WO2022027303A1

WO2022027303A1 - User equipment and method of operating access control for at least one of onboarding service and/or of npn service

Info

Publication number: WO2022027303A1
Application number: PCT/CN2020/107076
Authority: WO
Inventors: Chenho Chin; Yang Xu
Original assignee: Guangdong Oppo Mobile Telecommunications Corp., Ltd.
Priority date: 2020-08-05
Filing date: 2020-08-05
Publication date: 2022-02-10

Abstract

A user equipment (UE) and a method of operating an access control for at least one of an onboarding service and/or of a non-public network (NPN) service are provided. The method includes introducing a new access category for a unified access control (UAC) access attempt check for NPN service and performing the UAC access attempt check using the new access category. This can solve issues in the prior art, provide an access control for at least one of an onboarding service and a NPN service, provide a good communication performance and/or provide high reliability.

Description

USER EQUIPMENT AND METHOD OF OPERATING ACCESS CONTROL FOR AT LEAST ONE OF ONBOARDING SERVICE AND/OR OF NPN SERVICE

BACKGROUND OF DISCLOSURE

1. Field of Disclosure

The present disclosure relates to the field of communication systems, and more particularly, to a user equipment (UE) and a method of operating an access control for at least one of an onboarding service and/or of a non-public network (NPN) service, which can provide a good communication performance and/or provide high reliability.

2. Description of Related Art

For a 5th generation system (5GS) , the 3rd generation partnership project (3GPP) has developed a non-public network (NPN) feature in release 16 set of specifications that allows enterprises, factories, consortium companies, etc., to have their own private networks. NPN, could be deployed as a part of an operator, a public land mobile network (PLMN) , or it can be totally own by a private operator and in 3GPP-speak these are called standalone non-public networks (SNPNs) because logically speaking these NPNs are standalone networks logically different from PLMNs.

For NPN UEs (mobiles) working to service providers or 3rd party providers or 3rd party vertical markets, the NPN UEs need to be provided with information –for example, most important of which are the security credentials –to get onto the service providers. This is the process of onboarding. And to do onboarding, the NPN UEs need to get onto an onboarding network (ON) which will act as a bridge to either the service providers themselves or to provisioning servers which first provision such mobiles with necessary information and credentials. In current work done in working group 2 (SA2) , a state of the art is that the ONs will broadcast an indication that it can allow access for onboarding.

The above also discusses that such function or service of providing access for onboarding is not the sole function or service of the networks. Mainly, the networks –3GPP PLMNs or SNPNs –are meant to be wireless communication services networks. Not only is onboarding just another service provided by the networks, onboarding might very likely not be the most important service. For instance, supporting a user making a voice call in times of high traffic load might be more important than providing access for NPN UEs to get onboarded. Certainly, in times of overload or emergency, allowing UEs to come onto the network to get to their provisioning servers or service providers, to get onboarded might be deemed to be low or lower importance. But right now, there is not a way to back off NPN UEs making attempts to do onboarding in preference to say UEs making mobile originating calls or sending SMSs or answer to a page for an incoming call or other types of services.

Currently, there is not distinguishing/differentiating access attempt for onboarding for unified access control (UAC) to be applied. Not only onboarding is not even currently mapped to any currently defined access category. This same shortfall happens also for a radio resource control (RRC) establishment cause value. The usefulness of RRC establishment cause is to allow a radio access network (RAN) and a 3GPP core network (CN) (for example, an access and mobility management function (AMF) in particular) to judge at start of establishing requested radio resources what (for what service) that a request is meant to be for. This allows that even if a UE gets pass UAC, the next check by the core network knowing the reason for establishment, can determine whether to allow request to progress or request stopped thus saving further use of radio resources and further establishment of core Network resources.

It should be noted though that before and in SA2#139E, contributions have been submitted that suggest to use a registration type = onboarding when the UE makes a registration attempt to the ON to get onboarded, i.e. to have in REGISTRATION_REQUEST the registration type = onboarding. This registration type set to "onboarding" has even been documented in TR 23.700-07 (present dated version) , and S2-2004364 and S2-2004369 are also examples of such.

However, by the time the core network (or the AMF) receives the REGISTRATION_REQUEST from the NPN UE, that UE has already gained access to the RAN, obtain radio resources for which it then sends the REGISTRATION_REQUEST. Therefore, in essence, the NPN UE has already passed through UAC checks and without being checked that it is either an NPN UE accessing for NPN services or accessing for onboarding and remote provisioning.

A method of operating an access control for at least one of an onboarding service and/or of a non-public network (NPN) service by a UE may be a challenging issue. Thus, improvements in the field are desirable. Therefore, there is a need for a user equipment (UE) and a method of operating an access control for at least one of an onboarding service and/or of a non-public network (NPN) service, which can solve issues in the prior art, provide an access control for at least one of an onboarding service and/or of a NPN service, provide a good communication performance and/or provide high reliability.

SUMMARY

An object of the present disclosure is to propose a user equipment (UE) and a method of operating an access control for at least one of an onboarding service and/or of a non-public network (NPN) service, which can solve issues in the prior art, provide an access control for at least one of an onboarding service and/or of a NPN service, provide a good communication performance and/or provide high reliability.

In a first aspect of the present disclosure, a method of operating an access control for at least one of an onboarding service and/or of a non-public network (NPN) service by a user equipment (UE) includes introducing a new access category for a unified access control (UAC) access attempt check for NPN service and performing the UAC access attempt check using the new access category.

In a second aspect of the present disclosure, a user equipment of operating an access control for at least one of an onboarding service and/or of a non-public network (NPN) service includes a memory, a transceiver, and a processor coupled to the memory and the transceiver. The processor is configured to introduce a new access category for a unified access control (UAC) access attempt check for NPN service and perform the UAC access attempt check using the new access category.

In a third aspect of the present disclosure, a non-transitory machine-readable storage medium has stored thereon instructions that, when executed by a computer, cause the computer to perform the above methods.

In a fourth aspect of the present disclosure, a chip includes a processor, configured to call and run a computer program stored in a memory, to cause a device in which the chip is installed to execute the above methods.

In a fifth aspect of the present disclosure, a computer readable storage medium, in which a computer program is stored, causes a computer to execute the above methods.

In a sixth aspect of the present disclosure, a computer program product includes a computer program, and the computer program causes a computer to execute the above methods.

In a seventh aspect of the present disclosure, a computer program causes a computer to execute the above methods.

BRIEF DESCRIPTION OF DRAWINGS

In order to more clearly illustrate the embodiments of the present disclosure or related art, the following figures will be described in the embodiments are briefly introduced. It is obvious that the drawings are merely some embodiments of the present disclosure, a person having ordinary skill in this field can obtain other figures according to these figures without paying the premise.

FIG. 1 is a schematic diagram of the signaling plane and user plane between a user equipment (UE) and a public land mobile network (PLMN) through a (standalone) non-public network (NPN) .

FIG. 2 is a schematic diagram illustrating a UE accessing a PLMN via a non-3GPP access.

FIG. 3 is a schematic diagram illustrating an NPN.

FIG. 4 is a schematic diagram (atable) illustrating access categories presently defined in 3GPP.

FIG. 5 is a schematic diagram illustrating a mapping table for access identities/access categories and a radio resource control (RRC) establishment cause.

FIG. 6 is a block diagram of a user equipment (UE) and a network (e.g., core network) of operating an access control for at least one of an onboarding service and/or of a non-public network (NPN) service in a communication network system according to an embodiment of the present disclosure.

FIG. 7 is a flowchart illustrating a method of operating an access control for at least one of an onboarding service and/or of a non-public network (NPN) service by a UE according to an embodiment of the present disclosure.

FIG. 8 is a block diagram of a system for wireless communication according to an embodiment of the present disclosure.

DETAILED DESCRIPTION OF EMBODIMENTS

Embodiments of the present disclosure are described in detail with the technical matters, structural features, achieved objects, and effects with reference to the accompanying drawings as follows. Specifically, the terminologies in the embodiments of the present disclosure are merely for describing the purpose of the certain embodiment and does not limit the disclosure.

In some embodiments, when a non-access stratum (NAS) is mentioned, it refers to a NAS of a user equipment (UE) unless it is explicitly stated that it is a NAS of a network side or a NAS of each side of a peer-to-peer communication/signaling. In some embodiments, the terms, a UE and a mobile station (MS) , are synonymous, in much the same way as it does in 3GPP specifications.

In some embodiments, as part of what service and system aspects working group 2 (SA2) developed under a standalone non-public network (SNPN) and/or a non-public network (NPN) ( (S) NPN) , SA2 has developed an architecture where by a UE of a (S) NPN can access a public land mobile network (PLMN) for a PLMN service, i.e. a service which would not be supported by the (S) NPN which it would then otherwise not get. Such service could for example be access to external data networks or access to voice/video services. FIG. 1, taken from SA2 technical documentation (e.g. 3GPP TR 23.734, subclause 6.20) , illustrates this architecture.

FIG. 1 illustrates that, in some embodiments, one would see that a dotted line (through N1 _PLMN) represents a signaling plane (i.e. a control plane) between a UE and a target PLMN. In order to have this signaling path, the UE and a (S) NPN have a PDU session set up between the UE and a session management function (SMF) of the (S) NPN and with the PDU session, a user plane exists between the UE and a user plane function (UPF) of the (S) NPN and from there an IP Sec tunnel is established to a N3 interworking function (N3IWF) of the PLMN through a Z2 interface, that is another dotted line (through Nwu _PLMN) in FIG. 1. Over the Z2 interface, the IP Sec tunnel, the UE by setting up another PDU session with a user plane, access external data networks through the PLMN, i.e. PLMN data services via the PLMN by a (S) NPN UE connecting to the PLMN through the N3IWF.

FIG. 2 illustrates that, in some embodiments, given an entry point of to the PLMN is via the (through the) N3IWF, this will be illustrated as an non-3GPP access-like entry, i.e. a signaling to the AMF through the N3IWF, will be illustrated as the UE accessing the PLMN via a non-3GPP access. This view of an entry via non-3GPP access is illustrated in FIG. 2. It can also refer to 3GPP TS 23.501. FIG. 2 illustrates an architecture and network functions directly connected to non-3GPP access. The reference architecture supports service based interfaces for AMF, SMF, and other NFs not represented in FIG. 2. Two N2 instances terminate to a single AMF for a UE which is simultaneously connected to the same 5G Core Network over 3GPP access and non-3GPP access. Two N3 instances may terminate to different UPFs when different PDU sessions are established over 3GPP access and non-3GPP access.

An eNPN work item currently progresses in 3GPP SA2 is Rel-17 enhancements for NPN parts of a Vertical_LAN work item. In this eNPN study item, one of issues identified in TR 23.700-07 may comprise the followings.

Key issue #4: UE Onboarding and remote provisioning. Given in TR 23.700-07, the definition of onboarding is: UE Onboarding: Provisioning of information, to a UE and within the network, required for the UE to get authorized access and connectivity to an NPN. Therefore, one could consider that "onboarding" means to provision the device/mobile that does not have the rights (right information or right credentials) to an NPN with that/those rights so that the UE can access the NPN for the intended service (s) .

FIG. 3 illustrates an NPN. FIG. 3 illustrates that in some embodiment, intended services are not necessarily provided by the NPN themselves, but rather provided by service providers. Consider for instance, enterprise companies run their private networks and car manufacture companies have robot units for their assembly lines. Those robots need to communicate with office controllers (and vice versa) e.g. who provide service commands and control to those robots. FIG. 3 provides an illustration of this setup.

To get "onboarded" and thus able to access its service providers –who could also be 3rd party service providers –the NPN UE needs to get onto some networks which can then provide the NPN UE access and connection to the service provider (s) who will then provision that/those NPN UEs with the necessary information such as credentials for the NPN UEs to then get services from the (3rd) service providers.

It is understood that, deployments can exist where the provisioning of the credentials needed to obtain service are performed by another entity like a provisioning server. Such provisioning server might or might not be part of the service provider or a network such as a PLMN/SNPN/PNI-NPN. The provisioning server might even be a standalone entity in the internet providing maintenance/generation/provisioning as a cloud service. Such networks which can allow NPN UEs to get on to get "onboarded" are termed "onboarding networks" in TR 23.700-07, which gives the definition as follows. Onboarding network (ON) : The network providing initial registration and/or access to the UE for UE onboarding.

Obviously, deploying a network just to function as an onboarding network (ON) is overly to totally under use such a network. Networks such as 3GPP networks are big extensive networks (with many functioning entities) meant to provide wireless communications and services to end users, using networks such as 3GPP networks to provide just an underlying service and nothing else would be a total waste. What is more, once onboarding is done for the NPN UEs, it is unlikely that such onboarding will need to be performed again and again. There is no question that re-doing onboarding for such UEs will occur e.g. when there are resets of the devices or when new upgrades are needed, but by and large those will not be regular often occurring events. Therefore, besides providing a "bridge" for NPN UEs to get "onboarded" , such 3GPP network will function as it is designed to do i.e. providing wireless communication and services. Providing access (and the means in terms of resources) for NPN UEs to get "onboarded" and service providers to remotely provision such NPN UEs are just one feature of these 3GPP networks or non-public networks.

However, some 3GPP networks or PLMNs might offer such "onboarding" service and some will not. Even for a PLMN operator to offer such services, not the entire network has to be open as an onboarding network. Consider a big national operator such as Deustche Telekom of Germany providing "onboarding" access to NPN UEs of e.g. Mercedes, BMW, Volkswagen, in example the city of Munich. Such factories are in certain parts of Munich, so why should the entire Deutsche Telekom 3GPP network in the city of Munich open itself up to support onboarding?

To resolve these issues, SA2 has decided that a network that offers access for "onboarding" , will broadcast in its SIB and indication that the network can support onboarding.

Prior to 5GS –so in LTE/SAE, UMTS, and even GPRS -the control of initial access of mobiles is done through access class control or access class baring (ACB) –see 3GPP TS 22.011. Such initial access control is based on the access class of the mobile, assigned to that mobile related to its subscription and/or equipment. Then against each access class the RAN broadcast a loading factor (or barring factor) . When the mobile wishes to request radio resources to make an access for services, the mobile looks into the SIBs for the loading factor broadcasted for each access class. Then matching its access class and the loading factor, the UE draws on an algorithm to determine its access rights –see 3GPP TS 25.331 and 3GPP TS 36.331. Along the way and through the releases of UMTS and LTE/SAE, some extensions, additions and exceptions to access control were partly introduced such as domain specific access control (DSAC) and service specific access control (SSAC) where the former does similar access control based on the domain the mobile wishes to access while the latter specifically introduced IMS services such as mobile originating MMTEL to be access controlled separately.

However, by and large, access control through access classes remained the mainstay till 3GPP started its 5GS design. When starting its 5G work for 3GPP's 5G system in Release 15, 3GPP RAN2, 3GPP CT1 in collaboration with 3GPP SA1 work on service requirements, studies and introduces a form of initial access control based on service requested/required. This form of access control (or feature) is termed unified access control (UAC) . At the heart of UAC is the assignment of an access category to each of the access attempt a UE wishes to make. The choice of the Access Category is determined by the service or best fitting service that the UE is requesting. For instance, if the UE wishes to send an SMS, then the access category to use to check if access is allowed is access category 6 (see 3GPP TS 22.261, subclause 6.22.2.3 and 3GPP TS 24.501, subclause 4.5.2) .

It is understood that, in determining the access category, the access identity allocated for that UE is also determined, see 3GPP TS 24.501, subclause 4.5.2, table 4.5.2.1 and table 4.5.2.2, and subclause 4.5.3. Access identity is also used by the radio resource control procedures to determine if an access attempt is allowed or is barred, see 3GPP TS 38.331 (the radio resource control (RRC) protocol specification for NR (5GS) ) .

Once that access identity and access category are determined, then access control is checked to see if the (radio) network allows that category of service to access. Such access category determination is specified in 24.501. Along with the access identity and access category, the RRC establishment cause is also determined (see 3GPP TS 24.501, Table 4.5.6.1) . This RRC establishment cause is passed to the radio network and then onwards to the core network as an indication of the UE’s reason for access.

A UE can have more than one access identity (e.g. an ambulance personnel who is also an MCS user) and also an access can be matched to more than one access categories (e.g. a user wanting an emergency service for making a voice call) . In the event that more than one access category matches the reason for access, 3GPP TS 24.501, Table 4.5.2.2, sets out the rules to determine one access category for use in access control checks. Further to note, there are two types of access categories, namely, standardized access categories and operator defined access categories (ODAC) -see 3GPP TS 22.261, subclause 6.22.2.3 and 3GPP TS 24.501, subclause 4.5.3. Standardized access category classifies a standardized service with a category, e.g. MMTEL video = Category 5.

ODAC allows individual operators to classify a number of criteria of services or types (e.g. the criteria types 5QI, certain DNNs and/or matching certain slice S-NSSAI) into an access category. Such ODACs are in the range of 32 to 63. And to allow for control of such access the radio network will broadcast access allowance/barring factors criteria against the Access Category. Thus, on the UE side, having determined an access attempt to a certain access category, the UE looks at the broadcasted barring factors and from that work out if access attempt is allowed. Therefore, in times of congestion and/or overload, the radio network will manipulate such access allowance /barring factors thereby able to control access attempts of UEs, see 3GPP TS 38.331.

FIG. 4 illustrates access categories of 3GPP. FIG. 5 illustrates a mapping table for access identities/access categories and a radio resource control (RRC) establishment cause. FIG. 4 taken from 3GPP TS 22.261, illustrates an elaboration of access categories and the services tied to those access attempts, while FIG. 5, extracted from TS 24.501, illustrates the mapping between access categories and RRC establishment cause.

FIG. 6 illustrates that, in some embodiments, a user equipment (UE) 10 and a network (e.g., a core network) 20 of operating an access control for at least one of an onboarding service and/or of a non-public network (NPN) service in a communication network system 30 according to an embodiment of the present disclosure are provided. The communication network system 30 includes the UE 10 and the network 20. The UE 10 may include a memory 12, a transceiver 13, and a processor 11 coupled to the memory 12, the transceiver 13. The network 20 may include a memory 22, a transceiver 23, and a processor 21 coupled to the memory 22, the transceiver 23. The

processor

11 or 21 may be configured to implement proposed functions, procedures and/or methods described in this description. Layers of radio interface protocol may be implemented in the

processor

11 or 21. The

memory

12 or 22 is operatively coupled with the

processor

11 or 21 and stores a variety of information to operate the

processor

11 or 21. The

transceiver

13 or 23 is operatively coupled with the

processor

11 or 21, and the

transceiver

13 or 23 transmits and/or receives a radio signal.

The

processor

11 or 21 may include application-specific integrated circuit (ASIC) , other chipset, logic circuit and/or data processing device. The

memory

12 or 22 may include read-only memory (ROM) , random access memory (RAM) , flash memory, memory card, storage medium and/or other storage device. The

transceiver

13 or 23 may include baseband circuitry to process radio frequency signals. When the embodiments are implemented in software, the techniques described herein can be implemented with modules (e.g., procedures, functions, and so on) that perform the functions described herein. The modules can be stored in the

memory

12 or 22 and executed by the

processor

11 or 21. The

memory

12 or 22 can be implemented within the

processor

11 or 21 or external to the

processor

11 or 21 in which case those can be communicatively coupled to the

processor

11 or 21 via various means as is known in the art.

In some embodiments, the processor 11 is configured to introduce a new access category for a unified access control (UAC) access attempt check for NPN service and perform the UAC access attempt check using the new access category. This can solve issues in the prior art, provide an access control for at least one of an onboarding service and/or of a NPN service, provide a good communication performance and/or provide high reliability.

In some embodiments, the new access category comprises a new standardized access category or an operator defined access category (ODAC) . In some embodiments, the new standardized access category or the ODAC identifies a type of access attempt for NPN service. In some embodiments, the new standardized access category or the ODAC identifies an access for NPN service without distinguishing whether the access is for onboarding or for getting to a service provider. In some embodiments, the new standardized access category comprises a value from a range 11 to 31. In some embodiments, the new standardized access category of 12 corresponds to a type of access attempt for onboarding service. In some embodiments, the ODAC comprises a value from a range 32 to 63. In some embodiments, the ODAC has an access category criteria type indicating that onboarding is an access type that an access attempt is for. In some embodiments, the method comprises mapping an access attempt for onboarding to an access category 3. In some embodiments, mapping an access attempt for onboarding to an access category 3 is used if a control plane and/or a control plane signaling procedure is to be used to perform onboarding. In some embodiments, the method comprises mapping an access attempt for onboarding to an access category 7. In some embodiments, mapping an access attempt for onboarding to an access category 7 is used if a user plane is to be used to perform onboarding. In some embodiments, the method comprises mapping an access attempt for onboarding to an access category 1. In some embodiments, mapping an access attempt for onboarding to an access category 1 is used if onboarding is not an urgent function/service and can be delay tolerant.

In some embodiments, the processor 11 is configured to introduce a new radio resource control (RRC) establishment to access a network for onboarding. In some embodiments, if the access category 3 is used to indicate onboarding, an RRC establishment cause of mo-signalling is used. In some embodiments, if the access category 7 is used to indicate onboarding, an RRC establishment cause of mo-data is used. In some embodiments, if the access category 1 is used to indicate onboarding, as an implementation option either at least one of the access categories 3 to 7 to map to an RRC establishment cause is selected or either the RRC establishment cause of mo-signalling or the RRC establishment cause of mo-data is selected. In some embodiments, selection of using the RRC establishment cause of mo-signalling or the RRC establishment cause of mo-data is based on whether control plane procedures or user plane procedures are used to do onboarding.

In some embodiments, for a case where the UE 10 is registered to a public land mobile network (PLMN) or the NPN and the UE 10 is not going through a registration procedure to get onboarding, when the transceiver 13 sends a service request to get to a core network to perform onboarding, a new service type indicating onboarding is set. In some embodiments, for a case where the UE 10 is registered to a public land mobile network (PLMN) or the NPN and the UE 10 is not going through a registration procedure to get onboarding, when the processor 11 establishes a session and user plane resources to a provisioning server or to a service provider to get onboarding, a new session type identifying a session and/or user plane resources are for onboarding is set.

In some embodiments, the processor 11 is configured to allow an application to trigger the UE to get onboarding. In some embodiments, allowing the application to trigger the UE to get onboarding comprises introducing a new AT command to trigger onboarding. In some embodiments, the new AT command comprises +CNPNONB AT command for NPN onboarding. In some embodiments, allowing the application to trigger the UE 10 to get onboarding comprises adding changes to an existing AT command to trigger onboarding. In some embodiments, existing AT command comprises an +CDGCONT AT command used to establish a packet data protocol (PDP) context or a PDU session. In some embodiments, if the PDU session is used to perform onboarding, +CDGCONT AT command with a new request type set to onboarding can be used. In some embodiments, existing AT command comprises +CGATT AT command used to attach and/or detach of the UE 10 for packet domain services. In some embodiments, an indication of request is added to +CGATT AT command where the indication of request has a value indicating onboarding.

FIG. 7 illustrates a method 200 of operating an access control for at least one of an onboarding service and/or of a non-public network (NPN) service by a UE according to an embodiment of the present disclosure. In some embodiments, the method 200 includes: a block 202, introducing a new access category for a unified access control (UAC) access attempt check for NPN service, and a block 204, performing the UAC access attempt check using the new access category. This can solve issues in the prior art, provide an access control for at least one of an onboarding service and/or of a NPN service, provide a good communication performance and/or provide high reliability.

In some embodiments, the new access category comprises a new standardized access category or an operator defined access category (ODAC) . In some embodiments, the new standardized access category or the ODAC identifies a type of access attempt for NPN service. In some embodiments, the new standardized access category or the ODAC identifies an access for NPN service without distinguishing whether the access is for onboarding or for getting to a service provider. In some embodiments, the new standardized access category comprises a value from a range 11 to 31. In some embodiments, the new standardized access category of 12 corresponds to a type of access attempt for onboarding service. In some embodiments, the ODAC comprises a value from a range 32 to 63. In some embodiments, the ODAC has an access category criteria type indicating that onboarding is an access type that an access attempt is for.

In some embodiments, the method comprises mapping an access attempt for onboarding to an access category 3. In some embodiments, mapping an access attempt for onboarding to an access category 3 is used if a control plane and/or a control plane signaling procedure is to be used to perform onboarding. In some embodiments, the method comprises mapping an access attempt for onboarding to an access category 7. In some embodiments, mapping an access attempt for onboarding to an access category 7 is used if a user plane is to be used to perform onboarding. In some embodiments, the method comprises mapping an access attempt for onboarding to an access category 1. In some embodiments, mapping an access attempt for onboarding to an access category 1 is used if onboarding is not an urgent function/service and can be delay tolerant. In some embodiments, the method further comprises introducing a new radio resource control (RRC) establishment to access a network for onboarding. In some embodiments, if the access category 3 is used to indicate onboarding, an RRC establishment cause of mo-signalling is used. In some embodiments, if the access category 7 is used to indicate onboarding, an RRC establishment cause of mo-data is used. In some embodiments, if the access category 1 is used to indicate onboarding, as an implementation option either at least one of the access categories 3 to 7 to map to an RRC establishment cause is selected or either the RRC establishment cause of mo-signalling or the RRC establishment cause of mo-data is selected. In some embodiments, selection of using the RRC establishment cause of mo-signalling or the RRC establishment cause of mo-data is based on whether control plane procedures or user plane procedures are used to do onboarding.

In some embodiments, for a case where the UE is registered to a public land mobile network (PLMN) or the NPN and the UE is not going through a registration procedure to get onboarding, when the UE sends a service request to get to a core network to perform onboarding, a new service type indicating onboarding is set. In some embodiments, for a case where the UE is registered to a public land mobile network (PLMN) or the NPN and the UE is not going through a registration procedure to get onboarding, when the UE establishes a session and user plane resources to a provisioning server or to a service provider to get onboarding, a new session type identifying a session and/or user plane resources are for onboarding is set.

In some embodiments, the method further comprises allowing an application to trigger the UE to get onboarding. In some embodiments, allowing the application to trigger the UE to get onboarding comprises introducing a new AT command to trigger onboarding. In some embodiments, the new AT command comprises +CNPNONB AT command for NPN onboarding. In some embodiments, allowing the application to trigger the UE to get onboarding comprises adding changes to an existing AT command to trigger onboarding. In some embodiments, existing AT command comprises an +CDGCONT AT command used to establish a packet data protocol (PDP) context or a PDU session. In some embodiments, if the PDU session is used to perform onboarding, +CDGCONT AT command with a new request type set to onboarding can be used. In some embodiments, existing AT command comprises +CGATT AT command used to attach and/or detach of the UE for packet domain services. In some embodiments, an indication of request is added to +CGATT AT command where the indication of request has a value indicating onboarding.

In summary, to solve and overcome shortfalls and/or issues discussed above, some embodiments propose the following methods, solutions, and embodiments which can be taken individually or in combination of one another.

1. Introduce a new Access Category for Unified Access Control (UAC) access attempt checks for NPN-UEs as follows: (1) A new standardized access category or a new ODAC, that identifies type of access attempt is for NPN services generically, i.e. indicating access for NPN services without distinguishing whether it is for onboarding or for getting to service providers. (2) A new access category can be a new standardized access category. This new access category can be a value from the range 11 to 31 –the currently reserved range of free values, e.g. access category of 12 is corresponding to the type of access attempt "onboarding service for NPN UE. " (3) A new access category can be an operator defined access category (ODAC) . This ODAC can be a value from range 32 to 63. Also, this ODAC has an access category criteria type that clearly indicates that onboarding is the access type the access attempt is for.

2. Map an access attempt for onboarding to: (1) Access category 3: As a further embodiment, the mapping to access category 3 is used if a control plane and control plane signaling procedures are to be used to perform the onboarding. (2) Access category 7: As a further embodiment, the mapping to access category 7 is used if the user plane is to be used to perform the onboarding. (3) Access category 1: One can consider that onboarding is not an urgent function/service and can be delay tolerant.

3. For indicating to a RAN and a 3GPP core network the nature of, reason for, establishing an RRC connection is to access the network for onboarding: (1) Introduce a new RRC Establishment, e.g. an RRC establishment cause =Onboarding. (2) If access category 3 is used to indicate onboarding, then use RRC establishment cause "mo-signalling. " (3) If access category 7 is used to indicate onboarding, then use RRC establishment cause "mo-data. " (4) If access category 1 is used to indicate onboarding, then as an implementation option either choose an access category 3 to an access category 7 to map to an RRC establishment cause or choose either RRC establishment cause "mo-signalling" or "mo-data. " (5) The choice of using RRC establishment cause of "mo-signaling" or "mo-data" can as a further embodiment be based on whether control plane procedures or user plane procedures are used to do onboarding.

4. For a case where the NPN UE might already be registered to an operator PLMN or NPN and is not going through registration procedure to get onboarding: (1) When sending SERVICE REQUEST to get to core network in order to perform onboarding, set a new service type that indicate "onboarding" , e.g. SERVICE_REQUEST with service type = "onboarding. " (2) When establishing a session and user plane resources to the provisioning server or to the service provider to get onboarded, set a new session type that identifies the session and/or the user plane resources is/are for onboarding –e.g. PDU session type = onboarding.

5. It is expected that a user Application –for instance, an application which is part of a mobile operating system which when run makes the mobile an NPN UE/mobile –will trigger the UE into making an access for onboarding. To allow such an application to trigger onboarding: (1) Introduce a new AT command (CMD) such as in 3GPP TS 27.007 to trigger onboarding. For example, an AT CMD such as +CNPNONB denoting AT Command for NPN onboarding. (2) Add changes to an existing AT CMD to trigger Onboarding. For example, the existing +CDGCONT is used to establish a PDP Context (or a PDU Session) . Therefore, if the PDU session is used to perform onboarding, this +CDGCONT with a new request type set to <Onboarding> can be used. Another example can be to modify the AT CMD +CGATT. +CGATT is currently used to attach/detach of the mobile for packet domain services. Therefore, for example, an "indication of request" can be added to +CGATT where the "indication of request" can have a value indicating "onboarding" or indication to that effect.

The above methods, solutions, and embodiments to access control attempts for onboarding service and/or services from non-public networks (NPNs) can be applied in part or in whole to other 3GPP systems such as a long term evolution/system architecture evolution (LTE/SAE) or an evolved packet system (EPS) and/or a universal mobile telecommunication system (UMTS) . These methods, solutions, and embodiments can also apply to other mobile or wireless/radio networks when requester makes attempts to get services off those wireless/radio networks such as non-public networks (or private networks) by itself (i.e. standalone) or otherwise formed as part of public networks (e.g. PLMN) . Indeed, these methods, solutions and embodiments can also be used by other UEs –not just NPN UEs –that need to access systems such as 3GPP's to get necessary security credentials associated to specific services. Furthermore, these can be applied in part or in whole, individually or used in conjunction presently or in future to obtaining information and/or security rights (credentials) to access those specific services.

The methods, solutions, and embodiments presented above overcomes what is currently no solution to address control of initial access and request for radio resources by NPN UEs making access for purpose of onboarding. Such described methods, solutions, and embodiments provide the networks –both the RAN and the core network individually or in tandem –the means to back off UEs attempting to access the network for onboarding in situations and times when network is getting congested or is congested or overloaded and wish to de-prioritize mobiles accessing for what it considers a non-urgent service or a service that can be delayed or can be delay tolerant. Such methods, solutions, and embodiments do not exist for the moment and would benefit the access control functioning's and management processes of RAN and core networks while either none exist for the moment or the control is done by the core network after the UE gained radio access and setting up signaling plane.

While allowing (initial) radio resource access control by the network, such methods, solutions, and embodiments also allow the UE to take pre-emptive measures by not making such access request in the first place. Furthermore, these methods, solutions, and embodiments allow the UE to know and make clear the reason for access request and handles the problems from the very start involving the triggering user application to indicate its reason for access. Additionally, with these methods, solutions, and embodiments covering not just initial access for registration but also access attempts when NPN UE is already registered to the (onboarding) network and either need to gain access to control plane and/or user plane resources for onboarding with the provisioning server or the service provider, what are proposed in some embodiments makes for a holistic solution to the problems described. While the described methods, solutions, and embodiments have made specific mention of UAC and for 5GS, such methods, solutions, and embodiments are not confined to just 5GS and the access control UAC designed for 3GPP use. Such methods, solutions, and embodiments can as well be applied to mobile or wireless systems where the requester attempts for services can be in that way control by those methods, solutions, embodiments. Anyone skill in the art can make such extensions apply.

Commercial interests for some embodiments are as follows. 1. Solving issues in the prior art. 2. Provide an access control for at least one of an onboarding service and/or of a NPN service. 3. Providing a good communication performance. 4. Providing a high reliability. 5. Some embodiments of the present disclosure are used by 5G-NR chipset vendors, V2X communication system development vendors, automakers including cars, trains, trucks, buses, bicycles, moto-bikes, helmets, and etc., drones (unmanned aerial vehicles) , smartphone makers, communication devices for public safety use, AR/VR device maker for example gaming, conference/seminar, education purposes. Some embodiments of the present disclosure are a combination of “techniques/processes” that can be adopted in 3GPP specification to create an end product. Some embodiments of the present disclosure propose technical mechanisms.

FIG. 8 is a block diagram of an example system 700 for wireless communication according to an embodiment of the present disclosure. Embodiments described herein may be implemented into the system using any suitably configured hardware and/or software. FIG. 8 illustrates the system 700 including a radio frequency (RF) circuitry 710, a baseband circuitry 720, an application circuitry 730, a memory/storage 740, a display 750, a camera 760, a sensor 770, and an input/output (I/O) interface 780, coupled with each other at least as illustrated.

The application circuitry 730 may include a circuitry, such as, but not limited to, one or more single-core or multi-core processors. The processors may include any combinations of general-purpose processors and dedicated processors, such as graphics processors and application processors. The processors may be coupled with the memory/storage and configured to execute instructions stored in the memory/storage to enable various applications and/or operating systems running on the system.

The baseband circuitry 720 may include a circuitry, such as, but not limited to, one or more single-core or multi-core processors. The processors may include a baseband processor. The baseband circuitry may handle various radio control functions that enable communication with one or more radio networks via the RF circuitry. The radio control functions may include, but are not limited to, signal modulation, encoding, decoding, radio frequency shifting, etc. In some embodiments, the baseband circuitry may provide for communication compatible with one or more radio technologies. For example, in some embodiments, the baseband circuitry may support communication with an evolved universal terrestrial radio access network (EUTRAN) and/or other wireless metropolitan area networks (WMAN) , a wireless local area network (WLAN) , a wireless personal area network (WPAN) . Embodiments in which the baseband circuitry is configured to support radio communications of more than one wireless protocol may be referred to as multi-mode baseband circuitry.

In various embodiments, the baseband circuitry 720 may include circuitry to operate with signals that are not strictly considered as being in a baseband frequency. For example, in some embodiments, baseband circuitry may include circuitry to operate with signals having an intermediate frequency, which is between a baseband frequency and a radio frequency. The RF circuitry 710 may enable communication with wireless networks using modulated electromagnetic radiation through a non-solid medium. In various embodiments, the RF circuitry may include switches, filters, amplifiers, etc. to facilitate the communication with the wireless network.

In various embodiments, the RF circuitry 710 may include circuitry to operate with signals that are not strictly considered as being in a radio frequency. For example, in some embodiments, RF circuitry may include circuitry to operate with signals having an intermediate frequency, which is between a baseband frequency and a radio frequency.

In various embodiments, the transmitter circuitry, control circuitry, or receiver circuitry discussed above with respect to the user equipment, eNB, or gNB may be embodied in whole or in part in one or more of the RF circuitry, the baseband circuitry, and/or the application circuitry. As used herein, “circuitry” may refer to, be part of, or include an Application Specific Integrated Circuit (ASIC) , an electronic circuit, a processor (shared, dedicated, or group) , and/or a memory (shared, dedicated, or group) that execute one or more software or firmware programs, a combinational logic circuit, and/or other suitable hardware components that provide the described functionality. In some embodiments, the electronic device circuitry may be implemented in, or functions associated with the circuitry may be implemented by, one or more software or firmware modules.

In some embodiments, some or all of the constituent components of the baseband circuitry, the application circuitry, and/or the memory/storage may be implemented together on a system on a chip (SOC) .

The memory/storage 740 may be used to load and store data and/or instructions, for example, for system. The memory/storage for one embodiment may include any combination of suitable volatile memory, such as dynamic random access memory (DRAM) ) , and/or non-volatile memory, such as flash memory.

In various embodiments, the I/O interface 780 may include one or more user interfaces designed to enable user interaction with the system and/or peripheral component interfaces designed to enable peripheral component interaction with the system. User interfaces may include, but are not limited to a physical keyboard or keypad, a touchpad, a speaker, a microphone, etc. Peripheral component interfaces may include, but are not limited to, a non-volatile memory port, a universal serial bus (USB) port, an audio jack, and a power supply interface.

In various embodiments, the sensor 770 may include one or more sensing devices to determine environmental conditions and/or location information related to the system. In some embodiments, the sensors may include, but are not limited to, a gyro sensor, an accelerometer, a proximity sensor, an ambient light sensor, and a positioning unit. The positioning unit may also be part of, or interact with, the baseband circuitry and/or RF circuitry to communicate with components of a positioning network, e.g., a global positioning system (GPS) satellite.

In various embodiments, the display 750 may include a display, such as a liquid crystal display and a touch screen display. In various embodiments, the system 700 may be a mobile computing device such as, but not limited to, a laptop computing device, a tablet computing device, a netbook, an ultrabook, a smartphone, etc. In various embodiments, system may have more or less components, and/or different architectures. Where appropriate, methods described herein may be implemented as a computer program. The computer program may be stored on a storage medium, such as a non-transitory storage medium.

A person having ordinary skill in the art understands that each of the units, algorithm, and steps described and disclosed in the embodiments of the present disclosure are realized using electronic hardware or combinations of software for computers and electronic hardware. Whether the functions run in hardware or software depends on the condition of application and design requirement for a technical plan. A person having ordinary skill in the art can use different ways to realize the function for each specific application while such realizations should not go beyond the scope of the present disclosure. It is understood by a person having ordinary skill in the art that he/she can refer to the working processes of the system, device, and unit in the above-mentioned embodiment since the working processes of the above-mentioned system, device, and unit are basically the same. For easy description and simplicity, these working processes will not be detailed.

It is understood that the disclosed system, device, and method in the embodiments of the present disclosure can be realized with other ways. The above-mentioned embodiments are exemplary only. The division of the units is merely based on logical functions while other divisions exist in realization. It is possible that a plurality of units or components are combined or integrated in another system. It is also possible that some characteristics are omitted or skipped. On the other hand, the displayed or discussed mutual coupling, direct coupling, or communicative coupling operate through some ports, devices, or units whether indirectly or communicatively by ways of electrical, mechanical, or other kinds of forms.

While the present disclosure has been described in connection with what is considered the most practical and preferred embodiments, it is understood that the present disclosure is not limited to the disclosed embodiments but is intended to cover various arrangements made without departing from the scope of the broadest interpretation of the appended claims.

The units as separating components for explanation are or are not physically separated. The units for display are or are not physical units, that is, located in one place or distributed on a plurality of network units. Some or all of the units are used according to the purposes of the embodiments. Moreover, each of the functional units in each of the embodiments can be integrated in one processing unit, physically independent, or integrated in one processing unit with two or more than two units. If the software function unit is realized and used and sold as a product, it can be stored in a readable storage medium in a computer. Based on this understanding, the technical plan proposed by the present disclosure can be essentially or partially realized as the form of a software product. Or, one part of the technical plan beneficial to the conventional technology can be realized as the form of a software product. The software product in the computer is stored in a storage medium, including a plurality of commands for a computational device (such as a personal computer, a server, or a network device) to run all or some of the steps disclosed by the embodiments of the present disclosure. The storage medium includes a USB disk, a mobile hard disk, a read-only memory (ROM) , a random access memory (RAM) , a floppy disk, or other kinds of media capable of storing program codes.

Claims

A method of operating an access control for at least one of an onboarding service and/or of a non-public network (NPN) service by a user equipment (UE) , comprising:

introducing a new access category for a unified access control (UAC) access attempt check for NPN service; and

performing the UAC access attempt check using the new access category.
The method of claim 1, wherein the new access category comprises a new standardized access category or an operator defined access category (ODAC) .
The method of claim 2, wherein the new standardized access category or the ODAC identifies a type of access attempt for NPN service.
The method of claim 2 or 3, wherein the new standardized access category or the ODAC identifies an access for NPN service without distinguishing whether the access is for onboarding or for getting to a service provider.
The method of any one of claims 2 to 4, wherein the new standardized access category comprises a value from a range 11 to 31.
The method of claim 5, wherein the new standardized access category of 12 corresponds to a type of access attempt for onboarding service.
The method of any one of claims 2 to 6, wherein the ODAC comprises a value from a range 32 to 63.
The method of claim 7, wherein the ODAC has an access category criteria type indicating that onboarding is an access type that an access attempt is for.
The method of any one of claims 1 to 8, further comprising mapping an access attempt for onboarding to an access category 3.
The method of any one of claims 1 to 8, wherein mapping an access attempt for onboarding to an access category 3 is used if a control plane and/or a control plane signaling procedure is to be used to perform onboarding.
The method of any one of claims 1 to 8, further comprising mapping an access attempt for onboarding to an access category 7.
The method of any one of claims 1 to 8, wherein mapping an access attempt for onboarding to an access category 7 is used if a user plane is to be used to perform onboarding.
The method of any one of claims 1 to 8, further comprising mapping an access attempt for onboarding to an access category 1.
The method of any one of claims 1 to 8, wherein mapping an access attempt for onboarding to an access category 1 is used if onboarding is not an urgent function/service and can be delay tolerant.
The method of any one of claims 1 to 14, further comprising introducing a new radio resource control (RRC) establishment to access a network for onboarding.
The method of claim 15, wherein if the access category 3 is used to indicate onboarding, an RRC establishment cause of mo-signalling is used.
The method of claim 15, wherein if the access category 7 is used to indicate onboarding, an RRC establishment cause of mo-data is used.
The method of claim 15, wherein if the access category 1 is used to indicate onboarding, as an implementation option either at least one of the access categories 3 to 7 to map to an RRC establishment cause is selected or either the RRC establishment cause of mo-signalling or the RRC establishment cause of mo-data is selected.
The method of any one of claims 15 to 18, wherein selection of using the RRC establishment cause of mo-signalling or the RRC establishment cause of mo-data is based on whether control plane procedures or user plane procedures are used to do onboarding.
The method of any one of claims 1 to 19, wherein for a case where the UE is registered to a public land mobile network (PLMN) or the NPN and the UE is not going through a registration procedure to get onboarding, when the UE sends a service request to get to a core network to perform onboarding, a new service type indicating onboarding is set.
The method of any one of claims 1 to 19, wherein for a case where the UE is registered to a public land mobile network (PLMN) or the NPN and the UE is not going through a registration procedure to get onboarding, when the UE establishes a session and user plane resources to a provisioning server or to a service provider to get onboarding, a new session type identifying a session and/or user plane resources are for onboarding is set.
The method of any one of claims 1 to 21, further comprising allowing an application to trigger the UE to get onboarding.
The method of claim 22, wherein allowing the application to trigger the UE to get onboarding comprises introducing a new AT command to trigger onboarding.
The method of claim 23, wherein the new AT command comprises +CNPNONB AT command for NPN onboarding.
The method of claim 22, wherein allowing the application to trigger the UE to get onboarding comprises adding changes to an existing AT command to trigger onboarding.
The method of claim 25, wherein existing AT command comprises an +CDGCONT AT command used to establish a packet data protocol (PDP) context or a PDU session.
The method of claim 26, wherein if the PDU session is used to perform onboarding, +CDGCONT AT command with a new request type set to onboarding can be used.
The method of claim 25, wherein existing AT command comprises +CGATT AT command used to attach and/or detach of the UE for packet domain services.
The method of claim 28, wherein an indication of request is added to +CGATT AT command where the indication of request has a value indicating onboarding.
A user equipment (UE) of operating an access control for at least one of an onboarding service and/or of a non-public network (NPN) service by a user equipment, comprising:

a memory;

a transceiver; and

a processor coupled to the memory and the transceiver;

wherein the processor is configured to:

introduce a new access category for a unified access control (UAC) access attempt check for NPN service; and

perform the UAC access attempt check using the new access category.
The UE of claim 30, wherein the new access category comprises a new standardized access category or an operator defined access category (ODAC) .
The UE of claim 31, wherein the new standardized access category or the ODAC identifies a type of access attempt for NPN service.
The UE of claim 31 or 32, wherein the new standardized access category or the ODAC identifies an access for NPN service without distinguishing whether the access is for onboarding or for getting to a service provider.
The UE of any one of claims 31 to 33, wherein the new standardized access category comprises a value from a range 11 to 31.
The UE of claim 34, wherein the new standardized access category of 12 corresponds to a type of access attempt for onboarding service.
The UE of any one of claims 31 to 35, wherein the ODAC comprises a value from a range 32 to 63.
The UE of claim 36, wherein the ODAC has an access category criteria type indicating that onboarding is an access type that an access attempt is for.
The UE of any one of claims 30 to 37, further comprising mapping an access attempt for onboarding to an access category 3.
The UE of any one of claims 30 to 37, wherein mapping an access attempt for onboarding to an access category 3 is used if a control plane and/or a control plane signaling procedure is to be used to perform onboarding.
The UE of any one of claims 30 to 37, further comprising mapping an access attempt for onboarding to an access category 7.
The UE of any one of claims 30 to 37, wherein mapping an access attempt for onboarding to an access category 7 is used if a user plane is to be used to perform onboarding.
The UE of any one of claims 30 to 37, further comprising mapping an access attempt for onboarding to an access category 1.
The UE of any one of claims 30 to 37, wherein mapping an access attempt for onboarding to an access category 1 is used if onboarding is not an urgent function/service and can be delay tolerant.
The UE of any one of claims 30 to 43, wherein the processor is configured to introduce a new radio resource control (RRC) establishment to access a network for onboarding.
The UE of claim 44, wherein if the access category 3 is used to indicate onboarding, an RRC establishment cause of mo-signalling is used.
The UE of claim 44, wherein if the access category 7 is used to indicate onboarding, an RRC establishment cause of mo-data is used.
The UE of claim 44, wherein if the access category 1 is used to indicate onboarding, as an implementation option either at least one of the access categories 3 to 7 to map to an RRC establishment cause is selected or either the RRC establishment cause of mo-signalling or the RRC establishment cause of mo-data is selected.
The UE of any one of claims 39 to 47, wherein selection of using the RRC establishment cause of mo-signalling or the RRC establishment cause of mo-data is based on whether control plane procedures or user plane procedures are used to do onboarding.
The UE of any one of claims 30 to 48, wherein for a case where the UE is registered to a public land mobile network (PLMN) or the NPN and the UE is not going through a registration procedure to get onboarding, when the transceiver sends a service request to get to a core network to perform onboarding, a new service type indicating onboarding is set.
The UE of any one of claims 30 to 48, wherein for a case where the UE is registered to a public land mobile network (PLMN) or the NPN and the UE is not going through a registration procedure to get onboarding, when the processor establishes a session and user plane resources to a provisioning server or to a service provider to get onboarding, a new session type identifying a session and/or user plane resources are for onboarding is set.
The UE of any one of claims 30 to 50, wherein the processor is configured to allow an application to trigger the UE to get onboarding.
The UE of claim 51, wherein allowing the application to trigger the UE to get onboarding comprises introducing a new AT command to trigger onboarding.
The UE of claim 52, wherein the new AT command comprises +CNPNONB AT command for NPN onboarding.
The UE of claim 51, wherein allowing the application to trigger the UE to get onboarding comprises adding changes to an existing AT command to trigger onboarding.
The UE of claim 54, wherein existing AT command comprises an +CDGCONT AT command used to establish a packet data protocol (PDP) context or a PDU session.
The UE of claim 55, wherein if the PDU session is used to perform onboarding, +CDGCONT AT command with a new request type set to onboarding can be used.
The UE of claim 54, wherein existing AT command comprises +CGATT AT command used to attach and/or detach of the UE for packet domain services.
The UE of claim 57, wherein an indication of request is added to +CGATT AT command where the indication of request has a value indicating onboarding.
A non-transitory machine-readable storage medium having stored thereon instructions that, when executed by a computer, cause the computer to perform the method of any one of claims 1 to 29.
A chip, comprising:

a processor, configured to call and run a computer program stored in a memory, to cause a device in which the chip is installed to execute the method of any one of claims 1 to 29.
A computer readable storage medium, in which a computer program is stored, wherein the computer program causes a computer to execute the method of any one of claims 1 to 29.
A computer program product, comprising a computer program, wherein the computer program causes a computer to execute the method of any one of claims 1 to 29.
A computer program, wherein the computer program causes a computer to execute the method of any one of claims 1 to 29.