitting the first message. The method includes transmitting a third message including a second registration request from the remote unit. The second registration request includes an indication of a network selected from the list of networks configured for use by the remote unit.

Indicating a network for a remote unit

Apparatuses, methods, and systems are disclosed for using a pseudonym for access authentication over non-3GPP access. One apparatus includes a processor and a transceiver that communicates with a mobile communication network using a 3GPP access network and a non-3GPP access network. The processor sends a registration message to a first network function in the mobile communication network via the 3GPP access network, the first authentication message comprising a first indicator and a SUCI for the apparatus, wherein the first indicator comprises an indication that the apparatus has the capability for access authentication for non-3GPP access in an EPS. The processor receives a first identity pseudonym for the apparatus in response to the registration message comprising the first indicator and performs access authentication via a non-3GPP access network using the first identify pseudonym.

Using a pseudonym for access authentication over non-3GPP access

Apparatuses, methods, and systems are disclosed for supporting remote unit reauthentication. One apparatus includes a network interface that receives a first authentication message for reauthenticating a remote unit and a processor that verifies a first domain-name. The first domain-name identifies a key management domain name and an associated gateway function holding a reauthentication security context. Here, the first authentication message includes a NAI containing a first username and the first domain-name. The processor validates the first authentication message using at least the first username and generates a second authentication message in response to successfully validating the first authentication message. Via the network interface, the processor responds to the first authentication message by sending the second authentication message.

Supporting remote unit reauthentication

Apparatuses, methods, and systems are disclosed for determining remote unit behavior parameters. One method includes receiving a message including parameters associated with an application in a remote unit. The method includes determining a first set of parameters including a first portion of the parameters, wherein each parameter of the first set of parameters corresponds to a remote unit behavior. The method includes determining a second set of parameters including a second portion of the parameters, wherein each parameter of the second set of parameters corresponds to a service behavior. The method includes associating the second set of parameters with a data network name, a single network slice selection assistance information, or a combination thereof.

Determining remote unit behavior parameters

Apparatuses, methods, and systems are disclosed for securing communications between user equipment devices. One apparatus includes a processor that derives, at a first user equipment ('UE') device in communication with a mobile wireless communication network, a security key for securing communications between the first UE and a second UE via the mobile wireless communication network, the security key derived based on at least one parameter associated with the first UE and the second UE. The processor establishes a secure communication between the first UE and the second UE via a first network function of the mobile wireless communication network using the derived security key.

Securing communications between user equipment devices

A communication terminal () according to the present disclosure includes: a control unit () configured to, in a case of a movement from a communication area formed by the 5GS to a communication area formed by the EPS or a movement from a communication area formed by the EPS to a communication area formed by the 5GS, determine whether or not a communication system forming a communication area at a movement destination can satisfy requirements of services; and a communication unit () configured to, when it is determined that the communication system forming the communication area at the movement destination can satisfy the requirements of the services, send a connection request message to the communication system forming the communication area at the movement destination.

Communication terminal, network device, communication method, and non-transitory computer readable medium

Apparatuses, methods, and systems are disclosed for security context handling during AMF reallocation. One apparatus in a mobile communication network includes a network interface and a processor that derives a Reroute Security Context and derives a first authentication parameter for authenticating a Target AMF. The network interface receives a Key Request message from a SEAF co-located with the Target AMF following an AMF reallocation during a UE Registration procedure. The processor verifies the Key Request message by determining whether the second authentication parameter matches the first authentication parameter derived for authenticating the Target AMF. The processor derives a new security context for the Target AMF/SEAF in response to successfully verifying the Key Request message. The network interface sends a Key Response message to the Target AMF/SEAF.

Security context for target AMF

Growing community of inventors

Heidelberg, Germany

Andreas Kunz