GB2619798A

GB2619798A - Network Slice-Specific Authentication and Authorization

Info

Publication number: GB2619798A
Application number: GB2305496.8A
Authority: GB
Inventors: Watfa Mahmoud
Original assignee: Samsung Electronics Co Ltd
Current assignee: Samsung Electronics Co Ltd
Priority date: 2020-03-30
Filing date: 2020-03-30
Publication date: 2023-12-20
Also published as: GB202305496D0

Abstract

A UE transmits to a network entity (e.g. an AMF entity), a Registration Request message including a 5GS registration type IE indicating (a) "periodic registration updating", or (b) "mobility registration updating" and the UE is in NB-N1 mode. The UE receives from the network entity, a Registration Accept message including a 5GS registration result IE indicating "NSSAA (Network Slice Specific Authentication and Authorization) to be performed", setting one or more stored allowed Network Slice Selection Assistance Information (NSSAI) as invalid (e.g. deleting stored allowed NSSAI). If an allowed NSSAI for the UE has been changed from an allowed NSSAI that was previously sent to the UE, and at least one new S-NSSAI (Single-Network Slice Selection Assistance Information) requires NSSAA the UE may receive from the network entity; an allowed NSSAI containing S-NSSAIs for which a re-initiation of NSSAA is not required, and/or a pending NSSAI containing S-NSSAIs for which NSSAA needs to be re-initiated.

Description

Network Slice-Specific Authentication and Authorization

BACKGROUND

Field

Certain examples of the present disclosure provide methods, apparatus and systems for performing network slice-specific authentication and authorization For example, certain examples of the present disclosure provide methods, apparatus and systems for enabling correct operations for network slice-specific authentication and authorization in 3GPP 5G.

Description of the Related Art

Herein, the following documents are referenced: [1] 3GPP TS 23.501 V16.4.0 [2] 3GPP TS 23.502 V16.4.0 [3] 3GPP TS 24.501 V16.4.0 In 3GPP 5GS, the following are defined (e.g. in [1]). A Network Slice (NS) is defined as a logical network that provides specific network capabilities and network characteristics. A Network Slice Instance (NSI) is defined as a set of Network Function instances and the required resources (e.g. compute, storage and networking resources) which form a deployed NS. A Network Function (NF) is defined as a 3GPP adopted or 3GPP defined processing function in a network, which has defined functional behaviour and 3GPP defined interfaces.

A NS may be identified by Single Network Slice Selection Assistance Information (S-NSSAI).

Overview of Network slice-specific authentication and authorization (NSSAA) NSSAA was introduced as part of Rel-16 in 3GPP. The feature enables the network to perform slice-specific authentication and authorization for a set of S-NSSAI(s) to ensure that the user is allowed to access these slices. The procedure is executed after the 5GMM authentication procedure has been completed and also after the registration procedure completes. The high-level description of the feature can be found in [1] whereas further details can be found in [2] and [3]. The key points about the NSSAA procedure are summarized in this section.

The NSSAA procedure is access independent i.e. if a slice is successfully authorized, then it is considered as authorized for both access types (i.e. 3GPP and non-3GPP access type).

Note: "authorized" means that slice-specific authentication/authorization has succeeded for a particular S-NSSAI, however this does not mean that the S-NSSAI is allowed to be used in the UE's current tracking area (TA) over the 3GPP access.

When the UE registers with the network, the UE may include a requested NSSAI (R-NSSAI) in the Registration Request message if available at the UE. The following describes the network behaviour as specified in [3]: If the UE indicated the support for network slice-specific authentication and authorization, and.

a) if the Requested NSSAI IE only includes the S-NSSAls: 1) which are subject to network slice-specific authentication and authorization; and 2) for which the network slice-specific authentication and authorization procedure has not been initiated; the AMF shall in the REGISTRATION ACCEPT message include.

1) the "NSSAA to be performed" indicator in the 5GS registration result IE set to indicate whether network slice-specific authentication and authorization procedure will be performed by the network; 2) pending NSSAI containing one or more S-NSSAls for which network slice-specific authentication and authorization will be performed; and 3) the current registration area in the list of "non-allowed tracking areas" in the Service area list 1E; or b) if the Requested NSSAI 1E includes one or more S-NSSAls subject to network slice-specific authentication and authorization, the AMP shall in the REGISTRATION ACCEPT message include: 1) the allowed NSSAI containing the S-NSSAls or the mapped S-NSSAls which are not subject to network slice-specific authentication and authorization or for which the network slice-specific authentication and authorization has been successfully performed; and 2) pending NSSAI containing one or more S-NSSAls for which network slice-specific authentication and authorization will be performed, if any.

If the UE indicated the support for network slice-specific authentication and authorization, and if: a) the UE did not include the requested NSSAI in the REGISTRATION REQUEST message or none of the S-NSSAls in the requested NSSAI in the REGISTRATION REQUEST message are present in the subscribed S-NSSAls; and b) all of the S-NSSAls in the subscribed S-NSSAls are subject to network slice-specific authentication and authorization; the AMP shall in the REGISTRATION ACCEPT message include: a) the "NSSAA to be performed" indicator in the 5GS registration result IE to indicate whether network slice-specific authentication and authorization procedure will be performed by the network; b) pending NSSAI containing one or more S-NSSAls for which network slice-specific authentication and authorization will be performed; and c) the current registration area in the list of "non-allowed tracking areas" in the Service area fist IE." NSSAA can be re-initiated at any time as specified in section 5.15.10 of [1]: This procedure can be invoked for a supporting UE by an AMP at any time, e.g. when: a. The UE registers with the AMP and one of the S-NSSAls of the HPLMN which maps to an S-NSSAI in the Requested NSSA1 is requiring Network Slice-Specific Authentication and Authorization (see clause 5.15.a 2.1 for details), and can be added to the Allowed NSSAI by the AMF once the Network Slice-Specific Authentication and Authorization for the S-NSSA1 succeeds; or b. The Network Slice-Specific AAA Server triggers a UE re-authentication and re-authorization for an S-NSSA1; or a The AMP, based on operator policy or a subscription change, decides to initiate the Network Slice-Specific Authentication and Authorization procedure for a certain S-NSSAI which was previously authorized.

In the case of re-authentication and re-authorization (b. and c. above) the following applies: -If S-NSSAls that are requiring Network Slice-Specific Authentication and Authorization are included in the Allowed NSSAI for each Access Type, AMP selects an Access Type to be used to perform the Network Slice Specific Authentication and Authorization procedure based on network policies.

- If the Network Slice-Specific Authentication and Authorization for some S-NSSAls in the Allowed NSSAI is unsuccessful, the AMP shall update the Allowed NSSAI for each Access Type to the UE via UE Configuration Update procedure.

- If the Network Slice-Specific Authentication and Authorization fails for all S-NSSAls in the Allowed NSSA1, the AMP shall execute the Network-initiated Deregistration procedure described in TS 23.502 [3], clause 4.2.2.3.3, and shall include in the explicit De-Registration Request message the list of Rejected S-NSSAls, each of them with the appropriate rejection cause value.

Overview of S-NSSAI IE and its handling during roaming Note that the S-NSSAI IE is coded as shown in Figure 1 [3].

When the UE is in the home PLMN (HPLMN) then the Mapped HPLMN SST (octet 7) and Mapped HPLMN SD (octets 8 to 10) are not applicable. In fact in the HPLMN these octets correspond to the SST field (octet 3) and SD field (octets 4 to 6) respectively.

On the other hand, when the UE is roaming in a visited PLMN (VPLMN) then the UE may contain the mapped slice information that corresponds to the slice being use in the VPLMN. For example, assume in a VPLMN 1 the UE has the following S-NSSAI entry in the allowed NSSAI as shown in Figure 2.

Basically the above means that the slice [V1-Cars, V1-BMW] that is being accessed in VPLMN 1 corresponds to the slice [Hi-Cars, H1-BMW] in the HPLMN. It should be noted, as shown in Figure 1, that the SD field and the Mapped HPLMN SD fields are optional.

The NSSAI (Network Slice Selection Assistance Information) is a list of S-NSSAI (Single Network Slice Selection Assistance Information) and there are different types of NSSAls such as the Requested NSSAI (which has at most 8 entries), Allowed NSSAI (which has at most 8 entries), Configured NSSAI (which has at most 16 entries), and the Pending NSSAI (which has at most 8 entries).

The NSSAI IE is coded as shown in Figure 3.

The Requested mapped NSSAI is a type of Mapped NSSAI which is coded as shown in Figure 4.

The Mapped NSSAI contains a list of Mapped S-NSSAI entries, where each Mapped S-NSSAI entry is coded as shown in Figure 5.

The Requested mapped NSSAI IE is sent in roaming cases when: * the UE moves across visited PLMNs and attempts to transfer a PDU session across these visited PLMNs, * the UE has an established PDU session in the source VPLMN, * the UE knows the mapped HPLMN slice information (i.e. the Mapped HPLMN SST and optionally the Mapped HPLMN SD) of the PDU session that is established in the source VPLMN, and * the UE does not have any slice information (i.e. does not have a configured NSSAI or allowed NSSAI) for the target VPLMN.

As an example to explain this, assume the UE is in VPLMN 1 and has a PDU session for which the S-NSSAI is {V1-Cars, H-Cars}. For simplicity, the value V-Cars corresponds to at least the SST field of Figure 1 but may also include the SD field of Figure 1. Similarly for simplicity the value H-Cars corresponds to at least the Mapped HPLMN SST field of Figure 1 but may also include the Mapped HPLMN SD field of Figure 1.

Now if the UE moves from VPLMN 1 to a target VPLMN, say VPLMN 2, and the UE does not have any slice information for VPLMN 2, then the UE will include the Requested mapped NSSAI IE in the Registration Request message that is sent in VPLMN 2. The NAS message does not include the Requested NSSAI IE in this case since the UE does not have any slice information for VPLMN 2.

Now assume that the UE in VPLMN 1 had two PDU sessions each of which is associated to one of the following S-NSSAls: * {V1-Cars, H-Cars} * {V1-SmartPhone, H-SmartPhone} Also, assume that the UE has the following slice information for a potential target VPLMN 2: * {V2-Cars, H-Cars} When the UE enters VPLMN 2, the UE will include the following IEs in the Registration Request message: * The Requested NSSAI IE that will include the entry {V2-Cars, H-Cars}. This IE will be sent since the UE has the slice information for VPLMN 2 and moreover the mapped slice component i.e. the value "H-Cars", matches the mapped slice component of the existing PDU session, and * The Requested mapped NSSAI IE that will include the entry (H-SmartPhone). This IE will be included since the UE does not have slice information for the VPLMN 2 that matches the mapped slice component i.e. the value "H-SmartPhone", of the existing PDU session.

In the example above, the AMF will consider both the Requested NSSAI IE and the Requested mapped NSSAI IE for the purpose of sending an Allowed NSSAI IE to the UE in the Registration Accept message.

Note that if, for the sake of an example and for the sake of clarifying how slicing works, the UE also had {V2-SmartPhone, H-SmartPhone} as a slice information for the VPLMN 2, then the UE in this case would only include the Requested NSSAI IE in the Registration Request message since the mapped slice information of the existing PDU sessions from VPLMN 1 match the mapped slice information of VPLMN 2. In this case the Requested mapped NSSAI IE is not included in the Registration Request message.

To summarize, it should be understood that in roaming cases the UE may send the Requested NSSAI IF only, or the Requested mapped NSSAI 1E, or both the Requested NSSAI IF and the Requested mapped NSSAI IE in the Registration Request message. Determining which IE to include depends on whether the UE has slice information of the target VPLMN and whether there is a match between the mapped components of the S-NSSAls that are associated with the existing PDU session(s) from the source VPLMN.

Finally, what is very important to note is that if the UE receives the Allowed NSSAI IE in the Registration Accept, and: * the entries of the Allowed NSSAI IE do not match the entire S-NSSAI of an existing PDU session, or * the mapped slice information (i.e. the Mapped HPLMN SST and optionally the Mapped HPLMN SD) of the entries in the Allowed NSSAI IE does not match the mapped slice information of the existing PDU session, then the UE will locally release the PDU session whose associated S-NSSAI does not match any entry in the Allowed NSSAI IE as explained above. This behaviour is described in [3] as 10 follows: INIth respect to each of the PDU session(s) active in the UE, if the allowed NSSAI contains neither a) an S-NSSAI matching to the S-NSSAI of the PDU session; nor b) a mapped S-NSSAI matching to the mapped S-NSSA1 of the POU session; the UE shall perform a local release of all such PDU sessions except for the persistent PDU session(s), The above information is presented as background information only to assist with an understanding of the present disclosure. No determination has been made, and no assertion is made, as to whether any of the above might be applicable as prior art with regard to the present invention.

SUMMARY

It is an aim of certain examples of the present disclosure to address, solve and/or mitigate, at least partly, at least one of the problems and/or disadvantages associated with the related art, for example at least one of the problems and/or disadvantages described herein. It is an aim of certain examples of the present disclosure to provide at least one advantage over the related art, for example at least one of the advantages described herein.

The present invention is defined in the independent claims. Advantageous features are defined in the dependent claims.

Other aspects, advantages, and salient features will become apparent to those skilled in the art from the following detailed description, taken in conjunction with the annexed drawings, which disclose examples of the present disclosure.

BRIEF DESCRIPTION OF THE DRAWINGS

Figure 1 illustrates an S-NSSAI information element (from [3]); Figure 2 illustrates an example S-NSSAI value; Figure 3 illustrates an NSSAI information element (from [3]); Figure 4 illustrates a mapped NSSAI information element (from [3]); Figure 5 illustrates a mapped S-NSSAI content (from [3]); and Figure 6 is a block diagram of an exemplary network entity that may be used in certain examples of the present disclosure.

DETAILED DESCRIPTION

The following description of examples of the present disclosure, with reference to the accompanying drawings, is provided to assist in a comprehensive understanding of the present invention, as defined by the claims. The description includes various specific details to assist in that understanding but these are to be regarded as merely exemplary. Accordingly, those of ordinary skill in the art will recognize that various changes and modifications of the examples described herein can be made without departing from the scope of the invention.

The same or similar components may be designated by the same or similar reference numerals, although they may be illustrated in different drawings.

Detailed descriptions of techniques, structures, constructions, functions or processes known in the art may be omitted for clarity and conciseness, and to avoid obscuring the subject matter of the present invention.

The terms and words used herein are not limited to the bibliographical or standard meanings, but, are merely used to enable a clear and consistent understanding of the invention.

Throughout the description and claims of this specification, the words "comprise", "include" and "contain" and variations of the words, for example "comprising" and "comprises", means "including but not limited to", and is not intended to (and does not) exclude other features, elements, components, integers, steps, processes, operations, functions, characteristics, properties and/or groups thereof Throughout the description and claims of this specification, the singular form, for example "a", "an" and "the", encompasses the plural unless the context otherwise requires. For example, reference to "an object" includes reference to one or more of such objects.

Throughout the description and claims of this specification, language in the general form of "X for Y" (where Y is some action, process, operation, function, activity or step and X is some means for carrying out that action, process, operation, function, activity or step) encompasses means X adapted, configured or arranged specifically, but not necessarily exclusively, to do Y. Features, elements, components, integers, steps, processes, operations, functions, characteristics, properties and/or groups thereof described or disclosed in conjunction with a particular aspect, embodiment, example or claim of the present invention are to be understood to be applicable to any other aspect, embodiment, example or claim described herein unless incompatible therewith.

Certain examples of the present disclosure provide methods, apparatus and systems for performing network slice-specific authentication and authorization. The following examples are applicable to, and use terminology associated with, 3GPP 5G. For example, certain examples of the present disclosure provide methods, apparatus and systems for enabling correct operations for network slice-specific authentication and authorization in 3GPP 53.

However, the skilled person will appreciate that the techniques disclosed herein are not limited to these examples or to 3GPP 5G, and may be applied in any suitable system or standard, for example one or more existing and/or future generation wireless communication systems or standards.

For example, the functionality of the various network entities and other features disclosed herein may be applied to corresponding or equivalent entities or features in other communication systems or standards. Corresponding or equivalent entities or features may be regarded as entities or features that perform the same or similar role, function, operation or purpose within the network. For example, the functionality of the AMF in the examples below may be applied to any other suitable type of entity performing mobility management functions.

The skilled person will appreciate that the present invention is not limited to the specific examples disclosed herein. For example: * The techniques disclosed herein are not limited to 3GPP 5G.

9 One or more entities in the examples disclosed herein may be replaced with one or more alternative entities performing equivalent or corresponding functions, processes or operations.

* One or more of the messages in the examples disclosed herein may be replaced with one or more alternative messages, signals or other type of information carriers that communicate equivalent or corresponding information.

* One or more further elements, entities and/or messages may be added to the examples disclosed herein.

* One or more non-essential elements, entities and/or messages may be omitted in certain examples.

* The functions, processes or operations of a particular entity in one example may be divided between two or more separate entities in an alternative example.

* The functions, processes or operations of two or more separate entities in one example may be performed by a single entity in an alternative example.

* Information carried by a particular message in one example may be carried by two or more separate messages in an alternative example.

* Information carried by two or more separate messages in one example may be carried by a single message in an alternative example.

* The order in which operations are performed may be modified, if possible, in alternative examples.

* The transmission of information between network entities is not limited to the specific form, type and/or order of messages described in relation to the examples disclosed herein.

Certain examples of the present disclosure may be provided in the form of an apparatus/device/network entity configured to perform one or more defined network functions and/or a method therefor. Certain examples of the present disclosure may be provided in the form of a system (e.g. a network) comprising one or more such apparatuses/devices/network entities, and/or a method therefor.

For example, in the following examples, a network may include a User Equipment (UE), and an Access and Mobility Management Function (AMF) entity.

The 5GC AMF receives all connection and session related information from the UE (N1/N2) but is responsible only for handling connection and mobility management tasks. All messages related to session management are forwarded over the N11 reference interface to the SMF. The AMF performs the role of access point to the 5GC. The functional description of AMF is given in 3GPP TS 23.501 V16.3.0, clause 6.2.1.

At least the following problems exist in view of the related art: 1. NSSAA does not consider the Requested mapped NSSAI IE and the UE may incorrectly release a PDU session thereby impacting the user's experience As described above, when the UE is roaming, the UE may include the Requested NSSAI IE only, the Requested mapped NSSAI IE only, or both the Requested NSSAI IE and the Requested mapped NSSAI IE in the Registration Request message.

The current NSSAA procedure does not consider UEs that are roaming and hence it is unclear what the AM F will do when the Requested mapped NSSAI IE is received and how this impacts NSSAA.

In relation to roaming, as also mentioned above, when the UE receives an Allowed NSSAI IE in the Registration Accept message for which no S-NSSAI entry of the allowed NSSAI, or no mapped S-NSSAI component of the S-NSSAI entries in the allowed NSSAI match the mapped S-NSSAI information of an existing PDU session, the UE shall perform a local release of these PDU sessions. This may be incorrect behaviour that may lead to an unnecessary release of the PDU session and disruption to the user experience. For example, the allowed NSSAI may not include such an S-NSSAI that would match the slice information of an existing PDU session because the slice is subject to NSSAA. Hence, the slice information, for which there is a potential match, may be in the Pending NSSAI IF and therefore considering only the Allowed NSSAI IF in this case can lead to an early and incorrect release of the PDU session locally in the UE.

2. Collisions of procedures have not been considered The NAS specification [3] usually considers collisions of different NAS procedures or messages and specifies which procedure or message should be prioritized in some cases depending on the colliding procedures in question. There are some collision cases that can occur during NSSAA that have not yet been considered thereby leaving the UE and network behaviour unclear when such cases arise. The following cases are identified as lacking any defined behaviour.

Case 1: a collision of an authentication procedure and NSSAA procedure As stated above, NSSAA should occur after the authentication procedure completes. However, it is possible that the same AMF that initiates an NSSAA procedure may also initiate an authentication procedure. This is because the re-initiation of the authentication procedure can happen at any time in connected mode. For example, assume the UE is registered over one access e.g. say the 3GPP access, the UE is in connected mode, and the network is performing NSSAA. Then the UE registers over a second access e.g. say the non-3GPP access, to the same PLMN or AM F. The AMF may have a policy to run authentication for every initial registration. In this case, although NSSAA is ongoing, the AMF may initiate the authentication procedure and send the Authentication Request message to the UE. At the UE, the Authentication Request message may be received after (or before) a Network Slice-Specific Authentication Command message is received in the UE but before the UE responds with the Network Slice-Specific Authentication Complete message, then there has to be specified behaviour for the UE to follow in terms of which message needs to be prioritized. The same question can be asked for the AMF i.e. if the AMF sends the Authentication Request message after sending a Network Slice-Specific Authentication Command message to the UE, and the AMF has not yet received the Authentication Response but receives the Network Slice-Specific Authentication Complete message, then it is not clear if the AMF should accept the latter or wait for the authentication procedure to complete.

Case 2: a collision of a generic UE configuration update procedure and NSSAA procedure The generic UE configuration update procedure can be initiated at any time when the UE is in connected mode. Similarly the NSSAA procedure can be initiated at any time for a UE that is in connected mode. As such, these procedures may collide and the related messages may be sent by the AMF at approximately the same time thereby the UE receives these messages at approximately the same time. The NAS specification [3] usually defines the behaviour for the recipient in collision cases however the current specification has not defined the behaviour for the collision of these procedures. Certain examples of the present disclosure aim to solve this problem by specifying the correct behaviour to mitigate such collisions.

Case 3: a collision of a service request procedure and NSSAA procedure The UE can initiate the service request procedure when in connected mode. At the same time, the network may initiate NSSAA for the UE in connected mode. For example, the UE can be in 53MM-CONNECTED mode over the non-3GPP access and then the UE performs a registration procedure over the 3GPP access. The AMF may indicate that NSSAA will be performed in the 5G5 registration result IF and may include the Pending NSSAI IF in the Registration Accept message but the AMF may not include the Allowed NSSAI IE in the NAS message. At the same time, or approximately the same time, the UE may send the Service Request message over the non-3GPP access although the existing requirement is such that this should not happen. There is currently no mechanism to handle this collision.

3. Lack of methods to handle abnormal cases The NAS specification [3] handles abnormal cases that can occur and describes a method for recovering from them.

Case 1: Transmission failure of the Network Slice-Specific Authentication Complete message with TAI change from lower layers The following abnormal case has been identified for NSSAA in section 5.4.7.2.4 in [3], a) Transmission failure of the NETWORK SLICE-SPECIFIC AUTHENTICATION COMPLETE message with TAI change from lower layers If the current TAI is not in the TAI list, the network slice-specific authentication and authorization procedure shall be aborted and a registration procedure for mobility and periodic registration update indicating "mobility registration updating" in the 5GS registration type IE of the REGISTRATION REQUEST message shall be initiated.

If the current TAI is still part of the TAI list, it is up to the UE implementation how to re-run the ongoing procedure that tnggered the network slice-specific authentication and authorization procedure.

The case above means that the UE, during an ongoing NSSAA enters a new tracking area identity (TAI) that is not in the UE's current list of TAls and therefore the UE would need to perform a registration procedure again.

Although the behaviour above is fine, what is not yet considered is how the UE handles the Requested NSSAI IE that will be sent in the Registration Request procedure.

It should be noted that there is a requirement that the UE with a pending NSSAI should not include the S-NSSAls in the pending NSSAI if the UE sends a Registration Request again except when specific conditions occur. However, before entering a new TAI as described above, the UE may have received a Pending NSSAI IE but no Allowed NSSAI 1E, or the UE may have received both IEs. In any cases, as the UE is moving into a new TAI, this new area may be served by a new AMF. Therefore, if the UE does not send the Requested NSSAI IF again, then the determination (by the AM F) of the entries of the Allowed NSSAI I E would be different as compared to the case when the UE actually sends a Requested NSSAI IE. Hence, not sending the Requested NSSAI IE may be lead to an incorrect behaviour and undesirable outcome. The present disclosure analyses different cases to determine whether or not the Requested NSSAI IF should be included in the Registration Request message following the abnormal case in an effort to avoid undesirable outcomes.

Case 2: NSSAA performed for an S-NSSAI that is in the allowed NSSAI list or is not in the pending NSSAI The UE may register with the network e.g. at initial registration, and get an allowed NSSAI with an S-NSSAI entry, say for example S-NSSAI X. The network may also provide a pending NSSAI list in the Registration Accept message for which NSSAA is to be performed.

The UE may then receive the Network Slice-Specific Authentication Complete message for an S-NSSAI, say S-NSSAI X, that is already in the allowed NSSAI list in the UE or is not in the pending NSSAI list in the UE. This is an abnormal case and the UE behaviour has not yet been defined to handle such a scenario.

Case 3: Unnecessary release of a NAS connection To avoid the unnecessarily maintenance of a NAS connection, the UE starts the timer T3540 in some cases to guard a maximum period of time during which the network is expected to release the NAS signalling connection. The cases for which the UE starts T3540 are described in section 5.3.1.3 of the NAS specification in [3].

However, the current conditions for the start of T3540 (which when expires will lead to the local release of the NAS connection in the UE), specifically associated with the registration procedure, are not complete and hence need to be updated. Otherwise the NAS connection may be released earlier than needed 4. Issue with prohibiting the service request procedure during NSSAA The AMF may indicate that NSSAA is pending by including the "NSSAA to be performed" indicator in the 5GS registration result IE and the AMF may include the Pending NSSAI IE without including the Allowed NSSAI IF in the Registration Accept message. In this case, the UE is not allowed to perform a service request procedure except for emergency services, or high priority access, or for responding to paging or notification over non-3GPP access.

However, the UE may be in 5GMM-CONNECTED mode over the non-3GPP access while NSSAA is ongoing. It is already an existing trigger that if the lower layer connection of the non3GPP access is lost, then the UE shall perform a service request procedure to re-establish the NAS connection when the lower layers (of the non-3GPP access) indicate that the connection has been regained as specified in section 5.6.1.1 of [3]: [ . SKIP.

This procedure is used when: -the UE in 5GMM-IDLE mode over non-3GPP access, receives an indication from the lower layers of non-3GPP access, that the access stratum connection is established between UE and network; or [ SKIP.

However, the prohibition of the service request procedure due to the ongoing NSSAA leads to contradictory requirement at the UE where: * on one hand the loss of the lower layer connection requires the initiation of the service request procedure, and * on the other hand the ongoing NSSAA procedure prohibits the initiation of the service request procedure as the loss of the lower layer connection is not one of the identified exceptions for initiating the service request procedure.

5. Fallback indication from lower layers and the UE has NSSAA Complete message to 15 send The UE in 5GMM-CONNECTED mode may receive a fallback indication from the lower layers as described in section 5.3.1.2 of the NAS specification in [3] (reproduced below for reference): When the UE in 5GMM-CONNECTED mode over 3GPP access receives a fallback indication from lower layers, and the UE has no pending NAS procedure and no pending uplink user data for PDU session(s) with user-plane resources already established, the UE shall: a) enter 53MM-1DLE mode; and b) initiate the registration procedure for mobility and periodic registration update and include the Uplink data status IE in the REGISTRATION REQUEST message indicating the PDU session(s) for which user-plane resources were active prior to receiving the fallback indication, if any (see subclause 5.5.1.3 for further details).

When the UE in 5GMM-CONNECTED mode over 3GPP access receives a fallback indication from lower layers, and the UE has pending uplink user data for PDU session(s) with user-plane resources already established but no pending NAS procedure, the UE shall: a) enter 53MM-1DLE mode, and b) initiate the service request procedure and include the Uplink data status IE in the SERVICE REQUEST message indicating the PDU session(s) for which user-plane resources were active prior to receiving the fallback indication (see subclause 5.6.1 for further details).

When the UE in 5GMM-CONNECTED mode over 3GPP access receives a fallback indication from lower layers, and the UE has a pending registration procedure, a service request procedure, or a de-registration procedure, the UE shall: a) enter 53MM-IDLE mode; b) proceed with the pending procedure; and c) if the pending procedure is a service request or registration procedure, the UE shall include the Uplink data status 1E in the SERVICE REQUEST message, or in the REGISTRATION REQUEST message, indicating the PDU session(s)for which user-plane resources were not active prior to receiving a fallback indication from the lower layers and the UE has pending user data to be sent over 3GPP access, if any, and the PDU session(s) for which user-plane resources were active prior to receiving the fallback indication, if any (see subclauses 5.5.1.3 and 56.1 for further details) When the UE in 5GMM-CONNECTED mode over 3GPP access receives a fallback indication from lower layers, and the UE has a pending NAS procedure other than a registration procedure, a service request procedure, or a de-registration procedure, the UE shall: a) enter 5GMM-1DLE mode; b) initiate the service request procedure and include the Uplink data status 1E in the SERVICE REQUEST message indicating the PDU session(s) for which user-plane resources were active prior to receiving the fallback indication, if any (see subdause 5.6.1 for further details); and c) upon successful service request procedure completion, proceed with any pending procedure.

The cases above apply when the UE is in an allowed area or when the UE is not in a non-allowed area.

When the UE: a) is in a non-allowed area or is not in an allowed area; b) is in 5GMM-CONNECTED mode over 3GPP access; c) receives a fallback indication from lower layers; and d) does not have signalling pending, the UE shall: a) enter 53MM-1DLE mode; and b) initiate the registration procedure for mobility and periodic registration update. The UE shall not include the Uplink data status IF in the REGISTRATION REQUEST message except if the PDU session for which user-plane resources were active is an emergency PDU session, or if the UE is configured for high priority access in the selected PLMN.

In the above cases when the UE receives a fallback indication from lower layers, if the UE is in non-allowed area or not in allowed area, the UE shall behave as specified in subclause 5.3.5.

A particular behaviour to note is that if the UE has a pending procedure that is not a registration procedure, not a service request procedure, and not a deregistration procedure, then after reception of a fallback indication from the lower layers the UE should initiate a service request procedure from idle mode and after the completion of the procedure the UE continues with the pending NAS procedure.

During a registration procedure, the UE may receive a pending NSSAI list in the Registration Accept message and the network may then start NSSAA. The UE may receive the Network Slice-Specific Authentication Command message and the UE may have to respond to this message and hence the UE has a pending NAS message that is not a registration procedure, not a service request procedure, and not a deregistrafion procedure. The UE may then receive a fallback indication from the lower layers. Since there are some requirements that the UE should not initiate a service request procedure during NSSAA, optionally when no allowed NSSAI is available in the UE, then the recovery from fallback would contradict that requirement. The UE behaviour needs to be defined in this case such that the proper recovery from fallback can occur.

6. Handling of timer T3346 when the UE receives a NAS message for NSSAA The UE may be in 5GM M-CONNECTED mode with the NAS congestion control timer T3346 running. The UE may then receive a Network Slice-Specific Authentication Command message for NSSAA. Currently, the UE does not stop the timer T3346 if it is running and this is an incorrect behaviour.

7. Impacts to NSSAA during a registration procedure for periodic updating The UE is not mandated to send the requested NSSAI during periodic registration which means that the NSSAI information that is requested by the UE has not changed since the last signalling or registration with the network. However, if the allowed NSSAI has changed for the UE, the AMF can provide a new allowed NSSAI in the Registration Accept message.

Currently, the providing an allowed NSSAI and/or a pending NSSAI to the UE during a registration procedure depends on whether or not the UE sent a requested NSSAI and the contents of the requested NSSAI. For example, the UE may not have any slice information for the current PLMN and hence may not send a requested NSSAI although the registration is not triggered due to periodic registration. In this case, the AMF will consider the default slices for the UE.

However as mentioned above, since the UE does not provide a requested NSSAI during periodic registration, the AMF may consider the default slices for the UE and therefore provide the wrong allowed NSSAI. Therefore, the current procedure for NSSAA needs to consider whether or not the UE is performing a periodic registration and determine the contents of the pending NSSAA accordingly. The current handling of the Registration Request message currently does not consider this aspect and hence needs to be updated for a correct handling and execution of the NSSAA procedure.

In view of the above problems, certain examples of the present disclosure provide one or more of the following solutions.

1. Solution to enable NSSAA during roaming cases (and non-roaming cases) As described above, the roaming UE may include the Requested mapped NSSAI IE in the Registration Request message and the S-NSSAI(s) included in this IE may be subject to NSSAA.

Therefore, it is proposed that the AMF should also consider and take into account the mapped S-NSSAI content in the Requested mapped NSSAI IE for NSSAA optionally in addition to the S-NSSAI entries of the Requested NSSAI IE if the latter is also included in the Registration Request message.

In addition to the current behaviour, the AMF should also perform the following actions: * If the UE does not support NSSAA, the UE sent the Requested mapped NSSAI IE in the Registration Request and the S-NSSAI entries in the IE are subject to NSSAA, and optionally the Requested NSSAI IE is not included in the Registration Request message, or o the Requested NSSAI IE is included in the Registration Request message and the entries in the Requested NSSAI IE are subject to NSSAA, then the AMF should reject the registration by sending the Registration Reject message and include the 5GMM cause #62 "No network slices available" and the AMF should also include the Rejected NSSAI IE. In this case, the SST field of the Rejected S-NSSAI should be set to the Mapped HPLMN SST that was included in the Requested mapped NSSAI 1E, and for which NSSAA is required, and the SD field of the Rejected S-NSSAI should be set to the Mapped HPLMN SD field if the latter was included in the Requested mapped NSSAI IE.

* If the entries in the Requested mapped NSSAI are not subject to NSSAA and the AM F's policy allows that these slices can be used by the UE and the associated PDU session is allowed to be transferred, then the AMF should include the corresponding S-NSSAI in the Allowed NSSAI IE and send the IE to the UE in the Registration Accept message.

* If the UE supports NSSAA and the UE included the Requested mapped NSSAI IE in the Registration Request message for which the entries in the Requested mapped NSSAI are subject to NSSAA, the AMF shall include the corresponding S-NSSAls in the Pending NSSAI IF and send the IF to the UE in the Registration Accept message.

Note that the Pending NSSAI IF may also include entries from the Requested NSSAI 1E if the latter was included by the UE in the Registration Request message.

* Wien rejecting a Registration Request message from the UE due to NSSAA, the AMF should also consider different cases i.e. it should consider whether the Requested mapped NSSAI IE is included or the Requested NSSAI IE is included in the message.

The AMF behaviour is proposed to be as follows: o If the Registration Request message included the Requested mapped NSSAI IE but did not include the Requested NSSAI IF and NSSAA is revoked or failed for all the entries in the Requested mapped NSSAI IE (or all the entries are rejected for the current registration area or rejected for the current PLMN), and optionally there is no entry for which the network allows the UE to use without NSSAA or there is no default S-NSSAI that is allowed for the UE, then the network shall send the Registration Reject and include the Rejected NSSAI IE. For each of the rejected S-NSSAI entry in the Rejected NSSAI 1E, the AMF should set the reject cause to "S-NSSAI is not available due to the failed or revoked network slice-specific authentication and authorization".

o If the Registration Request message included the Requested mapped NSSAI IE and also the Requested NSSAI 1E, and NSSAA is revoked or failed for all the entries in both IEs (or all the entries are rejected for the current registration area or rejected for the current PLMN), and optionally there is no entry in any of these IEs for which the network allows the UE to use without NSSAA or there is no default S-NSSAI that is allowed for the UE, then the network shall send the Registration Reject and include the Rejected NSSAI IE. For each of the rejected S-NSSAI entry in the Rejected NSSAI 1E, the AM F should set the reject cause to "S-NSSAI is not available due to the failed or revoked network slice-specific authentication and authorization". The Deregistration Request message should include the 53MM cause indicating #62 "No network slices available".

o When the AMF sends the Rejected NSSAI IE due to failure of NSSAA, or S revocation of NSSAA, or the UE does not support NSSAA but all the S-NSSAls that the UE requested (either in the Requested mapped NSSAI 1E, or in the Requested NSSAI 1E, or both) are subject to NSSAA, then the entries in the Rejected NSSAI IE shall be set to the mapped S-NSSAI (i.e. the S-NSSAI of the HPLMN). The Registration Reject message should include the 53MM cause indicating #62 "No network slices available".

o Alternatively, when any of the above occurs for a UE in connected mode, i.e. when the AMF considers the contents of the Requested mapped NSSAI IE and/or the contents of the Requested NSSAI 1E, and NSSAA fails for all the entries in the IEs, and optionally there is no default slices that are allowed for the UE, or optionally there entries in the I Es are rejected for the current PLMN or registration area, then the AMF should send the Deregistrafion Request message and set the 5GMM cause to #62 "No network slices available". The AMF should also include the rejected NSSAI.

When NSSAA is to be performed, the UE may receive the Registration Accept message with a Pending NSSAI IE and optionally an Allowed NSSAI IE. According to current behaviour, if the UE receives the Allowed NSSAI IE for which there is no match between the S-NSSAI entries and the S-NSSAI that is associated with a PDU session, or between the mapped SNSSAI (of the allowed NSSAI entries) and the mapped S-NSSAI that is associated with a PDU session, then the UE will locally release the PDU session for which there is no match as described above.

However, during NSSAA, an S-NSSAI that is associated with a PDU session may not be in the Allowed NSSAI IE but may be in the Pending NSSAI IE. Therefore the UE which supports NSSAA should not ignore the contents of the Pending NSSAI IE before concluding or determining that a PDU session should be released. Therefore it is proposed that: * If the UE receives an Allowed NSSAI IF and a Pending NSSAI 1E, then even if there is no match between the: o S-NSSAls in the Allowed NSSAI IE and the S-NSSAI for each and every PDU session, or o Mapped S-NSSAI of the entries in the Allowed NSSAI IE and the mapped SNSSAI for each and every PDU session, then the UE shall check for a match, as described above i.e. between: o the S-NSSAI entries in the Pending S-NSSAI IF and the S-NSSAI of each and every PDU session, or o mapped S-NSSAI of the entries in the Pending NSSAI IE and the mapped SNSSAI for each and every PDU session.

If there is a match, then the UE shall not release the PDU session for which the match occurred and shall wait to determine if the session should be released after NSSAA completes and after the UE gets the Allowed NSSAI IE for which it should perform the check again. Optionally the UE performs the check again (e.g. on the allowed NSSAI entries) after the pending NSSAI list is empty.

If there is no match, as described above, with any entry of the Pending NSSAI 1E, then the UE should (for each PDU session for which a match did not occur) release the PDU session locally except for persistent PDU sessions or a PDU session for emergency services.

* If the UE does not receive the Allowed NSSAI IE but receives the Pending NSSAI 1E, then the UE should maintain the PDU session until the Allowed NSSAI IF is received after which the UE performs the check as described above and determine whether or not a PDU session should be released.

o Alternatively, the UE should perform the check against the entries in the Pending NSSAI IF as described above i.e. the UE checks for a match between: * the S-NSSAI entries in the Pending S-NSSAI IE and the S-NSSAI of each and every PDU session, or * mapped S-NSSAI of the entries in the Pending NSSAI IE and the mapped S-NSSAI for each and every PDU session.

If there is a match, the UE maintains the PDU session for which the match occurred until the Allowed NSSAI IF is received after which the UE performs the check again and then determines whether or not a PDU session should be released.

If there is no match, as described above, with any entry of the Pending NSSAI 1E, then the UE should release the PDU session locally except for persistent PDU sessions or a PDU session for emergency services.

The proposal above can also be achieved by the following checks at the UE: With respect to each of the PDU session(s) active in the UE, if the UE does indicate support for network slice-specific authentication and authorization and: 1) if the UE received a pending NSSAI but no allowed NSSAI, and every mapped S-NSSAI in the pending NSSAI does not match with the mapped S-NSSAI of the PDU session; 2) if the UE received a pending NSSAI and an allowed NSSAI, and i) the allowed NSSAI contains neither: A) an S-NSSAI matching to the S-NSSAI of the PDU session; nor B) a mapped S-NSSAI matching to the mapped S-NSSAI of the PDU session; and ii) every mapped S-NSSAI in the pending NSSAI does not match with the mapped S-NSSAI of the PDU session; or 3) if the UE received an allowed NSSAI but no pending NSSAI, and the allowed NSSAI contains neither: i) an S-NSSAI matching to the S-NSSAI of the PDU session; nor fi) a mapped S-NSSAI matching to the mapped S-NSSAI of the PDU session; the UE shall perform a local release of all such PDU sessions except for an emergency PDU session, if any.

Optionally, the UE should always maintain the PDU sessions as long as the UE has a pending NSSAI that is not empty, or optionally as long as the 5G3 registration result IE indicates "NSSAA to be performed". When the UE receives an allowed NSSAI and/or rejected NSSAI such that as part of storing this information the UE's pending NSSAI becomes empty, the UE then performs the check against the allowed NSSAI (as currently specified in TS 24.501 and also described above) to determine if the session should be maintained or not In other words, the UE maintains the PDU sessions until the UE receives an allowed NSSAI and/or the UE's pending NSSAI is empty, and then the UE checks the allowed NSSAI for a match between the: * S-NSSAls in the Allowed NSSAI IE and the S-NSSAI for each and every PDU session, Or * Mapped S-NSSAI of the entries in the Allowed NSSAI IE and the mapped S-NSSAI for each and every PDU session.

If there is no match as described above, then the UE releases the PDU session for which there is no match, except a PDU session for emergency services or high priority access.

Note that the proposals above apply even for non-roaming cases i.e. even if the UE did not send the Requested mapped NSSAI IE. Note that the above proposals also apply for the case when the UE performs an inter-system change from Si mode (i.e. from EPS) to Ni mode (i.e. to 53S) and optionally when the N26 interface is supported in the system.

Moreover, the check as described above can also be made between what the UE sends in the {Requested NSSAI IE or the Requested mapped NSSAI 1E} and the entries of {the Allowed NSSAI IE or the Pending NSSAI IE}.

Note that some or all of the checks above (i.e. the checks in the UE to determine whether or not a PDU session should be locally released based on the received NSSAI information) should also be performed when the UE receives the same information or a subset of the information (i.e. allowed NSSAI only, or pending NSSAI only, or both allowed NSSAI and pending NSSAI) in the Configuration Update Command message.

Note that the term "mapped S-NSSAI in the pending NSSAI" also refers to an S-NSSAI entry in the pending NSSAI.

2. Solution to handle collisions between NSSAA procedure and other procedures Case 1: solution for collision between an authentication procedure and NSSAA procedure As described above, during NSSAA, the network may initiate an NSSAA procedure and then initiate an authentication procedure.

If the UE receives the Network Slice-Specific Authentication Command message over any access type (e.g. 3GPP access or non-3GPP access) and (approximately at the same time or shortly after) the UE also receives the Authentication Request message over any access type (e.g. 3GPP access or non-3GPP access), where the access type over which one of the NAS messages is not necessarily the same as the access type over which the other NAS message is received, then the UE should ignore or abort the NSSAA procedure (i.e. ignore the Network Slice-Specific Authentication Command message) and continue with the authentication procedure (i.e. process the Authentication Request message). Alternatively, the UE should first process the Authentication Request message and first successfully complete the procedure for authentication and optionally for security mode control before responding to the Network Slice-Specific Authentication Command message. In this case, the UE should only send the Network Slice-Specific Authentication Complete message after sending the Authentication Response or Security Mode Complete message.

Note that the proposal above applies to a collision between the NSSAA procedure and a security control procedure.

Hence if the UE receives a Network Slice-Specific Authentication Command message over an access type and (approximately at the same time or shortly after) the UE also receives a Security Mode Command message over the same access type then the UE should prioritize handling the Security Mode Command message (i.e. should prioritize the security mode control procedure) over the Network Slice-Specific Authentication Command message (i.e. over the NSSAA procedure). The UE may ignore the Network Slice-Specific Authentication Command message (i.e. ignore or abort the NSSAA procedure) and process the Security Mode Command message (i.e. continue with the security mode control procedure). Alternatively the UE may first complete the ongoing security mode control procedure and after the successful completion of the procedure (i.e. after the UE sends the Security Mode Complete message) the UE can then process the Network Slice-Specific Authentication Command message and potentially respond with the Network Slice-Specific Authentication Complete message.

Case 2: solution for collision between a generic UE configuration update procedure and 15 NSSAA procedure As described above, during NSSAA, the network may initiate an NSSAA procedure and then initiate a generic UE configuration update procedure. If the UE receives the Network Slice-Specific Authentication Command message over any access type (e.g. 3GPP access or non3GPP access) and (approximately at the same time or shortly after) the UE also receives the Configuration Update Command message over any access type (e.g. 3GPP access or non3GPP access), where the access type over which one of the NAS messages is not necessarily the same as the access type over which the other NAS message is received, and if the Configuration Update Command message indicates that a registration is required (e.g. with the "registration requested" bit of the Configuration update indication IF or any other means that can be used to indicate that a registration is required) then the UE should ignore or abort the NSSAA procedure (i.e. ignore the Network Slice-Specific Authentication Command message) and proceed with the generic UE configuration update procedure (i.e. process the Configuration Update Command message).

* Alternatively, the proposal above should be applied if the Configuration Update Command message does not contain any parameter other than the indication to register (e.g. the message contains no other IE except the Configuration update indication 1E).

* Alternatively, the proposal above should be applied if the Configuration Update Command message indicates that a registration is required and the message also includes the Network slicing indication IE with the NSSCI bit (see [3]) set to "Network slicing subscription changed".

* Alternatively the proposal above should not apply, i.e. the UE continues with both the NSSAA procedure and the generic UE configuration update procedure, if the UE is requested to perform a registration while in connected mode e.g. when the MICO indication IF is present in the Configuration Update Command message. Note that the presence of the MICO indication IE is an example of when the UE is requested to perform a registration procedure in connected mode but there can be other cases for which the UE is requested to perform a registration in connected mode and for these cases the proposal above does not apply.

o Note: "the proposal above should not apply" means that the UE does not ignore the NSSAA procedure and the UE continues to process both the Network Slice-Specific Authentication Command message and the Configuration Update Command message and none of the procedures is aborted.

Case 3: solution for collision between a service request procedure and NSSAA procedure As described above, during an ongoing NSSAA procedure e.g. over the 3GPP access, the UE may initiate the service request procedure over the non-3GPP procedure.

When the AMF receives a Service Request message over the non-3GPP access from a UE that is in 5GMM-CONNECTED mode over the non-3GPP access, if the: * AMF has initiated NSSAA for the UE over the same or a different access, * And optionally the AMF has sent the Registration Accept message (prior to the start of NSSAA) to the UE over a different access where the message contains a Pending NSSAI IF and the 5GS registration result IF indicating "NSSAA to be performed", and the message does not contain the Allowed NSSAI 1E, * And the AM F receives a Service Request message from the UE over the non-3GPP access, optionally from a UE that is in 5GMM-CONNECTED mode, and optionally the Service Request message includes the Uplink data status 1E, then the AMF should abort the service request procedure (i.e. ignore the Service Request message) and proceed with the NSSAA procedure (i.e. send the Network Slice-Specific 30 Authentication Command message to the UE if not yet sent, or process the Network Slice-Specific Authentication Complete message from the UE if received).

Otherwise, if the conditions above are not met, the AMF may process both procedures simultaneously.

3. Handling of abnormal cases Case 1: Transmission failure of the NETWORK SLICE-SPECIFIC AUTHENTICATION COMPLETE message with TAI change from lower layers As specified in [3], when the identified abnormal case occurs, the UE aborts the network slice-specific authentication and authorization procedure and a registration procedure for mobility and periodic registration update indicating "mobility registration updating" in the 5G5 registration type IE of the REGISTRATION REQUEST message shall be initiated. In this case, the UE shall also include the Requested NSSAI IE or the Requested mapped NSSAI 1E, or both I Es, even if the S-NSSAI entries that constitute these IEs are in the Pending NSSAI IE.

Alternatively the IEs should be included if in the previous or last registration procedure the UE had sent a Requested NSSAI IF or the Requested mapped NSSAI 1E, or both IEs, even if the UE has a pending NSSAI list for which the S-NSSAI entries were previously included in Requested NSSAI IE or the Requested mapped NSSAI 1E, or both IEs.

Case 2: NSSAA performed for an S-NSSAI that is in the allowed NSSAI list or is not in the 15 pending NSSAI The UE may perform a registration procedure, e.g. for initial registration, and the UE may get an allowed NSSAI in the Registration Accept message that may include a pending NSSAI.

After the registration procedure completes, the AMF may initiate NSSAA and send the Network Slice-Specific Authentication Command message and the S-NSSAI field set to a value that is either in the allowed NSSAI or is not in the pending NSSAI. When this occurs, optionally after an initial registration, the UE should consider this as an abnormal case or an error.

When the UE considers a Network Slice-Specific Authentication Command message as problematic or erroneous or as an abnormal case, such as but not limited to the example scenario discussed above, the UE should send the 5GMM Status message to the AMF as defined in [3]. In this case, the UE can use a new 53MM cause code that is indicative of an error with NSSAA e.g. "Network Slice-Specific Authorization and Authentication Error". Note that this is an example 53MM cause code but any other value can be defined for this purpose.

Alternatively, a new 53MM message can be used for this purpose. For example a new Network Slice-Specific Authentication Reject message can be defined to report an error or abnormal case such as the scenario described above. The new message should include at least the S-NSSAI that was received in the corresponding Network Slice-Specific Authentication Command message, a 53MM cause and optionally an EAP message. The EAP message may be the same message that was received in the corresponding Network Slice-Specific Authentication Command message.

When the UE sends either the 5GMM Status message or the new NAS message as proposed above, the UE may optionally send the list of allowed NSSAI and pending NSSAI to the AMF to inform the AMF of the S-NSSAls that are available in the UE for each list. The proposed new message is shown in Table 1 below.

Table 1: NETWORK SLICE-SPECIFIC AUTHENTICATION REJECT message content 1E1 Information Element Type/Reference Presence Format Length Extended protocol discriminator Extended protocol discriminator 9.2 M V 1 Security header type Security header type 9.3 M V 1/2 Spare half octet Spare half octet 9.5 M V 1/2 NETWORK SLICE-SPECIFIC Message type 9.7 M V 1

AUTHENTICATION RESULT

message identity S-NSSAI S-NSSAI M LV 2-5 9.11.2.8 EAP message EAP message M LV-E 6-1502 9.11.2.2 Allowed NSSAI NSSAI 0 TLV 4-74 9.11.3.37 Pending NSSAI NSSAI 0 TLV 4-74 9.11.3.37 Rejected NSSAI Rejected NSSAI 0 TLV 4-42 9.11.3.46 Note that the IEs in the message above may be optional (identified by "0" in the Presence column) although some are shown as mandatory (identified by "M" in the Presence column), or vice versa.

When the AMF receives the new message or the 5GMM Status message as proposed above with the new 5GMM cause code, the AMF should re-initiate the NSSAA procedure with the correct S-NSSAI. If the 5GMM cause code indicates that the S-NSSAI is incorrect, then the AMF should re-initiate NSSAA with the correct S-NSSAI optionally by ensuring that the 5-NSSAI used is actually part of the pending NSSAI list in the UE, where the latter may also have been received by the AMF.

It may be possible that running NSSAA for an S-NSSAI which is not in the pending NSSAI list is not an error or abnormal case. For example, this can occur for a default S-NSSAI(s) that the UE did not request but the AMF needs to perform NSSAA for. Therefore, an alternative approach would be for the UE to continue processing the related NSSAA message even if the S-NSSAI for which NSSAA is being performed is not in the pending NSSAI (or optionally is in the allowed NSSAI).

Another way to indicate to the UE that the NSSAA procedure is not erroneous it to include a new indication in the Network Slice-Specific Authentication Command message such that the recipient (e.g. the UE) is informed about the procedure being intentional i.e. is not an error. The indication can be in any form such as defining an operation type where the operation may be set to e.g. "initial NSSAA", "re-authentication", "NSSAA for default slice", etc. This indication can be in the form of a new IE. Note that this indication can be used in general to indicate to the UE why the specific NSSAA message is being sent. The UE can use this indication to identify whether the message being sent is for initial NSSAA or re-run of NSSAA, etc, and hence the UE can take specific actions based on this. For example, if the network is performing re-authentication for a certain S-NSSAI that is in the allowed NSSAI, the UE may block 5GSM requests that are associated with that S-NSSAI given the UE knows that the NSSAA procedure is a re-run and hence the UE does not consider it to be an error.

Currently the involvement of the UE, specifically the 53MM entity in the UE, for NSSAA is that the NAS forwards the contents of the NETWORK SLICE-SPECIFIC SESSION AUTHENTICATION COMMAND message to the upper layers. However, it may be good for the UE (or NAS or 53MM entity) to take other actions such as ensuring that the S-NSSAI received in the message is part of any combination of: * the pending NSSAI list * the allowed NSSAI * the rejected NSSAI The UE can then take any of the proposed action when a condition for the check occurs.

Alternatively, the UE can also check if the S-NSSAI is not part of the allowed NSSAI and also not part of the pending NSSAI, and if so then the UE may consider this an error and take any of the proposed actions above.

Note that if the AMF receives a NETWORK SLICE-SPECIFIC SESSION AUTHENTICATION COMPLETE message and the S-NSSAI that is included in the message is not valid e.g. it does not match any of the S-NSSAls for which NSSAA is ongoing or it is not part of the SNSSAls for which NSSAA is being performed, or it is not part of the pending NSSAI list in the AMF, the AMF shall ignore or discard the received message and re-transmit the NETWORK SLICE-SPECIFIC SESSION AUTHENTICATION COMMAND message with a valid S-NSSAI (i.e. one for which NSSAA is ongoing or is not yet complete or one that is not the same as what is known to be invalid). Note that this requires that the AMF stores and compares the 5NSSAI sent in the NETWORK SLICE-SPECIFIC SESSION AUTHENTICATION COMMAND message with the S-NSSAI that is received in the NETWORK SLICE-SPECIFIC SESSION AUTHENTICATION COMPLETE message. When there is no match or when the S-NSSAI received in the NETWORK SLICE-SPECIFIC SESSION AUTHENTICATION COMPLETE message is not part of the S-NSSAI for which NSSAA is ongoing (as described in different ways above), the AMF should ignore the received message or optionally abort the existing procedure and resend the NETWORK SLICE-SPECIFIC SESSION AUTHENTICATION COMMAND message with the desired and valid S-NSSAI.

Note that in this entire document, the term "NSSAA to be performed" is synonymous with receiving the 5G5 registration result IE with the "NSSAA to be performed" indicator set to "Network slice-specific authentication and authorization is to be performed".

Case 3: Unnecessary release of a NAS connection To ensure that T3540 is started correctly during a registration procedure, in addition to what is specified in section 5.3.1.3 of the NAS specification in [3] for case (b) (i.e. reception of Registration Accept by the UE), the UE has to also check for the following conditions: * Whether the Registration Accept message indicates "NSSAA to be performed" in the 5GS registration result 1E, or * Whether the Registration Accept message includes a pending NSSAI (i.e. does not include the Pending NSSAI 1E).

If the Registration Accept: * indicates "NSSAA to be performed" in the 5GS registration result 1E, or * includes a pending NSSAI (i.e. does not include the Pending NSSAI 1E), then the UE should not start T3540.

If T3540 is running in the UE, then upon reception of the Network Slice-Specific Authentication Command message the UE should stop T3540.

4. Allowing some procedures when NSSAA is ongoing The UE may be in 5GMM-CONNECTED mode at least over the non-3GPP access, and optionally over the 3GPP access, and the AMF may be performing an NSSAA procedure over the non-3GPP access or optionally over the 3GPP access. The UE may have received a Pending NSSAI IE in the Registration Accept message but no Allowed NSSAI IE and the 5G5 registration result IE may have indicated "NSSAA to be performed".

While NSSAA is ongoing, the UE may lose its lower layer connection over the non-3GPP access. When the connection is regained, the NAS may receive an indication from the lower layers of non-3GPP access that the access stratum connection is established between UE and network. Although NSSAA is ongoing the UE should send initiate the service request procedure and send the Service Request message over the non-3GPP access even if NSSAA is ongoing with the conditions above.

The above can also be achieved by enforcing a restriction on the UE regarding the service request procedure such that the UE should not initiate the service request procedure (i.e. should not send the Service Request message) during an ongoing NSSAA procedure (optionally if the UE has received a pending NSSAI, and has not received an allowed NSSAI, and the 5GS registration result IE indicates "NSSAA to be performed") from 5GMMCONNECTED mode. Therefore, the restriction does not apply to a UE in 5GMM-IDLE mode. Thus when the UE in 5GMM-IDLE mode over the non-3GPP access receives an indication from the lower layers of non-3GPP access that the access stratum connection is established between UE and network then the UE would be able, and should, send the Service Request message over the non-3GPP access to establish the NAS connection with the network. The UE should send the Service Request message even if NSSAA is ongoing over the 3GPP access with the conditions above (regarding what the UE received, or did not receive, in the Registration Accept message e.g. even if the UE did not received an allowed NSSAI in the Registration Accept message). Note that the proposal applies to both initial registration and registration for mobility and periodic updating.

Note that the UE should be allowed to send the Service Request message in 53MMCONNECTED mode if the UE is doing so for the purpose of requesting the establishment of user plane resources for a PDU session for emergency services or for a PDU session for which the UE has exception data reporting to send. Similarly the UE should be allowed to send data over the control plane (i.e. to send UL NAS TRANSPORT message with CloT user data or location services, or optionally SMS) when the UE is doing so for exception data reporting or if the UE is a high priority access UE.

Alternatively, when the NAS receives an indication from the lower layers of non-3GPP access that the access stratum connection is established between UE and network, the UE should send a Registration Request message instead of a service request procedure. The UE should include the Requested NSSAI 1E, or the Requested mapped NSSAI 1E, or both, if the UE had included one or both of these IEs during the last registration procedure (or if the UE has slice information for the current PLMN) even if the S-NSSAls are included in the current pending NSSAI list in the UE.

Note that proposals above can also apply during any other procedure and are not limited to the registration procedure. For example, if in the future the Configuration Update Command message can be used to provide the UE with a pending NSSAI and optionally no allowed NSSAI, and optionally based on the contents of the message the UE considers that it has no valid allowed NSSAI, then if the lower layer connection fails and later gets established (as described above), the proposals above would still apply. Hence the proposals are not limited to the registration procedure only and should apply during any procedure or at any time in connected mode at which the UE determines that it has no allowed NSSAI.

The NAS specification [3] already allows the UE to initiate a 5GSM procedure e.g. PDU session establishment procedure, during NSSAA when the conditions above are met (i.e. the UE received a Pending NSSAI IE in the Registration Accept message but no Allowed NSSAI IE and the 5GS registration result IE may have indicated "NSSAA to be performed"). However, if the UE does send a PDU Session Establishment Request message (in the UL NAS TRANSPORT message) then the UE should not include the S-NSSAI IF in the UL NAS TRASN PORT message since the UE does not have an allowed NSSAI yet. Alternatively, the UE may include the S-NSSAI IF and set it to a pre-configured value in the UE.

5. Recovery from fallback during NSSAA As explained above, the UE may receive a fallback indication during NSSAA and hence the UE has a pending NAS procedure (e.g. the UE may need to send a NAS message in response to the Network Slice-Specific Authentication Command message). When the fallback occurs, the UE can take any of the following measures as a proposal to recover from fallback: * The UE should be allowed to initiate a service request procedure (i.e. send a Service Request message) to recover from fallback as currently specified. To allow this, the current restriction that the service request procedure should not be allowed during NSSAA needs to be updated such that more exceptions are defined to solve this problem. For example, the restriction (prohibiting the UE from initiating a service request procedure during NSSAA) should not apply to the service request procedure that is being initiated from 5GMM-IDLE mode. Thus, the UE with a pending NSSAI and during an NSSAA procedure (optionally if the UE does not have an allowed NSSAI, or if the UE received the "NSSAA to be performed indicator" indicating that NSSAA is to be performed) should be allowed to send a Service Request message from 5GMMIDLE mode to recover from fallback.

o Optionally the above should be allowed only if the UE has already registered to the system, or if the NSSAA is being performed following a registration procedure with the 5GS registration type IE set to "mobility registration updating" or "periodic registration updating".

S o Optionally, when sending the Service Request message the UE should not include the Uplink data status IE unless if the corresponding PDU session (for which a particular bit is set to one in the 1E) is associated with an S-NSSAI that is in the allowed NSSAI, or associated with an S-NSSAI for which NSSAA is not ongoing, or the PDU session is an always on PDU session, or if the PDU session had user plane resources established prior to the fallback indication * Alternatively, if in order to recover from the fallback, the UE should send the Registration Request message with the 5GS registration type IF set to "mobility registration updating". The UE is allowed to include the Requested NSSAI IE or the Requested mapped NSSAI IE in the Registration Request that is transmitted to recover from fallback even if the entries are in the pending NSSAI or even if the UE has a pending NSSAI.

Note that the proposal above should also apply at any time when the UE is in connected mode and NSSAA is ongoing and the UE receives a fallback indication. Hence, the proposed UE behaviour is not restricted to the scenario occurring only during a registration procedure. The proposals still apply if other procedures are ongoing or in general for a UE that is connected mode.

o Optionally, when sending the Service Request message the UE should not include the Uplink data status IE unless if the corresponding PDU session (for which a particular bit is set to one in the 1E) is associated with an S-NSSAI that is in the allowed NSSAI, or associated with an S-NSSAI for which NSSAA is not ongoing, or the PDU session is an always on PDU session.

When the AMF receives either the Service Request message or the Registration Request message as proposed above, and the AMF has an ongoing NSSAA procedure, the AMF should process the Service Request message or Registration Request message and optionally abort the NSSAA procedure. The AM F may determine to do so based on the fact that the NAS message is received as an initial NAS message from the N2 interface and protocol that runs between the NG-RAN and the AMF.

6. Stopping of timer 13346 when the UE receives a NAS message for NSSAA It is proposed that the UE should stop T3346, if running, upon the reception of a Network Slice-Specific Authentication Command message. Hence, upon reception of a NETWORK SLICE-SPECIFIC AUTHENTICATION COMMAND message, the UE shall stop the timer T3346 if running.

7. Solution for considering the type of registration update for NSSAA It is proposed that the current handling of NSSAA be performed only when the 5G5 registration type IE indicates "mobility registration updating" in the Registration Request message optionally when the NAS message is received from a UE that is not in NB-N1 mode. Therefore the AMF should take the actions that are currently specified in IS 24.501 if the 5G5 registration type IE indicates "mobility registration updating" in the Registration Request message optionally when the NAS message is received from a UE that is not in NB-N1 mode.

The AMF may have new NSSAI information for the UE i.e. the allowed NSSAI that was previously sent to the UE may have changed. The new NSSAI that the UE can use may also require NSSAA to be performed. In fact the AMF may be required, due to internal policy or as requested by the NSSAA related AAA server, to re-initiate NSSAA for the UE. The UE may then send a Registration Request with the 5GS registration type IE indicating "periodic registration updating", or "mobility registration updating" for the UE that is in NB-N1 mode. The following is therefore proposed: * The AMF need not take any actions if the allowed NSSAI has not changed for the UE and NSSAA is not required to be re-initiated for the UE.

* If the allowed NSSAI (or S-NSSAls that the UE is allowed to use) has changed, and at least one of the new S-NSSAls requires NSSAA, the AMF should: o Send the allowed NSSAI to the UE where the allowed NSSAI contains the 5-NSSAls for which re-initiation of NSSAA is not required, if any, or o Send the pending NSSAI containing the S-NSSAls for which NSSAA needs to be re-initiated. Additionally, if no allowed NSSAI can be provided to the UE, the AMF shall also set the "NSSAA to be performed" indicator in the 5GS registration result IE. The contents of the pending NSSAI may also include the default slices (i.e. the slices that are marked as default slices in the subscription information of the UE and that require NSSAA to be initiated or re-initiated).

During a periodic registration procedure (i.e. the 5GS registration type IE indicates "periodic registration updating"), or during a registration procedure for which the 5GS registration type IE is set to "mobility registration updating", the UE may receive a pending NSSAI in the Registration Accept message. The UE behaves in the similar manner as is currently specified when the same information is received in a Registration Accept message as part of a registration procedure that is not triggered for periodic updating.

If the 5GS registration result IE indicates "NSSAA to be performed" in REGISTRATION ACCEPT message, and the 5GS registration type IE in the REGISTRATION REQUEST message indicated: a) "periodic registration updating" (i.e. the procedure was triggered due to periodic registration update); or b) "mobility registration updating" and the UE is in NB-N1 mode (i.e. the procedure was not triggered by the NB-Ni mode UE for periodic registration update); the UE shall consider the previous stored allowed NSSAI as invalid i.e. the UE shall delete any stored allowed NSSAI.

Note that the proposal above i.e. to consider the stored allowed NSSAI as invalid can alternatively also apply to all UEs that send a Registration Request message with 5GS registration type IE set to "mobility registration updating" and the UE then gets the 5GS registration result IE indicating "NSSAA to be performed" in REGISTRATION ACCEPT message.

It should be noted that in the entire document, the term "NSSAA to be performed" is synonymous with the "NSSAA to be performed indicator" that is set to the value "Network slice-specific authentication and authorization is to be performed".

Note that the AMF can also reject the UE's Registration Request message, for which the 5GS registration type IE indicates "periodic registration updating" (i.e. the procedure was triggered due to periodic registration update) or indicates "mobility registration updating" and the UE is in NB-N1 mode (i.e. the procedure was not triggered by the NB-N1 mode UE for periodic registration update) if NSSAA is revoked for all the slices although the UE did not send the Requested NSSAI IE (or the Requested mapped NSSAI 1E) in the Registration Request message. The AMF takes the same behaviour as has been proposed earlier in this document (for the case when the AMF needs to consider the Requested mapped NSSAI IE and/or the Requested NSSAI 1E).

Certain examples of the present disclosure provide a method, for a network entity (e.g. an AMF entity), the method comprising: if an allowed NSSAI for a UE has changed from an allowed NSSAI that was previously sent to the UE, and at least one new S-NSSAI requires NSSAA, sending, to the UE: an allowed NSSAI containing S-NSSAls for which a re-initiation of NSSAA is not required, and/or a pending NSSAI containing S-NSSAls for which NSSAA needs to be re-initiated. The skilled person will appreciate that this technique may be applied to the cases described above under Item 7 (i.e. the UE is performing periodic update, or the NB-N1 mode UE is sending registration request for mobility updating). In either case, the AMF does not receive a requested NSSAI and hence certain examples send: (a) an allowed NSSAI with slices that are allowed to use, (b) pending NSSAI if NSSAA is requires for some (potentially new) slices.

Certain examples of the present disclosure provide a method, for a network entity (e.g. an AMF entity), the method comprising: if an allowed NSSAI for a UE has changed from an allowed NSSAI that was previously sent to the UE, and at least one new S-NSSAI requires NSSAA, sending, to the UE: an allowed NSSAI containing S-NSSAls for which a re-initiation of NSSAA is not required, and/or a pending NSSAI containing S-NSSAls for which NSSAA needs to be re-initiated. The skilled person will appreciate that this technique may be generalised to all types of registration requests for which the UE will set the allowed NSSAI as invalid if "NSSAA to be performed" is received.

Figure 6 is a block diagram of an exemplary network entity that may be used in examples of the present disclosure. For example, the UE and/or AMF may be provided in the form of the network entity illustrated in Figure 6. The skilled person will appreciate that the network entity illustrated in Figure 6 may be implemented, for example, as a network element on a dedicated hardware, as a software instance running on a dedicated hardware, or as a virtualised function instantiated on an appropriate platform, e.g. on a cloud infrastructure.

The entity 600 comprises a processor (or controller) 601, a transmitter 603 and a receiver 605. The receiver 605 is configured for receiving one or more messages or signals from one or more other network entities. The transmitter 603 is configured for transmitting one or more messages or signals to one or more other network entities. The processor 601 is configured for performing one or more operations and/or functions as described above. For example, the processor 601 may be configured for performing the operations of a UE or AMF.

The techniques described herein may be implemented using any suitably configured apparatus and/or system. Such an apparatus and/or system may be configured to perform a method according to any aspect, embodiment, example or claim disclosed herein. Such an apparatus may comprise one or more elements, for example one or more of receivers, transmitters, transceivers, processors, controllers, modules, units, and the like, each element configured to perform one or more corresponding processes, operations and/or method steps for implementing the techniques described herein. For example, an operation/function of X may be performed by a module configured to perform X (or an X-module). The one or more elements may be implemented in the form of hardware, software, or any combination of hardware and software.

It will be appreciated that examples of the present disclosure may be implemented in the form of hardware, software or any combination of hardware and software. Any such software may be stored in the form of volatile or non-volatile storage, for example a storage device like a ROM, whether erasable or rewritable or not, or in the form of memory such as, for example, RAM, memory chips, device or integrated circuits or on an optically or magnetically readable medium such as, for example, a CD, DVD, magnetic disk or magnetic tape or the like.

It will be appreciated that the storage devices and storage media are embodiments of machine-readable storage that are suitable for storing a program or programs comprising instructions that, when executed, implement certain examples of the present disclosure.

Accordingly, certain example provide a program comprising code for implementing a method, apparatus or system according to any example, embodiment, aspect and/or claim disclosed herein, and/or a machine-readable storage storing such a program. Still further, such programs may be conveyed electronically via any medium, for example a communication signal carried over a wired or wireless connection.

While the invention has been shown and described with reference to certain examples, it will be understood by those skilled in the art that various changes in form and detail may be made therein without departing from the scope of the invention, as defined by any appended claims.

In accordance with a first aspect, there is provided a method, for a network entity (e.g. an AMF entity), the method comprising: receiving, from a UE, a registration request message; identifying one or more first S-NSSAI included in a Requested mapped S-NSSAI IE in the registration request message; and transmitting, to the UE, a message in response to the registration request message in consideration of the first S-NSSAI.

In accordance with a second aspect, there is provided a method according to the first aspect, wherein transmitting the message comprises: transmitting a registration reject message if a first condition is satisfied, wherein the first condition comprises: the first S-NSSAI are subject to NSSAA and the UE does not support NSSAA.

In accordance with a third aspect, there is provided a method according to the second aspect, wherein the registration reject message includes one or more of: an indication that no network slices are available; and a Rejected NSSAI IF including: an SST field set to a Mapped HPLMN SST that was included in the Requested mapped NSSAI 1E, and for which NSSAA is required; and if the Requested mapped NSSAI IE included a Mapped HPLMN SD field, an SD field set to the Mapped HPLMN SD field value of the Requested mapped NSSAI IE.

In accordance with a fourth aspect, there is provided a method according to the first aspect, wherein transmitting the message comprises: transmitting a registration accept message including the first S-NSSAI in an Allowed NSSAI IE of the registration accept message if a second condition is satisfied, wherein the second condition comprises: the first S-NSSAI are not subject to NSSAA.

In accordance with a fifth aspect, there is provided a method according to the fourth aspect, wherein the second condition further comprises one or more of: a policy of the network entity allows use, by the UE, of the slices corresponding to the first S-NSSAI; and the PDU sessions associated with the first S-NSSAI are allowed to be transferred.

In accordance with a sixth aspect, there is provided a method according to the first aspect, wherein transmitting the message comprises: transmitting a registration accept message including the first S-NSSAI in a pending NSSAI IF of the registration accept message if a third condition is satisfied, wherein the third condition comprises: the first S-NSSAI are subject to NSSAA and the UE supports NSSAA.

In accordance with a seventh aspect, there is provided a method according to the sixth aspect, wherein, if the registration request message includes a Requested NSSAI 1E, the Pending NSSAI IE of the registration accept message includes S-NSSAI included in the Requested NSSAI IE.

In accordance with an eighth aspect, there is provided a method, for a UE, the method comprising: transmitting, to a network entity (e.g. an AMF entity), a registration request message including one or more first S-NSSAI in one or more IEs (e.g. a Requested mapped S-NSSAI IF and/or a Requested S-NSSAI 1E) of the registration request message; receiving, from the network entity, a registration response message in response to the registration request message; identifying one or more second S-NSSAI in a Pending NSSAI IE of the registration response message; and determining whether to release one or more PDU sessions in consideration of the second S-NSSAI.

In accordance with a ninth aspect, there is provided a method according to the eighth aspect, further comprising: receiving an Allowed NSSAI 1E; and identifying one or more third S-NSSAI in the Allowed NSSAI IF.

In accordance with a tenth aspect, there is provided a method according to the ninth aspect, further comprising: determining that there is no first match between: the third S-NSSAI and the S-NSSAI for each and every PDU session; or the mapped S-NSSAI of the third S-NSSAI and the mapped S-NSSAI for each and every PDU session.

In accordance with an eleventh aspect, there is provided a method according to the eighth, ninth or tenth aspect, further comprising: determining whether there is a second match between: the second S-NSSAI and the S-NSSAI of each and every PDU session; or the mapped S-NSSAI of the second S-NSSAI and the mapped S-NSSAI for each and every PDU session In accordance with a twelfth aspect, there is provided a method according to the eleventh aspect, wherein determining whether to release the PDU sessions comprises: if there is a second match, waiting for completion of an NSSAA procedure, and determining whether to release the PDU sessions based on a result of the NSSAA procedure; and if there is no second match, releasing at least one of the PDU sessions (e.g. all sessions except persistent PDU sessions and PDU sessions for emergency services).

In accordance with a thirteenth aspect, there is provided a method according to any of the ninth to twelfth aspects, wherein the Allowed NSSAI IF is included in the registration response message.

In accordance with a fourteenth aspect, there is provided a method according to any of the ninth to twelfth aspects, wherein, if the Allowed NSSAI IE is not included in the registration response message, the method further comprises waiting for receipt of the Allowed NSSAI IE while maintaining the PDU sessions.

In accordance with a fifteenth aspect, there is provided a method according to the eighth aspect, further comprising: if the registration response message does not include an Allowed NSSAI 1E, determining whether there is a second match between: the second S-NSSAI and the S-NSSAI of each and every PDU session; or the mapped S-NSSAI of the second S-NSSAI and the mapped S-NSSAI for each and every PDU session; if there is a second match, waiting for receipt of the Allowed NSSAI IE while maintaining the PDU sessions, and determining whether to release the PDU sessions after receipt of the Allowed NSSAI 1E; and if there is no second match, releasing at least one of the PDU sessions (e.g. all sessions except persistent PDU sessions and PDU sessions for emergency services).

In accordance with a sixteenth aspect, there is provided a method, for a UE, the method comprising: receiving, from a network entity, a first message comprising a Network Slice-Specific Authentication Command message for performing an NSSAA procedure; and receiving, from a network entity, a second message for performing a second procedure, wherein, if a first condition is satisfied, the method further comprises: ignoring the Network Slice-Specific Authentication Command message or aborting the NSSAA procedure, and performing the second procedure; or completing the second procedure before performing the NSSAA procedure, wherein the condition comprises: the second message is received at the same time as, or within a certain time after, the first message.

In accordance with a seventeenth aspect, there is provided a method according to the sixteenth aspect, wherein the second message is an Authentication Request message and the second procedure is an authentication procedure, or wherein the second message is an Security Mode Command message and the second procedure is a security control procedure.

In accordance with an eighteenth aspect, there is provided a method according to the sixteenth aspect, wherein the second message is a Configuration Update Command for performing a configuration update procedure, and wherein the first condition further comprises one or more of: the Configuration Update Command message indicates that a registration is required; the Configuration Update Command message does not contain any parameter other than an indication to register; and the Configuration Update Command message indicates that a registration is required and also includes an indication of "network slicing subscription changed".

In accordance with a nineteenth aspect, there is provided a method according to the sixteenth aspect, wherein, if a second condition is satisfied, the method further comprises proceeding with both the second procedure and the NSSAA procedure.

In accordance with a twentieth aspect, there is provided a method according to the nineteenth aspect, wherein the second message is a Configuration Update Command for performing a configuration update procedure, and wherein the second condition comprises: the UE is requested to perform a registration while in connected mode.

In accordance with a twenty first aspect, there is provided a method, for a network entity (e.g. an AMF entity), the method comprising: performing an NSSAA procedure over 3GPP access; and during the NSSAA procedure, receiving, from a UE in 53MM-CONNECTED mode, a Service Request message over non-3GPP access for performing a service request procedure, wherein, if a third condition is satisfied, the method further comprises ignoring the Service Request message and proceed with the NSSAA procedure.

In accordance with a twenty second aspect, there is provided a method according to the twenty first aspect, wherein the third condition comprises one or more of: the network entity has initiated the NSSAA procedure for the UE over the same or a different access type; the network entity has sent a Registration Accept message, prior to the start of the NSSAA procedure, to the UE over a different access type, where the Registration Accept message contains a Pending NSSAI I E and a 5GS registration result IE indicating "NSSAA to be performed", and the Registration Accept message does not contain an Allowed NSSAI 1E; and the network entity receives a Service Request message from the UE over non-3GPP access, optionally from a UE that is in 5GMM-CONNECTED mode, and optionally the Service Request message includes the Uplink data status IF.

In accordance with a twenty third aspect, there is provided a method according to the twenty first or twenty second aspect, wherein, if the third condition is not satisfied, the method further comprises proceeding with both the service request procedure and the NSSAA procedure.

In accordance with a twenty fourth aspect, there is provided a method, for a UE, for recovery from fallback during NSSAA, the method comprising: receiving a Network Slice-Specific Authentication Command message as part of an NSSAA procedure; receiving a fallback indication while the UE is in 5GMM-CONNECTED mode and during the NSSAA procedure; in response to the fallback indication, entering 5GMM-IDLE mode and transmitting, to a network entity, a Service Request message to initiate a service request procedure to recover from fallback, wherein initiation of the service request procedure is not prohibited during the NSSAA procedure and optionally the UE does not have an allowed NSSAI.

In accordance with a twenty fifth aspect, there is provided a method according to the twenty fourth aspect, wherein the Service Request message is transmitted if a second condition is satisfied, wherein the second condition comprises one or more of: the UE has already registered to the network; and the NSSAA procedure is being performed and optionally the UE does not have an allowed NSSAI.

In accordance with a twenty sixth aspect, there is provided a method according to the twenty fourth or twenty fifth aspect, further comprising: transmitting, to the network entity, a Registration Request message with a 5GS registration type IF set to "mobility registration updating".

In accordance with a twenty seventh aspect, there is provided a method according to the twenty fourth, twenty fifth or twenty sixth aspect, wherein the Service Request message does not include an Uplink data status IE unless a first condition is satisfied, wherein the first condition comprises one or more of: a corresponding PDU session is associated with an S-NSSAI that is in an allowed NSSAI, or associated with an S-NSSAI for which an NSSAA procedure is not ongoing; and the PDU session is an always on PDU session.

In accordance with a twenty eighth aspect, there is provided a method, for a network entity (e.g. an AMF entity), for recovery from fallback during NSSAA, the method comprising: receiving, from a UE, during an NSSAA procedure, one or more NAS messages comprising one or more of a Service request message and a Registration Request message; processing the NAS message; and determining whether to abort the NSSA procedure based on whether the NAS message is received as an initial NAS message from an interface (e.g. N2 interface) and protocol between an NG-RAN and the network entity.

In accordance with a twenty ninth aspect, there is provided a method, for a UE, the method comprising: receiving a Network Slice-Specific Authentication Command message for a NSSAA procedure; and if the UE is in 5GMM-CONNECTED mode and a timer for NAS congestion control (e.g. timer T3346) is running when the message is received, stopping the timer.

In accordance with a thirtieth aspect, there is provided a method, for a network entity (e.g. an AMF entity), the method comprising: receiving, from the UE, a Registration Request message with the 5G5 registration type indicating "periodic registration updating", or the 5GS registration type indicating "mobility registration updating" and the UE is in NB-N1 mode, if an allowed NSSAI for a UE has changed from an allowed NSSAI that was previously sent to the UE, and at least one new S-NSSAI requires NSSAA, sending, to the UE: an allowed NSSAI containing S-NSSAls for which a re-initiation of NSSAA is not required, and/or a pending NSSAI containing S-NSSAls for which NSSAA needs to be re-initiated.

In accordance with a thirty first aspect, there is provided a method according to the thirtieth aspect, further comprising: if no allowed NSSAI can be provided to the UE, setting an "NSSAA to be performed" indicator in a 5G5 registration result IE.

In accordance with a thirty second aspect, there is provided a method according to the thirtieth or thirty first aspect, wherein the pending NSSAI further contains an indication of slices that are marked as default slices in subscription information of the UE and that require NSSAA to be initiated or re-initiated.

In accordance with a thirty third aspect, there is provided a method according to the thirtieth, thirty first or thirty second aspect, further comprising: receiving, from the UE, a Registration Request message; and if a condition is satisfied, rejecting the Registration Request message, wherein the condition comprises one or more of: the Registration Request message includes a 5GS registration type IE indicating "periodic registration updating" or indicating "mobility registration updating", the UE is in NB-N1 mode, and NSSAA is revoked for all slices although the UE did not send a Requested NSSAI 1E, or a Requested mapped NSSAI 1E, in the Registration Request message.

In accordance with a thirty fourth aspect, there is provided a method, for a UE, the method comprising: in response to: transmitting, to a network entity (e.g. an AMF entity), a Registration Request message including a 5GS registration type IE indicating (a) "periodic registration updating", or (b) "mobility registration updating" and the UE is in NB-N1 mode; and receiving, from the network entity, a Registration Accept message including a 53S registration result IF indicating "NSSAA to be performed", setting one or more stored allowed NSSAI as invalid (e.g. deleting stored allowed NSSAI).

In accordance with a thirty fifth aspect, there is provided a network entity or UE configured to operate according to a method of any of the first to thirty fourth aspects.

In accordance with a thirty sixth aspect, there is provided a network comprising a network entity and/or a UE according to the thirty fifth aspect.

In accordance with a thirty seventh aspect, there is provided a computer program comprising instructions which, when the program is executed by a computer or processor, cause the computer or processor to carry out a method according to any of the first to thirty fourth aspects.

In accordance with a thirty eighth aspect, there is provided a computer or processor-readable data carrier having stored thereon a computer program according to the thirty seventh aspect.

Acronyms, Abbreviations and Definitions In the present disclosure, the following acronyms, abbreviations and definitions are used.

3GPP 3rd Generation Partnership Project 53 5th Generation 5GC 53 Core 53MM 53 Mobility Management 5GS 53 System 5GSM 5G Session Management AAA Authentication, Authorization and Accounting AMF Access and Mobility Management Function AN Access Network A-NSSAI Allowed NSSAI C-NSSAI Configured NSSAI EAP Extensible Authentication Protocol EPS Evolved Packet System HPLMN Home PLMN IE Information Element 1E1 IE Identifier LV Length, and Value LV-E Length, and Value -Extended Mandatory MICO Mobile Initiated Connection Only Ni Interface between UE and AMF Ni mode a mode of a UE allowing access to the 53 core network via the 53 access network N2 Interface between AMF via (R)AN N11 Interface between AMF and SMF N26 Interface between MME and AMF NAS Non Access Stratum NB Narrow Band NG Next Generation NF Network Function NS Network Slice NSI Network Slice Instance NSSAA Network Slice-Specific Authentication and Authorization NSSAI Network Slice Selection Assistance Information NSSCI Network Slicing Subscription Change Indication 0 Optional PDU Protocol Data Unit PLMN Public Land Mobile Network P-NSSAI Pending NSSAI RAN Radio Access Network Rel Release R-NSSAI Requested NSSAI Si mode a mode of a UE that operates with a functional division that is in accordance with the use of an Si interface between the radio access network and the core network SD Slice Differenfiator SMF Session Management Function S-NSSAI Single NSSAI SST Slice/Service Type TA Tracking Area TAI Tracking Area Identity TLV Type, Length and Value

TS Technical Specification

UE User Equipment UL UpLink/Uplink V Value VPLMN Visited PLMN

Claims

Claims A method, for a UE, the method comprising: in response to: transmitting, to a network entity (e.g. an AMF entity), a Registration Request message including a 5GS registration type IE indicating (a) "periodic registration updating", or (b) "mobility registration updating" and the UE is in NB-N1 mode; and receiving, from the network entity, a Registration Accept message including a 5GS registration result IE indicating "NSSAA to be performed", setting one or more stored allowed NSSAI as invalid (e.g. deleting stored allowed NSSAI)
2. A method according to claim 1, further comprising, if an allowed NSSAI for the UE has changed from an allowed NSSAI that was previously sent to the UE, and at least one news-NSSAI requires NSSAA, receiving, from the network entity: an allowed NSSAI containing S-NSSAls for which a re-initiation of NSSAA is not required; and/or a pending NSSAI containing S-NSSAls for which NSSAA needs to be re-initiated.
3. A method according to claim 2, wherein the pending NSSAI further contains an indication of slices that are marked as default slices in subscription information of the UE and that require NSSAA to be initiated or re-initiated.
4. A method according to claim 1,2 or 3, further comprising: determining that no allowed NSSAI can be provided to the UE if an "NSSAA to be performed" indicator is set in a 5GS registration result IE.
5. A UE configured to operate according to a method of any preceding claim.
6. A network comprising a network entity and a UE according to claim 5.
7. A computer program comprising instructions which, when the program is executed by a computer or processor, cause the computer or processor to carry out a method according to any of claims 1 to 4.
8. A computer or processor-readable data carrier having stored thereon a computer program according to claim 7.