Telefonaktiebolaget Lm Ericsson (publ)

Christine Jost

Noamen Ben Henda

Monica Wifvesson

Vesa Torvinen

Karl Norrman

Vesa Lehtovirta

Prajwol Kumar Nakarmi

David Castellanos Zamora

Helena Vahidi Mazinani

Peter Hedman

Alexander Maximov

Ivo Sedlacek

Ferhat Karakoc

Qian Chen

Bernard Smeets

Lars-Bertil Olsson

Cheng Wang

Ulf Mattsson

Pablo Martinez De La Cruz

Zhang Fu

Pasi Saarinen

Pinar Comak

Ralf Keller

Magnus Hallenstål

Åke Busin

Vlasios Tsiatsis

Maria Cruz Bartolome Rodrigo

Maria Esther Bas Sanchez

Jesus-Angel de-Gregorio-Rodriguez

Jesus Angel De Gregorio Rodriguez

Juha Kujanen

Ha Lam

Songmao Li

Bernard (Ben) Smeets

Jesús Ángel De-gregorio-rodriguez

Dan Xu

Helena Mazinani

Embodiments include methods for a data consumer network function (NF) of a communication network. These methods include sending, to a network repository function (NRF) of the communication network, a request for an access token for the following: a service provided by a 5 data collection coordination function (DCCF) of the communication network, and data to be collected via the DCCF service. These methods include receiving from the NRF at least one access token for the DCCF service and for the data to be collected via the DCCF service and, using the at least one access token, collecting the data from a data producer NF of the communication network via the DCCF service. Other embodiments include complementary methods for DCCFs 0 and NRFs, as well as data consumer NFs, DCCFs, and NRFs configured to perform such methods.

Data collection coordination function (DCCF) data access authorization without messaging framework

A method for a user equipment (UE) to obtain security credentials for accessing a non-public network (NPN) is provided. The method comprises sending, to an onboarding network (ON), a registration request that includes an identifier of the UE, and obtaining an indication of a credential provisioning protocol (CPP) used by a provisioning server (PS) for provisioning security credentials to access the NPN. The method further comprises obtaining, from the PS via the ON using the indicated CPP, security credentials for the UE to access the NPN.

Indication of provisioning protocol for credentials to access a non-public network

A serving network establishes a connection with a UE via an N3AN using a trusted registration procedure to establish a secure access link between the UE and the serving network via the N3AN. The serving network sends a trust indication message via the N3AN to the UE using the secure access link to identify the N3AN as trusted or untrusted. When the received trust indication message indicates the N3AN is untrusted, the serving network executes an untrusted registration procedure with the UE using the secure access link to establish the connection between the UE and the serving network. When the received trust indication message indicates the N3AN is trusted, the serving network continues execution of the initial registration with the UE using the trusted registration procedure to establish the connection between the UE and the serving network. The UE and serving network exchange messages via the established connection.

Determination of trust relationship of non-3GPP access networks in 5GC

Network equipment implements a network function in a wireless communication network. The network equipment obtains integrity verification information that is a function of only a portion of a message. The message is either a request for a service to be consumed by the network function or a response to a request for a service provided by the network function. The network equipment digitally signs an assertion that includes the integrity verification information, and then sends the message and the digitally signed assertion to a service communication proxy. Other network equipment that receives the message and the digitally signed assertion may check an integrity of the portion of the message, based on integrity verification information that the other network equipment obtains and on the integrity verification information included in the digitally signed assertion.

Integrity verification in a wireless communication network

Network equipment () is configured as a proxy () for one of multiple different core network domains of a wireless communication system (). The network equipment () is configured to receive a message () that has been, or is to be, transmitted between the different core network domains. The network equipment () is further configured to perform inter-domain security measures according to a security policy (). The security policy () may indicate which one or more portions of (e.g., the content of a field in) the message () are to be used by inter-domain security measures (e.g., inter-domain anti-spoofing measures) and/or which types of messages are to be used by the inter-domain security measures.

Message transmission between core network domains

Embodiments include methods performed by a service consumer network function (NF) of a communication network. Such methods include sending, to a network repository function (NRF) of the communication network, a request for an access token for notifications from a service producer NF of the communication network. The request includes a list of alternative notification endpoints. Such methods also include receiving, from the NRF, an access token for the notifications from the service producer NF. The access token includes the list of alternative notification endpoints. Such methods also include sending, to the service producer NF, a subscription request for the notifications. The subscription request includes the received access token, a primary notification endpoint, and binding information usable for selecting an alternative notification endpoint from the list. Other embodiments include complementary methods performed by NRFs and service producer NFs, as well as network nodes/functions that perform such methods.

Authorization of consumer network functions

The invention relates to a method for a data consumer network function, NF, of a communication network to collect data from a data producer NF, the method comprising: ∘sending (), to a network repository function, NRF, in the communication network, a request for an access token for a service provided by a data collection coordination function, DCCF, in the communication network; ∘receiving (), from the NRF, at least one access token for the service provided by the DCCF; and ∘using () the at least one access token, collecting data from the data producer NF in the communication network via the DCCF service.

Method and system for data access authorization via a data collection coordination function

A method performed by a service communication proxy (SCP). The method comprises determining whether or not there is a mismatch between a first list of Network Function (NF) service producers in an authorization token and a second list of NF service producers in a discovery response. The method further comprises responsive to determining that there is a mismatch between the first list of NF service producers and the second list of NF service producers, transmitting a service response error message to an NF consumer device that transmitted the authorization token, the service response error message indicating a mismatch between the authorization token and the discovery response.

Handling of token audience mismatch

The present disclosure relates to methods and apparatus for flexible, security context management during AMF changes. One aspect of the disclosure is a mechanism for achieving backward security during AMF changes in idle mode. Instead of passing the current NAS key to the target AMF, the source AMF derives a new NAS key, provides the new NAS key to the target AMF, along with a key change indication indicating that the NAS key has changed. The target AMF sends the key change indication to the user equipment.

Security context handling in 5G during idle mode

A process of operating a first network node in a first communication network can include establishing a control plane interface between the first network node and a second network node in a second communication network. The process can further include communicating first control plane data via the control plane interface. The first control plane data can be associated with operation of a user equipment, UE, in a first communication system of the first communication network. The process can further include determining that the UE has moved to a second communication system of the first communication network. The process can further include maintaining the control plane interface between the first network node and the second network node in the second communication network. The process can further include communicating second control plane data via the control plane interface.

Maintaining N32 interface when using different radio access technologies

A first network node operating in a telecommunications network can receive an authentication request associated with a communication device requesting registration with the telecommunications network. The authentication request can include first subscriber information. The first network node can determine that the first subscriber information includes an anonymous identifier. Responsive to determining that the first subscriber information includes the anonymous identifier, the network node can determine an authentication procedure to be performed. The network node can receive information associated with the communication device as part of the authentication procedure. The network node can generate second subscriber information based on the information associated with the communication device.

Subscription retrieval for anonymous identification

Network equipment is configured for use in one of multiple different core network domains of a wireless communication system. The network equipment is configured to receive a message that has been, or is to be, transmitted between the different core network domains. The network equipment is also configured to apply inter-domain security protection to, or remove inter-domain security protection from, one or more portions of the content of a field in the message according to a protection policy. The protection policy includes information indicating to which one or more portions of the content inter-domain security protection is to be applied or removed. The network equipment is also configured to forward the message, with inter-domain security protection applied or removed to the one or more portions, towards a destination of the message.

Protecting a message transmitted between core network domains

Enabling the exchange of connection parameters where a user equipment (UE) lacks a secret shared with the network (e.g. a server), such as key materials, and lacks a valid certificate. In some embodiments, the connection parameters may be exchanged via EAP messages. In certain aspects, and particularly with respect to emergency attach, a simplified protocol is used with limited overhead because the UE does not attempt to authenticate the network, and the network does not attempt to authenticate the UE.

Parameter exchange during emergency access using extensible authentication protocol messaging

A method performed by a mobile terminal for verifying at least one privacy profile setting for positioning of the mobile terminal to a location network node in a communications network is provided. The method includes receiving a request from the location network node for the mobile terminal to provide a position of the mobile terminal. The method further includes checking the at least one privacy profile setting of the mobile terminal for permission to provide position information of the mobile terminal. The method further includes determining whether to send the positioning information of the mobile terminal to the location network node based on the checking the at least one privacy profile setting. Methods performed by a network node are also provided.

Privacy control of user equipment and related apparatuses

There is provided mechanisms for attachment of a wireless device to an MNO. A method is performed by the wireless device. The method comprises providing an authorization token to an AMF node of the MNO in conjunction with authenticating with the AMF node. The method comprises completing attachment to the MNO upon successful validation of the authorization token by the AMF node.

Growing community of inventors

Lund, Sweden

Christine Jost