WO2024092844A1

WO2024092844A1 - Using routing indicator

Info

Publication number: WO2024092844A1
Application number: PCT/CN2022/130159
Authority: WO
Inventors: Jing PING; Ranganathan MAVUREDDI DHANASEKARAN; Laurent Thiebaut
Original assignee: Nokia Shanghai Bell Co., Ltd.; Nokia Solutions And Networks Oy; Nokia Technologies Oy
Priority date: 2022-11-05
Filing date: 2022-11-05
Publication date: 2024-05-10

Abstract

Embodiments of the present disclosure relate to using routing indicator. A terminal device obtains a first routing indicator for an anchor function device for the terminal device, and obtains a second routing indicator for an authentication server function (AUSF) device for the terminal device. The terminal device sends a communication establishment request including at least the first routing indicator and the second routing indicator. The solution provided in the present disclosure can locate both the anchor function device and the AUSF device.

Description

USING ROUTING INDICATOR

FIELD

Various example embodiments relate to the field of telecommunication and in particular, to methods, devices, apparatuses and computer readable storage medium for using routing indicator.

BACKGROUND

In the communications area, there is a constant evolution ongoing in order to provide efficient and reliable solutions for utilizing wireless communication networks. Each new generation has it owns technical challenges for handling the different situations and processes that are needed to connect and serve devices connected to the wireless network. To meet the demand for wireless data traffic having increased since deployment of 4th generation (4G) communication systems, efforts have been made to develop an improved 5th generation (5G) or pre-5G communication system. The new communication systems can support various types of service applications for terminal devices.

It is necessary to apply routing indicator in communication systems. In some scenarios, the routing indicator can be used for routing network signaling to device to serve a subscriber.

SUMMARY

In general, example embodiments of the present disclosure provide a solution for using routing indicator.

In a first aspect, there is provided a terminal device. The terminal device comprises at least one processor; and at least one memory storing instructions that, when executed by the at least one processor, cause the terminal device at least to: obtain a first routing indicator for an anchor function device for the terminal device; obtain a second routing indicator for an authentication server function (AUSF) device for the terminal device; and send a communication establishment request including at least the first routing indicator and the second routing indicator.

In a second aspect, there is provided a terminal device. The terminal device comprises at least one processor; and at least one memory storing instructions that, when executed by the at least one processor, cause the terminal device at least to: receive a routing indicator for an anchor function device for the terminal device, the routing indicator being provided by an authentication server function (AUSF) device for the terminal device; and send a communication establishment request including at least the routing indicator.

In a third aspect, there is provided an authentication server function (AUSF) device. The AUSF device comprises at least one processor; and at least one memory storing instructions that, when executed by the at least one processor, cause the AUSF device at least to: obtain a first routing indicator for an anchor function device for a terminal device; send the first routing indicator to be used by the terminal device.

In a fourth aspect, there is provided an access and mobility management (AMF) device of a relay terminal device. The AMF device comprises at least one processor; and at least one memory storing instructions that, when executed by the at least one processor, cause the AMF device at least to: receive, from the relay terminal device, a relay key request including at least a routing indicator for an authentication server function (AUSF) device; determine, based on the routing indicator, the AUSF device from a plurality of AUSF devices.

In a fifth aspect, there is provided a unified data management (UDM) device. The UDM device comprises at least one processor; and at least one memory storing instructions that, when executed by the at least one processor, cause the UDM device at least to: store a routing indicator for an anchor function device for a terminal device; and send the routing indicator to the terminal device during a user equipment (UE) parameter update (UPU) procedure.

In a sixth aspect, there is provided a method implemented at a terminal device. The method comprises obtaining, at a terminal device, a first routing indicator for an anchor function device for the terminal device; obtaining a second routing indicator for an authentication server function (AUSF) device for the terminal device; and sending a communication establishment request including at least the first routing indicator and the second routing indicator.

In a seventh aspect, there is provided a method implemented at a terminal device. The method comprises receiving, at a terminal device, a routing indicator for an anchor function device for the terminal device, the routing indicator being provided by an authentication server function (AUSF) device for the terminal device; and sending a communication establishment request including at least the routing indicator.

In an eighth aspect, there is provided a method implemented at an authentication server function (AUSF) device. The method comprises obtaining, at the AUSF device, a first routing indicator for an anchor function device for a terminal device; and sending the first routing indicator to be used by the terminal device.

In a ninth aspect, there is provided a method implemented at an access and mobility management (AMF) device of a relay terminal device. The method comprises receiving, at the AMF device of a relay terminal device, from the relay terminal device, a relay key request including at least a routing indicator for an authentication server function (AUSF) device; and determining, based on the routing indicator, the AUSF device from a plurality of AUSF devices.

In a tenth aspect, there is provided a method implemented at a unified data management (UDM) device. The method comprises storing, at a unified data management (UDM) device, a routing indicator for an anchor function device for a terminal device; and sending the routing indicator to the terminal device during a user equipment (UE) parameter update (UPU) procedure.

In an eleventh aspect, there is provided an apparatus. The apparatus comprises means for obtaining, at a terminal device, a first routing indicator for an anchor function device for the terminal device; means for obtaining a second routing indicator for an authentication server function (AUSF) device for the terminal device; and means for sending a communication establishment request including at least the first routing indicator and the second routing indicator.

In a twelfth aspect, there is provided an apparatus. The apparatus comprises means for receiving, at a terminal device, a routing indicator for an anchor function device for the terminal device, the routing indicator being provided by an authentication server function (AUSF) device for the terminal device; and means for sending a communication establishment request including at least the routing indicator.

In a thirteenth aspect, there is provided an apparatus. The apparatus comprises means for obtaining, at an authentication server function (AUSF) device, a first routing indicator for an anchor function device for a terminal device; and means for sending the first routing indicator to be used by the terminal device.

In a fourteenth aspect, there is provided an apparatus. The apparatus comprises means for receiving, at an access and mobility management (AMF) device of a relay terminal device, from the relay terminal device, a relay key request including at least a routing indicator for an authentication server function (AUSF) device; and means for determining, based on the routing indicator, the AUSF device from a plurality of AUSF devices.

In a fifteenth aspect, there is provided an apparatus. The apparatus comprises means for storing, at a unified data management (UDM) device, a routing indicator for an anchor function device for a terminal device; and means for sending the routing indicator to the terminal device during a user equipment (UE) parameter update (UPU) procedure.

In a sixteenth aspect, there is provided a non-transitory computer readable medium comprising program instructions for causing an apparatus to perform at least the method according to any one of the above sixth to tenth aspect.

In a seventeenth aspect, there is provided a non-transitory computer readable medium comprising program instructions stored thereon for performing at least the method according to any one of the above sixth to tenth aspect.

In an eighteenth aspect, there is provided a computer program comprising instructions, which, when executed by an apparatus, cause the apparatus at least to obtain a first routing indicator for an anchor function device for the terminal device; obtain a second routing indicator for an authentication server function (AUSF) device for the terminal device; and send a communication establishment request including at least the first routing indicator and the second routing indicator.

In a nineteenth aspect, there is provided a computer program comprising instructions, which, when executed by an apparatus, cause the apparatus at least to receive a routing indicator for an anchor function device for the terminal device, the routing indicator being provided by an authentication server function (AUSF) device for the terminal device; and send a communication establishment request including at least the routing indicator.

In a twentieth aspect, there is provided a computer program comprising instructions, which, when executed by an apparatus, cause the apparatus at least to obtain a first routing indicator for an anchor function device for a terminal device; and send the first routing indicator to be used by the terminal device.

In a twenty-first aspect, there is provided a computer program comprising instructions, which, when executed by an apparatus, cause the apparatus at least to receive, from the relay terminal device, a relay key request including at least a routing indicator for an authentication server function (AUSF) device; and determine, based on the routing indicator, the AUSF device from a plurality of AUSF devices.

In a twenty-second aspect, there is provided a computer program comprising instructions, which, when executed by an apparatus, cause the apparatus at least to store a routing indicator for an anchor function device for a terminal device; and send the routing indicator to the terminal device during a user equipment (UE) parameter update (UPU) procedure.

In a twenty-third aspect, there is provided a terminal device. The terminal device comprises first obtaining circuitry configured to obtain a first routing indicator for an anchor function device for the terminal device; second obtaining circuitry configured to obtain a second routing indicator for an authentication server function (AUSF) device for the terminal device; and sending circuitry configured to send a communication establishment request including at least the first routing indicator and the second routing indicator.

In a twenty-fourth aspect, there is provided a terminal device. The terminal device comprises receiving circuitry configured to receive a routing indicator for an anchor function device for the terminal device, the routing indicator being provided by an authentication server function (AUSF) device for the terminal device; and sending circuitry configured to send a communication establishment request including at least the routing indicator.

In a twenty-fifth aspect, there is provided an authentication server function (AUSF) device. The AUSF device comprises obtaining circuitry configured to obtain a first routing indicator for an anchor function device for a terminal device; and sending circuitry configured to send the first routing indicator to be used by the terminal device.

In a twenty-sixth aspect, there is provided an access and mobility management (AMF) device of a relay terminal device. The AMF device comprises receiving circuitry configured to receive, from the relay terminal device, a relay key request including at least a routing indicator for an authentication server function (AUSF) device; and determining circuitry configured to determine, based on the routing indicator, the AUSF device from a plurality of AUSF devices.

In a twenty-seventh aspect, there is provided unified data management (UDM) device. The UDM device comprises storing circuitry configured to store a routing indicator for an anchor function device for a terminal device; and sending circuitry configured to send the routing indicator to the terminal device during a user equipment (UE) parameter update (UPU) procedure.

It is to be understood that the summary section is not intended to identify key or essential features of embodiments of the present disclosure, nor is it intended to be used to limit the scope of the present disclosure. Other features of the present disclosure will become easily comprehensible through the following description.

BRIEF DESCRIPTION OF THE DRAWINGS

Some example embodiments will now be described with reference to the accompanying drawings, where:

Fig. 1 illustrates an example communication system in which embodiments of the present disclosure may be implemented;

Fig. 2 illustrates a flowchart of a method implemented at a terminal device according to some embodiments of the present disclosure;

Fig. 3 illustrates a flowchart of a method implemented at a terminal device according to some other embodiments of the present disclosure;

Fig. 4 illustrates a flowchart of a method implemented at an authentication server function (AUSF) device according to some embodiments of the present disclosure;

Fig. 5 illustrates a flowchart of a method implemented at an access and mobility management (AMF) device of a relay terminal device according to some embodiments of the present disclosure;

Fig. 6 illustrates a flowchart of a method implemented at a unified data management (UDM) device according to some embodiments of the present disclosure;

Fig. 7 illustrates a schematic diagram of DCR after ProSe authentication according to some embodiments of the present disclosure;

Fig. 8 illustrates a structure of SUCI according to some embodiments of the present disclosure;

Fig. 9 illustrates a schematic diagram of 5G PRUK ID according to some embodiments of the present disclosure;

Fig. 10 illustrates a schematic diagram of A-KID according to some embodiments of the present disclosure;

Fig. 11A and Fig. 11B shows a flow chart of interaction process between devices according to some embodiments of the present disclosure;

Fig. 12A shows a flow chart of interaction process between devices according to some other embodiments of the present disclosure;

Fig. 12B shows schematic diagram of generation of K _{NR_Prose} according to some other embodiments of the present disclosure;

Fig. 13A and Fig. 13B shows a flow chart of interaction process between devices according to some other embodiments of the present disclosure;

Fig. 14A and Fig. 14B shows a flow chart of interaction process between devices according to some other embodiments of the present disclosure;

Fig. 15 shows a flow chart of interaction process between devices according to some other embodiments of the present disclosure;

Fig. 16 shows a flow chart of interaction process between devices according to some other embodiments of the present disclosure;

Fig. 17 illustrates a simplified block diagram of an apparatus that is suitable for implementing embodiments of the present disclosure; and

Fig. 18 illustrates a block diagram of an example computer readable medium in accordance with some embodiments of the present disclosure;

Throughout the drawings, the same or similar reference numerals represent the same or similar element.

DETAILED DESCRIPTION

Principle of the present disclosure will now be described with reference to some example embodiments. It is to be understood that these embodiments are described only for the purpose of illustration and help those skilled in the art to understand and implement the present disclosure, without suggesting any limitation as to the scope of the disclosure. The disclosure described herein can be implemented in various manners other than the ones described below.

In the following description and claims, unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skills in the art to which this disclosure belongs.

References in the present disclosure to “one embodiment, ” “an embodiment, ” “an example embodiment, ” and the like indicate that the embodiment described may include a particular feature, structure, or characteristic, but it is not necessary that every embodiment includes the particular feature, structure, or characteristic. Moreover, such phrases are not necessarily referring to the same embodiment. Further, when a particular feature, structure, or characteristic is described in connection with an embodiment, it is submitted that it is within the knowledge of one skilled in the art to affect such feature, structure, or characteristic in connection with other embodiments whether or not explicitly described.

It shall be understood that although the terms “first” and “second” etc. may be used herein to describe various elements, these elements should not be limited by these terms. These terms are only used to distinguish one element from another. For example, a first element could be termed a second element, and similarly, a second element could be termed a first element, without departing from the scope of example embodiments. As used herein, the term “and/or” includes any and all combinations of one or more of the listed terms.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of example embodiments. As used herein, the singular forms “a” , “an” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms “comprises” , “comprising” , “has” , “having” , “includes” and/or “including” , when used herein, specify the presence of stated features, elements, and/or components etc., but do not preclude the presence or addition of one or more other features, elements, components and/or combinations thereof. As used herein, “at least one of the following: <a list of two or more elements>” and “at least one of <a list of two or more elements>” and similar wording, where the list of two or more elements are joined by “and” or “or” , mean at least any one of the elements, or at least any two or more of the elements, or at least all the elements.

As used in this application, the term “circuitry” may refer to one or more or all of the following:

(a) hardware-only circuit implementations (such as implementations in only analog and/or digital circuitry) and

(b) combinations of hardware circuits and software, such as (as applicable) :

(i) a combination of analog and/or digital hardware circuit (s) with software/firmware and

(ii) any portions of hardware processor (s) with software (including digital signal processor (s) ) , software, and memory (ies) that work together to cause an apparatus, such as a mobile phone or server, to perform various functions) and

(c) hardware circuit (s) and or processor (s) , such as a microprocessor (s) or a portion of a microprocessor (s) , that requires software (e.g., firmware) for operation, but the software may not be present when it is not needed for operation.

This definition of circuitry applies to all uses of this term in this application, including in any claims. As a further example, as used in this application, the term circuitry also covers an implementation of merely a hardware circuit or processor (or multiple processors) or portion of a hardware circuit or processor and its (or their) accompanying software and/or firmware. The term circuitry also covers, for example and if applicable to the particular claim element, a baseband integrated circuit or processor integrated circuit for a mobile device or a similar integrated circuit in server, a cellular network device, or other computing or network device.

As used herein, the term “communication network” refers to a network following any suitable communication standards, such as Long Term Evolution (LTE) , LTE-Advanced (LTE-A) , Wideband Code Division Multiple Access (WCDMA) , High-Speed Packet Access (HSPA) , Narrow Band Internet of Things (NB-IoT) and so on. Furthermore, the communications between a terminal device and a network device in the communication network may be performed according to any suitable generation communication protocols, including, but not limited to, the first generation (1G) , the second generation (2G) , 2.5G, 2.75G, the third generation (3G) , the fourth generation (4G) , 4.5G, the future fifth generation (5G) communication protocols, and/or any other protocols either currently known or to be developed in the future. Embodiments of the present disclosure may be applied in various communication systems. Given the rapid development in communications, there will of course also be future type communication technologies and systems with which the present disclosure may be embodied. It should not be seen as limiting the scope of the present disclosure to only the aforementioned system.

As used herein, the term “network device” refers to a node in a communication network via which a terminal device accesses the network and receives services therefrom. The network device may refer to a base station (BS) or an access point (AP) , for example, a node B (NodeB or NB) , an evolved NodeB (eNodeB or eNB) , a NR NB (also referred to as a gNB) , a Remote Radio Unit (RRU) , a radio header (RH) , a remote radio head (RRH) , a relay, a low power node such as a femto, a pico, and so forth, depending on the applied terminology and technology.

The term “terminal device” refers to any end device that may be capable of wireless communication. By way of example rather than limitation, a terminal device may also be referred to as a communication device, user equipment (UE) , a Subscriber Station (SS) , a Portable Subscriber Station, a Mobile Station (MS) , or an Access Terminal (AT) . The terminal device may include, but not limited to, a mobile phone, a cellular phone, a smart phone, voice over IP (VoIP) phones, wireless local loop phones, a tablet, a wearable terminal device, a personal digital assistant (PDA) , portable computers, desktop computer, image capture terminal devices such as digital cameras, gaming terminal devices, music storage and playback appliances, vehicle-mounted wireless terminal devices, wireless endpoints, mobile stations, laptop-embedded equipment (LEE) , laptop-mounted equipment (LME) , USB dongles, smart devices, wireless customer-premises equipment (CPE) , an Internet of Things (loT) device, a watch or other wearable, a head-mounted display (HMD) , a vehicle, a drone, a medical device and applications (e.g., remote surgery) , an industrial device and applications (e.g., a robot and/or other wireless devices operating in an industrial and/or an automated processing chain contexts) , a consumer electronics device, a device operating on commercial and/or industrial wireless networks, and the like. In the following description, the terms “terminal device” , “communication device” , “terminal” , “user equipment” and “UE” may be used interchangeably.

According to 3GPP CT4 (TS 23.003 &TS 24.501) , routing indicator may consist of 1 to 4 decimal digits assigned by the home network operator and may be provisioned in the USIM, that allow together with the Home Network Identifier to route network signaling with SUCI to AUSF and UDM instances capable to serve the subscriber. Each decimal digit present in the routing indicator shall be regarded as meaningful (e.g. value "012" is not the same as value "12" ) . If no routing indicator is configured on the USIM, this data field shall be set to the value 0 (i.e. only consist of one decimal digit of "0" ) .

Routing indicator (octets 8-9) shall consist of 1 to 4 digits. The coding of this field is the responsibility of home network operator but BCD coding shall be used. If a network operator decides to assign less than 4 digits to routing indicator, the remaining digits shall be coded as "1111" to fill the 4 digits coding of routing indicator. If no routing indicator is configured in the USIM or the ME, the UE shall code bits 1 to 4 of octet 8 of the routing indicator as "0000" and the remaining digits as "1111" .

According to 3GPP CT6 (TS 31.102 clause 5.3.51 &4.4.11.11) , Routing Indicator procedure for ME: Requirement: Service n 124 is "available" . Request: As part of the SUCI calculation performed by the ME, the ME performs the reading procedure with EF _{Routing_Indicator}. EF _{Routing_Indicator} (Routing Indicator EF) : If service n 124 is "available" in EFUST, this file shall be present. This EF contains Routing Indicator needed by the ME or by the USIM for SUCI calculation contents of the routing indicator. This EF contains Routing Indicator that allows together with the MCC and MNC to route network signaling with SUCI to AUSF and UDM instances capable to serve the subscriber, as specified in 3GPP TS 23.003. The Routing Indicator is coded in 2 bytes as specified in 3GPP TS 24.501. This EF shall contain at least one valid digit of Routing ID even if that only digit is set to 0 (which is the case when the HPLMN intends to not configure a valid Routing Indicator in the USIM) , as specified in 3GPP TS 24.501. Bytes 3 to 4 are used for RFU. The above can be seen in table 1.

Table 1

An indicator defined in TS 23.003 that can be used for AUSF or UDM selection. One UDM can comprise several UDM instances. The routing indicator in the SUCI can be used to identify the right UDM instance that is capable of serving a subscriber.

According to 3GPP SA2 (TS 23.501) , when the UE's Routing Indicator is set to its default value as defined in TS 23.003, the AUSF NF consumer can select any AUSF instance within the home network for the UE. The UE provides the SUCI to the AMF, which contains the Routing Indicator and Home Network Public Key identifier as defined in TS 23.003, during initial registration. The AMF can provide the UE's Routing Indicator and optionally Home Network Public Key identifier to other AMFs as described in TS 23.502.

NF profile of NF instance maintained in an NRF includes the following information: NF instance ID; NF type; PLMN ID in the case of PLMN, PLMN ID + NID in the case of SNPN; Routing Indicator, Home Network Public Key identifier, for UDM and AUSF.

With reference to table 2, according to 3GPP SA2 (TS 23.502) , if the target NF is UDM or AUSF, the request may include the UE's routing indicator, or the UE's routing indicator and Home Network Public Key identifier.

Table 2

With reference to table 3, according to clause of S3-220736 of 3GPP, 5GPRUK ID is introduced for network to identify the 5GPRUK. When the 5GPRUK ID is used, the network shall be able to find PAnF in home PLMN that stored the 5GPRUK ID and 5GPRUK.

Table 3

Above ProSe Use case is an example to illustrate technologies related to embodiments of the present disclosure, at present, there are still some issues, specifically: Issue#1, either 5GPRUK ID or SUCI will be included in Direct communication request (DCR) . In SUCI case, the routing information for AUSF is included in SUCI, and AUSF could get routing information for PAnF (RID) from UDM of the remote UE, and use this information to generate 5GPRUK ID (in step 8 of Figure 6.3.3.3.2-1 in TS 33.503) and select PAnF based on the 5GPRUK ID (in step 9 of the same figure) . However, if 5GPRUK ID instead of SUCI is included in DCR, it's not clear how could AMF of the relay UE select AUSF of the remote UE as there's no routing indicator for AUSF. The RID was added in 5G PRUK ID for routing of PAnF, but not AUSF. Issue#2, at UE side (TS 24.501 or TS 24.554 or TS 33.503) it is not clearly mentioned which RID is used for 5G PRUK ID generation at AUSF and UE. Also it's not specified that how and when, also in which condition, the RID used for 5GPRUK ID should be configured at UE side. Issue#3, if RID of AUSF was supposed to be used for PAnF selection, why should AUSF retrieve the RID from UDM (in response of step 6 of Figure 6.3.3.3.2-1 in TS 33.503) , and select the PAnF based on 5GPRUK ID (in step 9 of the same figure) , as AUSF has RID of AUSF in its own NF profile. According to analysis before, RID used to select PAnF was different to legacy RID included in SUCI for AUSF selection. That also make sense, because: the number of AUSF in a HPLMN could be far more than number of PAnF, so it’s unnecessary to have same identity number for PAnF as for AUSF. Besides legacy RID, Home Network Public Key identifier was reused as additional information to find AUSF of same PLMN in the case that Routing Indicator is not enough to provide SUPI range granularity, that means add RID in 5GPRUK ID may be still not enough to locate AUSF. Default RID may be used for AUSF, in that case, any AUSF could be selected by AMF. It may be fine to AUSF as it is somehow “stateless” . It could be OK to select PAnF when AUSF register 5GPRUK to a PAnF, but cannot work when AUSF needs to get 5GPRUK based on 5GPRUK ID later. There are also some issue-like scenarios for AKMA. Embodiments of the present disclosure provide some solutions for the above issues.

Principle and embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings. Reference is first made to Fig. 1, which illustrates an example communication system 100 in which embodiments of the present disclosure may be implemented. The system 100 includes a plurality of network devices in a core network 120. The system 100 also includes a plurality of terminal devices 110. In some embodiments, a terminal device 110 of the plurality of terminal devices 110 can be a relay terminal device or remote terminal device. The relay terminal device is capable of connecting and communicating with both the network device in the core network 120 and the remote terminal device. In some embodiments, two of the network devices in the core network 120 can communicate with each other. In some embodiments, the system can include another device (s) (not shown in the Fig. 1) , for example, base station (s) .

It is to be understood that the number of network devices and terminal devices 110 is only for the purpose of illustration without suggesting any limitations. The system 100 may include any suitable number of network devices and terminal devices 110 adapted for implementing embodiments of the present disclosure.

Communications in the communication system 100 may be implemented according to any proper communication protocol (s) , comprising, but not limited to, cellular communication protocols of the first generation (1G) , the second generation (2G) , the third generation (3G) , the fourth generation (4G) and the fifth generation (5G) and on the like, wireless local network communication protocols such as Institute for Electrical and Electronics Engineers (IEEE) 802.11 and the like, and/or any other protocols currently known or to be developed in the future. Moreover, the communication may utilize any proper wireless communication technology, comprising but not limited to: Code Division Multiple Access (CDMA) , Frequency Division Multiple Access (FDMA) , Time Division Multiple Access (TDMA) , Frequency Division Duplex (FDD) , Time Division Duplex (TDD) , Multiple-Input Multiple-Output (MIMO) , Orthogonal Frequency Division Multiple (OFDM) , Discrete Fourier Transform spread OFDM (DFT-s-OFDM) and/or any other technologies currently known or to be developed in the future.

The present disclosure provides a terminal device 110. Fig. 2 illustrates a flowchart of a method 200 implemented at a terminal device 110 according to some embodiments of the present disclosure. At block 210, the terminal device 110 may obtain a first routing indicator for an anchor function device for the terminal device 110. At block 220, the terminal device 110 may obtain a second routing indicator for an authentication server function (AUSF) device for the terminal device 110. At block 230, the terminal device 110 may send a communication establishment request including at least the first routing indicator and the second routing indicator.

In some embodiments, the method 200 may be applied to a ProSe use case (will be described in detail below) . In some embodiments, the terminal device 110 is specifically the remote UE.

In some embodiments, the terminal device 110 may generate a key identifier (ID) of the terminal device 110 to include the first routing indicator; and send the communication establishment request including at least the second routing indicator and the key ID.

In some embodiments, the communication establishment request may further include a home network public key ID (PKID) to be used by an AMF device. In some embodiments, the key ID, the second routing indicator, and the PKID are included in a subscription concealed identifier (SUCI) of the terminal device 110; and the SUCI is included in the communication establishment request.

In some other embodiments, the terminal device 110 may generate a key identifier (ID) of the terminal device 110 to include the first routing indicator and the second routing indicator; and send the communication establishment request including at least the key ID.

In some embodiments, the anchor function device may be a proximity based services (ProSe) anchor function device. The key ID may be a ProSe remote user key (PRUK) ID for 5G of the terminal device 110.

In some embodiments, the terminal device 110 is a remote terminal device, and the remote terminal device may send the communication establishment request by sending a ProSe direct link establishment request including the first routing indicator to be used by the AUSF device and the second routing indicator to be used by an access and mobility management (AMF) device of a relay terminal device.

In some embodiments, the terminal device 110 may obtain the first routing indicator by at least one of the following: receiving the first routing indicator provided by the AUSF device during an authentication procedure; receiving the first routing indicator provided by a unified data management (UDM) device during a user equipment (UE) parameter update (UPU) procedure; or retrieving the first routing indicator preconfigured in a universal integrated circuit card (UICC) of the terminal device 110.

In some embodiments, the terminal device 110 may receive the first routing indicator during the authentication procedure by: receiving an extensible authentication protocol (EAP) message including the first routing indicator during a ProSe specific authentication procedure.

In some embodiments, the terminal device 110 may receive the first routing indicator during the UPU procedure by: receiving UPU data including the first routing indicator during the UPU procedure.

Fig. 3 illustrates a flowchart of a method 300 implemented at a terminal device 110 according to some other embodiments of the present disclosure. At block 310, the terminal device 110 may receive a routing indicator for an anchor function device for the terminal device 110, the routing indicator being provided by an authentication server function (AUSF) device for the terminal device 110. At block 320, the terminal device 110 may send a communication establishment request including at least the routing indicator.

In some embodiments, the method 300 may be applied to a AKMA use case (will be described in detail below) .

In some embodiments, the routing indicator can be referred as a first routing indicator. the terminal device 110 may generate a key identifier (ID) of the terminal device 110 to include the first routing indicator; and send the communication establishment request including at least the key ID.

In some other embodiments, the routing indicator can be referred as a first routing indicator, and the terminal device 110 may generate a key identifier (ID) of the terminal device 110 to include a second routing indicator for an authentication server function (AUSF) device for the terminal device 110 and the first routing indicator; and send the communication establishment request including at least the key ID.

In some embodiments, the anchor function device is an authentication and key management for applications (AKMA) anchor function device. In some embodiments, the key ID may be an AKMA key ID (A-KID) of the terminal device 110. In some embodiments, the terminal device 110 may send the communication establishment request in a way of sending an application session establishment request including the routing indicator to be used by an application function device.

In some embodiments, the terminal device 110 may obtain the routing indicator by various ways, for example, the terminal device 110 may obtain the routing indicator by at least one of the following: receiving the routing indicator provided by the AUSF device during an authentication procedure; receiving, from a unified data management (UDM) device, the routing indicator during a user equipment (UE) parameter update (UPU) procedure; or retrieving the routing indicator preconfigured in a universal integrated circuit card (UICC) of the terminal device 110.

In some embodiments, the terminal device 110 may receive the routing indicator during the authentication procedure by a way of receiving an authentication request including the routing indicator during a primary authentication procedure.

In some embodiments, in order to receive the routing indicator during the UPU procedure, the terminal device 110 may receive UPU data including the routing indicator during the UPU procedure.

Fig. 4 illustrates a flowchart of a method 400 implemented at an authentication server function (AUSF) device according to some embodiments of the present disclosure. At block 410, the AUSF device may obtain a first routing indicator for an anchor function device for a terminal device 110. At block 420, the AUSF device may send the first routing indicator to be used by the terminal device 110.

In some embodiments, the anchor function device is a proximity based services (ProSe) anchor function (PAnF) device, and the key ID is a ProSe remote user key (PRUK) ID for 5G of the terminal device 110. These embodiments may be applied to the ProSe use case of the present disclosure.

In ProSe use case, in some embodiments, the terminal device 110 may be a remote terminal device, the AUSF device may be an AUSF device of the remote terminal device. The AUSF device may send the first routing indicator, specifically, the AUSF device may send the first routing indicator to be used for the remote terminal device.

In ProSe use case, in some embodiments, the terminal device 110 sends the first routing indicator, specifically, the AUSF device may send a ProSe authenticate response including the first routing indicator during a ProSe specific authentication procedure.

In some other embodiments, the anchor function device may be an authentication and key management for applications (AKMA) anchor function (AAnF) device; and the key ID may be an AKMA key ID (A-KID) of the terminal device 110. These embodiments may be applied to the AKMA use case of the present disclosure.

In the AKMA use case, the terminal device 110 sends the first routing indicator, specifically, the terminal device 110 may send an authentication response message including the first routing indicator during a primary authentication procedure.

In some embodiments, for example in the ProSe use case or the AKMA use case, the AUSF device may generate a key identifier (ID) for the terminal device 110 to include one of the following: the first routing indicator; or both a second routing indicator for the AUSF device for the terminal device 110 and the first routing indicator.

In some embodiments, for example in the ProSe use case or the AKMA use case, the AUSF device obtains the first routing indicator, specifically, the AUSF device may select the anchor function device from a plurality of anchor function devices, and retrieve a routing indicator of the selected anchor function device from a network function (NF) .

In some embodiments, in order to retrieve the routing indicator of the selected anchor function device from the NF, the AUSF device may retrieve the routing indicator of the selected anchor function device from NF profile of the anchor function device in one of: the anchor function device; or a network repository Function (NRF) device.

In some embodiments, for example in the ProSe use case or the AKMA use case, in order to obtain the first routing indicator, the AUSF device may receive, from a unified data management (UDM) device, the first routing indicator preconfigured in the UDM device.

Fig. 5 illustrates a flowchart of a method 500 implemented at an access and mobility management (AMF) device of a relay terminal device according to some embodiments of the present disclosure. At block 510, the AMF device may receive, from the relay terminal device, a relay key request including at least a routing indicator for an authentication server function (AUSF) device. At block 520, the AMF device may determine, based on the routing indicator, the AUSF device from a plurality of AUSF devices.

In some embodiments, the relay key request further may include a home network public key ID (PKID) , and the AMF device may determine the AUSF device from the plurality of AUSF devices by a way of determine, based on both the routing indicator and the PKID, the AUSF device from the plurality of AUSF devices.

The AMF device may be applied to the ProSe use case of the present disclosure.

Fig. 6 illustrates a flowchart of a method 600 implemented at a unified data management (UDM) device according to some embodiments of the present disclosure. At block 610, the UDM device may store a routing indicator for an anchor function device for a terminal device 110. At block 620, the UDM device may send the routing indicator to the terminal device 110 during a user equipment (UE) parameter update (UPU) procedure.

In some embodiments, in order to send the routing indicator during the UPU procedure, the UDM device may send UPU data including the routing indicator during the UPU procedure.

The UDM device may be applied to the ProSe use case or the AKMA use case of the present disclosure.

Take the ProSe use case as an example, Fig. 7 illustrates a schematic diagram of Direct Communication Request (DCR) after ProSe authentication according to some embodiments of the present disclosure. As shown in Fig. 7, 5GPRUK ID is included in DCR, and RID of the selected PAnF is used by the AUSF to generate 5GPRUK ID. In some embodiments, RID of the selected PAnF may be preconfigured in UDM and UE (UICC) . In some other embodiments, the AUSF may get from NRF or PAnF after the AUSF selecting a PAnF for 5GPRUK registration, thus the AUSF can pass RID of the selected PAnF to the UE during ProSe authentication.

With continued reference to Fig. 7, in some embodiments, when UE sends Direct Communication Request (DCR) after ProSe specific authentication, it includes also RID of AUSF in the DCR, besides 5GPRUK ID and other information. In these embodiments, AMF uses RID _AUSF (i.e. RID of the AUSF) to discover AUSF, and then AUSF uses RID _PAnF (i.e. RID of PAnF) in 5GPRUK ID to identify the PAnF the 5GPRUK registered to.

In some embodiments, the 5GPRUK ID is an example of ProSe remote user key (PRUK) ID for 5G. In some other embodiments, an example of the ProSe remote user key (PRUK) ID for 5G may be CP-PRUK. In some embodiments, DCR is an example of communication establishment request.

With continued reference to Fig. 7, in some embodiments, When UE sends Direct Communication Request (DCR) after ProSe specific authentication, it includes also RID of AUSF and optionally Home Network Public Key identifier (PKID) in the DCR, besides 5GPRUK ID and other information. AMF uses RID _AUSF, optionally Home Network Public Key identifier (e.g. in the case that Routing Indicator is not enough to provide SUPI range granularity) to discover AUSF, then AUSF uses RID _PAnF in 5GPRUK ID to identify the PAnF the 5GPRUK registered to.

In some embodiments, a new SUPI type could be introduced in SUCI for 5GPRUK ID. Then as structure of subscription concealed identifier (SUCI) below, 5GPRUK ID could be set to "scheme output" of a SUCI, SUPI type may be set to 4 (represent 5GPRUK ID) , Protection Scheme Id may be set to 0 (null schema) . Fig. 8 illustrates a structure of SUCI according to some embodiments of the present disclosure, as shown in Fig. 8, 5GPRUK ID could be set to "scheme output" of a SUCI, thus the 5GPRUK ID is included in a SUCI of the UE.

In some embodiments, the SUCI may be included in DCR regardless if the ProSe authentication happened or not.

In some embodiments, RID of AUSF and RID of PAnF is fetched by AUSF to generate 5GPRUK ID. With reference to Fig. 9, Fig. 9 illustrates a schematic diagram of 5G PRUK ID according to some embodiments of the present disclosure, both the RID of AUSF and the RID of PAnF are included in the 5GPRUK ID. In some embodiments, for UE to generate similar ID, the RID of PAnF can be preconfigured in UDM and UE. In some other embodiments, the RID of PAnF can be sent via UPU procedure or during ProSe authentication procedure, in other words, the UE can receive the RID of PAnF via UPU procedure. In some embodiments, the RID of PAnF transmitted via UPU procedure may be. configured for UDM by network side. When DCR message is sent with 5GPRUK ID, then AMF uses RID _AUSF, which is legacy RID for AUSF and UDM, to identify AUSF, and AUSF uses RID _PAnF to identify PAnF.

Similarly, in some other embodiments, RID in A-KID of AKMA case should be clarified and RID _AAnF (i.e. RID of AAnF) should be explicitly included in A-KID. Fig. 10 illustrates a schematic diagram of A-KID according to some embodiments of the present disclosure, as shown in Fig. 10, the RID of AAnF is included in A-KID.

Embodiments of the present disclosure are described below for ProSe use case and AKMA usecase respectively.

In the ProSe use case, as mentioned above, in some embodiments, the RID of PAnF is used in the 5GPRUK ID but the RID of AUSF is not used in the 5GPRUK ID. In these embodiments, the RID of AUSF may be retrieved from USIM (EF file) which can be included in DCR message. In some embodiments, the RID of AUSF is included in the SUCI of the DCR message.

Fig. 11A and Fig. 11B are taken as a whole to show a flow chart of interaction process 1100 between devices according to some embodiments of the present disclosure. Fig. 11B is continuation of Fig. 11A. In the process 1100, remote UE 111 is registered, authenticated by remote network (1101a) . Relay UE 112 is registered, authenticated by Relay network (1101b) . Model A or B discovery (with reference to TS 23.3.4 clause 6.3.1) (1101c) . The remote UE 111 transmits, to the relay UE-to-network 112, a ProSe Direct Link Establishment Request (SUCI, Nonce_1, Relay Service Code) (1102) . The relay UE-to-network 112 transmits, to AMF 113 of the relay UE 112, a Relay Key Request (SUCI, Nonce_1, Relay Service Code, transaction identifier) (1103) . The AMF 113 of the relay UE 112 authorizes the relay UE 112 (1104) . The AMF 113 of the relay UE 112 transmits, to an AUSF 114 of the remote UE 111, a Nausf_UEAuthenticate_ProseAuthenticate_Request (SUCI, Nonce_1, Relay Service Code) (1105) . The AUSF 114 of the remote UE 111, transmits, to an UDM 115 of the remote UE 111, a Nudm_UEAuthenticate_GetProseAV Request (SUCI, Relay Service Code, SNN) (1106a) . The UDM 115 of the remote UE 111, transmits, to the AUSF 114 of the remote UE 111, a Nudm_UEAuthenticate_GetProseAV Response (authType =EAP AKA prime, EAP AV, SUPI, RID _PAnF) (1106c) . The AUSF 114 of the remote UE 111 stores XRES, RID _PAnF (1106d) . The AUSF 114 of the remote UE 111 transmits, to the AMF 113 of the relay UE 112, a Nausf_UEAuthentication_ProSeAuthenticateResponse (authType=EAP AKA prime, EAP AV, RID _PAnF) (1107) . The AMF 113 of the relay UE 112, transmits to the relay UE-to-network 112, a Relay Auth Request (EAP message, transaction identifier, RID _PAnF) (1108) . The relay UE-to-network 112 transmits to the remote UE 111, a PC5 EAP message (with RAND, AUTN, RID _PAnF) (1109a) . The remote UE 111 stores RID _PAnF (1109b) . The remote UE 111 transmits, to the relay UE-to-network 112, a PC5 EAP Response message (with RES) (1109c) . The relay UE-to-network 112 transmits, to the AMF 113 of the relay UE 112, a Relay Auth Response (EAP message, transaction identifier) (1110) . The AMF 113 of the relay UE 112 transmits, to the AUSF 114 of the remote UE 111 a Nudm_UEAuthentication_ProSeAuthenticatieResponse (EAP message) (1111) . The AUSF 114 of the remote UE 111 may verify RES with XRES (1112a) . The AUSF 114 of the remote UE 111 generates 5G PRUK ID (including the RID _PAnF) , 5G PRUK (1112b) . The Remote UE 111 may generates 5GPRUK ID (including the RID _PAnF) , 5GPRUK (i.e. 5G PRUK) (1112c) ; The AUSF 114 of the remote UE 111 transmits, to a PAnF 116 of the remote UE 111, a Npanf_ProseKey_Register Request (5G PRUK ID, 5G PRUK, RSC, SUPI) (1113) . The PAnF 116 of the remote UE 111 may store ProSe Context (SUPI, RSC, 5G PRUK, 5G PRUK ID) (1114) . The PAnF 116 of the remote UE 111 transmits, to the AUSF 114 of the remote UE 111, a Npanf_ProseKey_Register Response (1115) . The AUSF 114 of the remote UE 111 generates K _{NR_Prose} (1116) . The AUSF 114 of the remote UE 111 transmits, to the AMF 113 of the relay UE 112, a Nausf_UEAuthenticate_ProseAuthenticate Response (Nonce_2, K _{NR_Prose}, EAP_Success) (1117) . The AMF 113 of the relay UE 112 transmits, to the relay UE-to-network 112, a Relay key response (EAP_Success, K _{NR_Prose}, Nonce_2) (1118) . The relay UE-to-network 112 transmits, to the remote UE 111, a Direct security mode command (EAP_Success, Nonce_2) (1119) . The remote UE 111 may generate K _{NR_Prose} (1120) . The remote UE 111 transmits, to the relay UE-to-network 112, a message indicating direct security mode complete (1121) . The remote UE 111 transmits, to the relay UE-to-network 112, ProSE Direct Link Establishment Accept (1122) . Next DCR message from UE will have the RID of the PAnF in the 5G PRUK ID and the RID of AUSF fetched separately from USIM (1123) .

The process shown in the flow charts of Fig. 11A and Fig. 11B, specifically, the process of the 1101a in Fig. 11A to 1122 in Fig. 11B may be referred to as a first stage of process of communication. Next DCR message mentioned at 1123 in Fig. 11B corresponds to a ProSe Direct Link Establishment Request sent by the remote UE to the relay UE in a second stage of process of communication. An example of the second stage of process of communication may be shown in Figs. 12A and 12B.

In the embodiments above, the UDM 115 of the remote UE 111, transmits, to the AUSF 114 of the remote UE 111, a Nudm_UEAuthenticate_GetProseAV Response including the RID of PAnF. The RID of PAnF may be preconfigured in the UDM 115.

In some other embodiments, instead preconfigure the PAnF 116 in the UDM 115, it's also possible that the AUSF 114 of the remote UE 111 dynamically selects a lower load PAnF for 5G ProSe registration with support of NRF. The AUSF 114 gets the RID of the PAnF 116 from NF profile of the PAnF 116 from the NRF, and generates the 5GPRUK ID based on the RID of the PAnF 116, then send the RID of the PAnF 116 to the UE 111 together with EAP success message.

Fig. 12A shows a flow chart of interaction process 1200 between devices according to some other embodiments of the present disclosure. In the process 1200, the remote UE 111 is registered, authenticated by remote network (1201a) . The relay UE (i.e. relay UE-to-network) 112 is registered, authenticated by relay network (1201b) . Model A or B discovery (with reference to TS 23.3.4 clause 6.3.1) (1201c) . The remoted UE 111 transmits, to the relay UE 112, a ProSe Direct Link Establishment Request (5GPRUK ID with RID of PAnF, Nonce_1, Relay Service Code, RID of AUSF) (1202) .

The relay UE 112 transmits, to the AMF 113 of the relay UE 112, a relay key request (including the 5GPRUK ID, Nonce_1, Relay Service Code, the RID of AUSF, transaction identifier) (1203) . The AMF 113 of the relay UE 112 authorizes the relay UE 112 (1204) . The AMF 113 of the relay UE 112 transmits, to the AUSF 114 of the remote UE 111, a Nausf_UEAuthenticate_ProseAuthenticate_Request (including the 5GPRUK ID, Nonce_1, Relay Service Code, SNN) (1205) . The AUSF 114 of the remote UE 111 transmits, to the PAnF 116 of the remote UE 111, a Npanf_ProseKey_getRequest (including the 5GPRUK ID, RSC) (1206a) . The PAnF 116 of the remote UE 111 transmits, to the AUSF 114 of the remote UE 111, a Npanf_ProseKey_getResponse (including the 5GPRUK) (1206b) . The AUSF 114 of the remote UE 111 generates K _{NR_Prose} (1207) . The AUSF 114 of the remote UE 111 transmits, to the AMF 113 of the relay UE 112, a Nausf_UEAuthentication_ProSeAuthenticate Response (including Nonce_2, K _{NR_Prose}, EAP_Success) (1208) . The AMF 113 of the relay UE 112 transmits a relay key response (including EAP success, K _{NR_Prose}, Nonce_2) to the relay UE 112 (1209) . The relay UE 112 transmits a direct security mode command (including EAP success, Nonce_2) to the remote UE 111 (1210) . The remote UE 111 may generate a K _{NR_Prose} (1211) . The remote UE 111 transmits, to a relay UE 112, a message indicating direct security mode complete (1212a) . The remote UE 111 transmits, to the relay UE-to-network 112, ProSE Direct Link Establishment Accept (1212b) . The process shown in the flow charts of Fig. 12A, specifically, the process of the 1201a to 1212b in Fig. 12A may be referred to as the second stage of process of communication, the second stage of process of communication is a subsequent stage of the first stage of process of communication in the whole communication process. Fig. 12B shows schematic diagram of generation of K _{NR_Prose} according to some other embodiments of the present disclosure.

In above process shown in the flow charts of Fig. 12A and Fig. 12B, the 5GPRUK ID contains the RID of PAnF 116. The RID of AUSF 114 (fetched from USIM) is included in the DCR message, optionally, the Home Network Public Key identifier is also included in the DCR message. The RID of AUSF 114, optionally with the Home Network Public Key identifier, can be used by the AMF 113 of relay UE 112 to route the message to a correct AUSF 114 (of Remote UE 111) .

In some other embodiments, in the ProSe use case, both the RID of PAnF 116 and the RID of AUSF 114 are included in the 5GPRUK ID. In some embodiments, during the ProSe remote UE authentication and authentication vector fetching phase by the AUSF 114, the UDM 115 provides both the RID _PAnF and the RID _AUSF (the RID of PAnF 116 and the RID of AUSF 114 entity respectively) . The AUSF 114 stores both RID temporarily. The RID of PAnF 116 is included in EAP message or 5G AKA message towards the UE 111.

In some embodiments, the remote UE 111 receives the RID of PAnF 116 and stores it. After RES comparison is successful, both the AUSF 114 and the remote UE 111 independently generates 5G PRUK ID with both RIDs (the RID of PAnF and the RID of AUSF) .

In some embodiments, when next DCR message is sent from the remote UE 111 with the 5G PRUK ID, the AMF 113 of the relay UE 112 can use the RID of AUSF to identify the AUSF 114 of the remote UE 111. Later the AUSF 114 will fetch the RID of the PAnF to identify the PAnF 116 of the remote UE 116.

Fig. 13A and Fig. 13B are taken as a whole to show a flow chart of interaction process 1300 between devices according to some other embodiments of the present disclosure. Fig. 13B is continuation of Fig. 13A. Fig. 13A and Fig. 13B as a whole may be as another example of the first stage of process of communication. For the second stage of process of communication, can refer to Fig. 12A.

In the process 1300, the Remote UE 111 is registered, authenticated by remote network (1301a) ; Relay UE 112 is registered, authenticated by relay network (1301b) ; . Model A or B discovery (with reference to TS 23.3.4 clause 6.3.1) (1301c) ; The remote UE 111 transmits, to the relay UE 112, a ProSe Direct Link Establishment Request (including the SUCI, Nonce_1, Relay Service Code) (1302) ; The relay UE 112 transmits, to the AMF 113 of the relay UE 112, a Relay Key Request (including the SUCI, Nonce_1, Relay Service Code, transaction identifier) (1303) ; The AMF 113 of the relay UE 112 authorizes the relay UE 112 (1304) ; The AMF 113 of the relay UE 112 transmits, to the AUSF 114 of the remote UE 111, a Nausf_UEAuthenticate_ProseAuthenticate_Request (including the SUCI, Nonce_1, Relay Service Code) (1305) ; The AUSF 114 of the remote UE 111, transmits, to an UDM 115 of the remote UE 111, a Nudm_UEAuthenticate_GetProseAV Request (including the SUCI, Relay Service Code, SNN) (1306a) ; The UDM 115 of the remote UE 111, transmits, to the AUSF 114 of the remote UE 111, a Nudm_UEAuthenticate_GetProseAV Response (authType =EAP AKA prime, EAP AV, SUPI, RID _PAnF) (1306c) ; The AUSF 114 of the remote UE 111 stores XRES, RID _PAnF (1306d) ; The AUSF 114 of the remote UE 111 transmits, to the AMF 113 of the relay UE 112, a Nausf_UEAuthentication_ProSeAuthenticateResponse (authType=EAP AKA prime, EAP AV, RID _PAnF) ) (1307) ; The AMF 113 of the relay UE 112, transmits to the relay UE-to-network 112, a Relay Auth Request (including EAP message, transaction identifier, RID _PAnF) (1308) ; The relay UE-to-network 112 transmits to the remote UE 111, a PC5 EAP message (with RAND, AUTN, RID _PAnF) (1309a) ; The remote UE 111 stores RID _PAnF (1309b) ; The remote UE 111 transmits, to the relay UE-to-network 112, a PC5 EAP Response message (with RES) (1309c) ; The relay UE-to-network 112 transmits, to the AMF 113 of the relay UE 112, a Relay Auth Response (EAP message, transaction identifier) (1310) ; The AMF 113 of the relay UE 112 transmits, to the AUSF 114 of the remote UE 111 a Nudm_UEAuthentication_ProSeAuthenticatieResponse (EAP message) (1311) ; The AUSF 114 of the remote UE 111 may verify RES with XRES (1312a) ; The AUSF 114 of the remote UE 111 may generate 5GPRUK ID (including RID _PAnF and RID _AUSF) , 5GPRUK (1312b) ; The Remote UE 111 may generate 5GPRUK ID (including RID _PAnF and RID _AUSF) , 5GPRUK (1312c) ; The AUSF 114 of the remote UE 111 transmits, to a PAnF 116 of the remote UE 111, a Npnf_ProseKey_Register Request (including the 5G PRUK ID, 5G PRUK, RSC, SUPI) (1313) ; The PAnF 1116 of the remote UE 111 may store Prose_Context (including SUPI, RSC, the 5G PRUK, the 5G PRUK ID) (1314) ; The PAnF 116 of the remote UE 111 transmits, to the AUSF 114 of the remote UE 111, a Npnf_ProseKey_Register Response (1315) ; The AUSF 114 of the remote UE 111 generates K _{NR_Prose} (1316) ; The AUSF 114 of the remote UE 111 transmits, to the AMF 113 of the relay UE 112, a Nausf_UEAuthenticate_ProseAuthenticate Response (including the Nonce_2, K _{NR_Prose}, EAP_Success) (1317) ; The AMF 113 of the relay UE 112 transmits, to the relay UE-to-network 112, a Relay key response (including EAP_Success, K _{NR_Prose}, Nonce_2) (1318) ; The relay UE-to-network 112 transmits, to the remote UE 111, a Direct security mode command (EAP success, Nonce_2) (1319) ; The remote UE 111 may generate K _{NR_Prose} (1320) ; The remote UE 111 transmits, to the relay UE-to-network 112, a message indicating Direct security mode complete (1321) ; The remote UE 111 transmits, to the relay UE-to-network 112, ProSe Direct Link Establishment Accept (1322) ; Next DCR message from UE will have both RID of AUSF and RID of PAnF in the 5GPRUK ID (1323) .

Fig. 14A and Fig. 14B are taken as a whole to show a flow chart of interaction process 1400 between devices according to some other embodiments of the present disclosure. Fig. 14B is continuation of Fig. 14A. Fig. 14A and Fig. 14B as a whole may be as another example of the first stage of process of communication. For the second stage of process of communication, can refer to Fig. 12A.

In the process 1400, the Remote UE 111 is registered, authenticated by a remote network (1401a) ; Relay UE 112 is registered, authenticated by the relay network (1401b) ; UPU procedure executed by the UDM 115 of the remote UE 111 to provide the RID of PAnF for the remoted UE 111 (1401c) . Model A or B discovery (with reference to TS 23.3.4 clause 6.3.1) (1401d) ; The remote UE 111 transmits, to the relay UE 112, a ProSe Direct Link Establishment Request (including the SUCI, Nonce_1, Relay Service Code) (1402) ; The relay UE 112 transmits, to the AMF 113 of the relay UE 112, a Relay Key Request (including the SUCI, Nonce_1, Relay Service Code, transaction identifier) (1403) ; The AMF 113 of the relay UE 112 authorizes the relay UE 112 (1404) ; The AMF 113 of the relay UE 112 transmits, to the AUSF114 of the remote UE 111, a Nausf_UEAuthenticate_ProseAuthenticate_Request (including the SUCI, Nonce_1, Relay Service Code) (1405) ; The AUSF 114 of the remote UE 111, transmits, to an UDM 115 of the remote UE 111, a Nudm_UEAuthenticate_GetProseAV Request (including the SUCI, Relay Service Code, SNN) (1406a) ; The UDM 115 of the remote UE 111, transmits, to the AUSF 114 of the remote UE 111, a Nudm_UEAuthenticate_GetProseAV Response (authType =EAP AKA prime, EAP AV, SUPI, RID _PAnF) (1406c) ; The AUSF 114 of the remote UE 111 stores XRES, RID _PAnF (1406d) ; The AUSF 114 of the remote UE 111 transmits, to the AMF 113 of the relay UE 112, a Nausf_UEAuthentication_ProSeAuthenticateResponse (authType=EAP AKA prime, EAP AV, ) (1407) ; The AMF 113 of the relay UE 112, transmits to the relay UE-to-network 112, a Relay Auth Request (including EAP message, transaction identifier) (1408) ; The relay UE-to-network 112 transmits to the remote UE 111, a PC5 EAP message (with RAND, AUTN) (1409a) ; The remote UE 111 may verify AUTN and generate RES (1409b) ; The remote UE 111 transmits, to the relay UE-to-network 112, a PC5 EAP Response message (with RES) (1409c) ; The relay UE-to-network 112 transmits, to the AMF 113 of the relay UE 112, a Relay Auth Response (EAP message, transaction identifier) (1410) ; The AMF 113 of the relay UE 112 transmits, to the AUSF 114 of the remote UE 111 a Nudm_UEAuthentication_ProSeAuthenticatieResponse (EAP message) (1411) ; The AUSF 114 of the remote UE 111 may verify RES with XRES (1412a) ; The AUSF 114 of the remote UE 111 may generate 5GPRUK ID (including RID _PAnF and RID _AUSF) , 5GPRUK (1412b) ; The Remote UE 111 may generate 5GPRUK ID (including RID _PAnF and RID _AUSF) , 5GPRUK (1412c) ; The AUSF 114 of the remote UE 111 transmits, to a PAnF 116 of the remote UE 111, a Npnf_ProseKey_Register Request (including the 5G PRUK ID, 5G PRUK, RSC, SUPI) (1413) ; The PAnF 116 of the remote UE 111 may store Prose_Context (including SUPI, RSC, the 5G PRUK, the 5G PRUK ID) (1414) ; The PAnF 116 of the remote UE 111 transmits, to the AUSF 114 of the remote UE 111, a Npnf_ProseKey_Register Response (1415) ; The AUSF 114 of the remote UE 111 generates K _{NR_Prose} (1416) ; The AUSF 114 of the remote UE 111 transmits, to the AMF 113 of the relay UE 112, a Nausf_UEAuthenticate_ProseAuthenticate Response (including the Nonce_2, K _{NR_Prose}, EAP_Success) (1417) ; The AMF 113 of the relay UE 112 transmits, to the relay UE-to-network 112, a Relay key response (including EAP_Success, K _{NR_Prose}, Nonce_2) (1418) ; The relay UE-to-network 112 transmits, to the remote UE 111, a Direct security mode command (EAP success, Nonce_2) (1419) ; The remote UE 111 may generate K _{NR_Prose} (1420) ; The remote UE 111 transmits, to the relay UE-to-network 112, a message indicating Direct security mode complete (1421) ; The remote UE 111 transmits, to the relay UE-to-network 112, ProSe Direct Link Establishment Accept message (1422) ; Next DCR message from UE will have both the RID of AUSF and the RID of PAnF in the 5GPRUK ID (1423) .

In some embodiments, with reference to Fig. 14A, if the RID of the PAnF of the remote UE 111 is considered as very sensitive data, it can be sent to UE 111 after initial registration and if the UE 111 is capable and authorized to use ProSe U2N relay service, via the UPU procedure (the RID of AUSF provisioning available already for the UPU procedure) . This will avoid any attacker getting hold of the RID of PAnF. In this case, the RID of PAnF during AKA challenge need not be sent in clear (unprotected) to UE 111.

In some embodiments, instead preconfigure the PAnF 116 in the UDM 115, the AUSF 114 of the remote UE 111 may dynamically select a lower load PAnF 116 for 5G ProSe registration with support of NRF. In some embodiments, the AUSF 114 may select a PAnf 116 (an example of anchor function device) from a plurality of PAnfs 116, and retrieve a RID of the selected PAnf 116 from a network function (NF) . In some embodiments, the AUSF 114 may get RID of the PAnF 116 from NF profile of the PAnF 116 from NRF or PAnF 116, and generated 5GPRUK ID based on the RID of the PAnF 116, then send the RID of the PAnf 116 to the UE 111 together with EAP success message.

Fig. 15 shows a flow chart of interaction process between devices according to some other embodiments of the present disclosure. In this process, with reference to Fig. 15, the UE may transmit, to an AUSF, a request including (SUPI/SUCI) , the AUSF may transmit, to an UDM, a Nudm_UEAuthentication Get Request (including the SUPI/SUCI) , the UDM may sent back to the AUSF, Nudm_UEAuthentication Get Response (including AV, AKMA Ind, the RID of an AAnF) , the RID of the AAnF is sent to the UE by the AUSF during primary authentication.

In this AKMA use case, similar to Prose use case, the RID _AAnF is used in A-KID and the RID of AUSF is not used in A-KID. The RID _AANF is sent during primary authentication to UE from the UDM.

In some embodiments, the AUSF may transmit a discovery request to a NRF, and the NRF sent back a discovery response including an AAnF instance to the AUSF. In some embodiments, the AUSF may further transmit a Naanf_AKMA_AnchorKey_Register Request (including the SUPI, the A-KID, K _AKMA) to the AAnF. The AAnF may store AKMA Context (including SUPI, K _AKMA, A-KID) , and sent back to the AUSF, a Naanf_AKMA_AnchorKey_Response.

Similar to Prose use case, with reference to Fig. 15, the process above in the AKMA use case may be referred as a first stage of process of communication. In a second stage of process of communication, the UE may transmit, to a trusted AF an application session establishment request (including the A-KID with the RID of AAnF. The trusted AF may send back to the UE, an application session establishment response.

Fig. 16 shows a flow chart of interaction process between devices according to some other embodiments of the present disclosure. In this process, with reference to Fig. 16, the UE may transmit, to the AUSF, a request including (SUPI/SUCI) . The AUSF may transmit, to the UDM, a Nudm_UEAuthentication Get Request (including the SUPI/SUCI) , the UDM may sent back to the AUSF, Nudm_UEAuthentication Get Response (including AV, AKMA Ind, the RID of the AAnF, the RID of the AUSF) , the RID of the AAnF is sent to the UE by the AUSF during primary authentication.

In this AKMA use case, similar to Prose use case, the RID of AUSF and the RID of AAnF (RID _AAnF) are used in both UE and AUSF when A-KID is generated during AKMA procedure. The RID _AAnF may be sent from the AUSF to the UE during primary authentication.

Similar to Prose use case, with reference to Fig. 16, the process above in the AKMA use case may be referred as a first stage of process of communication. In a second stage of process of communication, the UE may transmit, to a trusted AF an application session establishment request (including the A-KID with the RID of the AAnF and the RID of the AUSF. The trusted AF may send back to the UE, an application session establishment response.

With reference to Fig. 15 or Fig. 16, the AAnF may transmit to the trusted AF, a Naanf_AKMA_ApplicationKey_Get_Request (including the A-KID, AF_ID ₁) . The AF_ID ₁ is used for the AAnF to generate a key (K _AF1) . The AAnF may transmit a Naanf_AKMA_ApplicationKey_Get_Response (including the K _AF1, K _AF1 exptime, the SUPI) .

In some embodiments, an apparatus capable of performing any of the method 200 (for example, the terminal device 110) may comprise means for performing the respective steps of the method 200. The means may be implemented in any suitable form. For example, the means may be implemented in a circuitry or software module.

In some embodiments, the apparatus comprises means for obtaining, at a terminal device 110, a first routing indicator for an anchor function device for the terminal device 110; means for obtaining a second routing indicator for an authentication server function (AUSF) device for the terminal device 110; and means for sending a communication establishment request including at least the first routing indicator and the second routing indicator.

In some embodiments, the apparatus further comprises means for generating a key identifier (ID) of the terminal device 110 to include the first routing indicator; and means for sending the communication establishment request including at least the second routing indicator and the key ID.

In some embodiments, the communication establishment request further includes a home network public key ID (PKID) to be used by an AMF device.

In some embodiments, the key ID, the second routing indicator, and the PKID are included in a subscription concealed identifier (SUCI) of the terminal device 110; and the SUCI is included in the communication establishment request.

In some embodiments, the apparatus further comprises means for generating a key identifier (ID) of the terminal device 110 to include the first routing indicator and the second routing indicator; and means for sending the communication establishment request including at least the key ID.

In some embodiments, the anchor function device is a proximity based services (ProSe) anchor function device; the key ID is a ProSe remote user key (PRUK) ID for 5G of the terminal device 110; the terminal device 110 is a remote terminal device; and means for sending the communication establishment request comprises means for sending a ProSe direct link establishment request including the first routing indicator to be used by the AUSF device and the second routing indicator to be used by an access and mobility management (AMF) device of a relay terminal device.

In some embodiments, the means for obtaining the first routing indicator comprises at least one of: means for receiving the first routing indicator provided by the AUSF device during an authentication procedure; means for receiving the first routing indicator provided by a unified data management (UDM) device during a user equipment (UE) parameter update (UPU) procedure; or means for retrieving the first routing indicator preconfigured in a universal integrated circuit card (UICC) of the terminal device 110.

In some embodiments, the means for receiving the first routing indicator during the authentication procedure comprises means for receiving an extensible authentication protocol (EAP) message including the first routing indicator during a ProSe specific authentication procedure.

In some embodiments, the means for receiving the first routing indicator during the UPU procedure comprises means for receiving UPU data including the first routing indicator during the UPU procedure.

In some embodiments, the apparatus further comprises means for performing other steps in some embodiments of the method 200. In some embodiments, the means comprises at least one processor; and at least one memory including computer program code, the at least one memory and computer program code configured to, with the at least one processor, cause the performance of the apparatus.

In some embodiments, an apparatus capable of performing any of the method 300 (for example, the terminal device 110) may comprise means for performing the respective steps of the method 300. The means may be implemented in any suitable form. For example, the means may be implemented in a circuitry or software module.

In some embodiments, the apparatus comprises means for receiving, at a terminal device 110, a routing indicator for an anchor function device for the terminal device 110, the routing indicator being provided by an authentication server function (AUSF) device for the terminal device 110; and means for sending a communication establishment request including at least the routing indicator.

In some embodiments, the routing indicator is a first routing indicator, and the apparatus further comprises means for generating a key identifier (ID) of the terminal device 110 to include the first routing indicator; and means for sending the communication establishment request including at least the key ID.

In some embodiments, the routing indicator is a first routing indicator, and the apparatus further comprises means for generating a key identifier (ID) of the terminal device 110 to include a second routing indicator for an authentication server function (AUSF) device for the terminal device 110 and the first routing indicator; and means for sending the communication establishment request including at least the key ID.

In some embodiments, the anchor function device is an authentication and key management for applications (AKMA) anchor function device; the key ID is an AKMA key ID (A-KID) of the terminal device 110; and the means for send the communication establishment request comprises means for sending an application session establishment request including the routing indicator to be used by an application function device.

In some embodiments, the means for obtaining the routing indicator comprises at least one of: means for receiving the routing indicator provided by the AUSF device during an authentication procedure; means for receiving, from a unified data management (UDM) device, the routing indicator during a user equipment (UE) parameter update (UPU) procedure; or means for retrieving the routing indicator preconfigured in a universal integrated circuit card (UICC) of the terminal device 110.

In some embodiments, the means for receiving the routing indicator during the authentication procedure comprises means for receiving an authentication request including the routing indicator during a primary authentication procedure.

In some embodiments, the means for receiving the routing indicator during the UPU procedure comprises means for receiving UPU data including the routing indicator during the UPU procedure.

In some embodiments, the apparatus further comprises means for performing other steps in some embodiments of the method 300. In some embodiments, the means comprises at least one processor; and at least one memory including computer program code, the at least one memory and computer program code configured to, with the at least one processor, cause the performance of the apparatus.

In some embodiments, an apparatus capable of performing any of the method 400 (for example, the terminal device 110) may comprise means for performing the respective steps of the method 400. The means may be implemented in any suitable form. For example, the means may be implemented in a circuitry or software module.

In some embodiments, the apparatus comprises means for obtaining, at an authentication server function (AUSF) device, a first routing indicator for an anchor function device for a terminal device 110; and means for sending the first routing indicator to be used by the terminal device 110.

In some embodiments, the anchor function device is a proximity based services (ProSe) anchor function (PAnF) device; and the key ID is a ProSe remote user key (PRUK) ID for 5G of the terminal device 110.

In some embodiments, the terminal device 110 is a remote terminal device, the AUSF device is an AUSF device of the remote terminal device, and the means for sending the first routing indicator comprises means for sending the first routing indicator to be used for the remote terminal device.

In some embodiments, the means for sending the first routing indicator comprises means for sending a ProSe authenticate response including the first routing indicator during a ProSe specific authentication procedure.

In some embodiments, the anchor function device is an authentication and key management for applications (AKMA) anchor function (AAnF) device; and the key ID is an AKMA key ID (A-KID) of the terminal device 110.

In some embodiments, the means for sending the first routing indicator comprises means for sending an authentication response message including the first routing indicator during a primary authentication procedure.

In some embodiments, the AUSF device further comprises means for generating a key identifier (ID) for the terminal device 110 to include one of the following: the first routing indicator; or both a second routing indicator for the AUSF device for the terminal device 110 and the first routing indicator.

In some embodiments, the means for obtaining the first routing indicator comprises means for selecting the anchor function device from a plurality of anchor function devices; and means for retrieving a routing indicator of the selected anchor function device from a network function (NF) .

In some embodiments, the means for retrieving the routing indicator of the selected anchor function device from the NF comprises means for retrieving the routing indicator of the selected anchor function device from NF profile of the anchor function device in one of: the anchor function device; or a network repository Function (NRF) device.

In some embodiments, the means for obtaining the first routing indicator comprises means for receiving, from a unified data management (UDM) device, the first routing indicator preconfigured in the UDM device.

In some embodiments, the apparatus further comprises means for performing other steps in some embodiments of the method 400. In some embodiments, the means comprises at least one processor; and at least one memory including computer program code, the at least one memory and computer program code configured to, with the at least one processor, cause the performance of the apparatus.

In some embodiments, an apparatus capable of performing any of the method 500 (for example, the terminal device 110) may comprise means for performing the respective steps of the method 500. The means may be implemented in any suitable form. For example, the means may be implemented in a circuitry or software module.

In some embodiments, the apparatus comprises means for receiving, at an access and mobility management (AMF) device of a relay terminal device, from the relay terminal device, a relay key request including at least a routing indicator for an authentication server function (AUSF) device; and means for determining, based on the routing indicator, the AUSF device from a plurality of AUSF devices.

In some embodiments, the relay key request further includes a home network public key ID (PKID) ; and the means for determining the AUSF device from the plurality of AUSF devices comprise means for determining, based on both the routing indicator and the PKID, the AUSF device from the plurality of AUSF devices.

In some embodiments, the apparatus further comprises means for performing other steps in some embodiments of the method 500. In some embodiments, the means comprises at least one processor; and at least one memory including computer program code, the at least one memory and computer program code configured to, with the at least one processor, cause the performance of the apparatus.

In some embodiments, an apparatus capable of performing any of the method 300 (for example, the terminal device 110) may comprise means for performing the respective steps of the method 600. The means may be implemented in any suitable form. For example, the means may be implemented in a circuitry or software module.

In some embodiments, the apparatus comprises means for storing, at a unified data management (UDM) device, a routing indicator for an anchor function device for a terminal device 110; and means for sending the routing indicator to the during a user equipment (UE) parameter update (UPU) procedure.

In some embodiments, the means for sending the routing indicator during the UPU procedure comprises means for sending UPU data including the routing indicator during the UPU procedure.

In some embodiments, the apparatus further comprises means for performing other steps in some embodiments of the method 600. In some embodiments, the means comprises at least one processor; and at least one memory including computer program code, the at least one memory and computer program code configured to, with the at least one processor, cause the performance of the apparatus.

FIG. 17 is a simplified block diagram of a device 1700 that is suitable for implementing embodiments of the present disclosure. The device 1700 may be provided to implement the communication device, for example the terminal device 110, the network devices in the core network 120 as shown in Fig. 1. As shown, the device 1700 includes one or more processors 1710, one or more memories 1740 coupled to the processor 1710, and one or more transmitters and/or receivers (TX/RX) 1740 coupled to the processor 1710.

The TX/RX 1740 is for bidirectional communications. The TX/RX 1740 has at least one antenna to facilitate communication. The communication interface may represent any interface that is necessary for communication with other network elements.

The processor 1710 may be of any type suitable to the local technical network and may include one or more of the following: general purpose computers, special purpose computers, microprocessors, digital signal processors (DSPs) and processors based on multicore processor architecture, as non-limiting examples. The device 1700 may have multiple processors, such as an application specific integrated circuit chip that is slaved in time to a clock which synchronizes the main processor.

The memory 1720 may include one or more non-volatile memories and one or more volatile memories. Examples of the non-volatile memories include, but are not limited to, a Read Only Memory (ROM) 1724, an electrically programmable read only memory (EPROM) , a flash memory, a hard disk, a compact disc (CD) , a digital video disk (DVD) , and other magnetic storage and/or optical storage. Examples of the volatile memories include, but are not limited to, a random access memory (RAM) 1722 and other volatile memories that will not last in the power-down duration.

A computer program 1730 includes computer executable instructions that are executed by the associated processor 1710. The program 1730 may be stored in the ROM 1020. The processor 1710 may perform any suitable actions and processing by loading the program 1730 into the RAM 1020.

The embodiments of the present disclosure may be implemented by means of the program 1730 so that the device 1700 may perform any process of the disclosure as discussed with reference to Figs. 2 to 16. The embodiments of the present disclosure may also be implemented by hardware or by a combination of software and hardware.

In some embodiments, the program 1730 may be tangibly contained in a computer readable medium which may be included in the device 1700 (such as in the memory 1720) or other storage devices that are accessible by the device 1700. The device 1700 may load the program 1730 from the computer readable medium to the RAM 1722 for execution. The computer readable medium may include any types of tangible non-volatile storage, such as ROM, EPROM, a flash memory, a hard disk, CD, DVD, and the like. Fig. 18 shows an example of the computer readable medium 1800 in form of CD or DVD. The computer readable medium has the program 1730 stored thereon.

Generally, various embodiments of the present disclosure may be implemented in hardware or special purpose circuits, software, logic or any combination thereof. Some aspects may be implemented in hardware, while other aspects may be implemented in firmware or software which may be executed by a controller, microprocessor or other computing device. While various aspects of embodiments of the present disclosure are illustrated and described as block diagrams, flowcharts, or using some other pictorial representations, it is to be understood that the block, apparatus, system, technique or method described herein may be implemented in, as non-limiting examples, hardware, software, firmware, special purpose circuits or logic, general purpose hardware or controller or other computing devices, or some combination thereof.

The present disclosure also provides at least one computer program product tangibly stored on a non-transitory computer readable storage medium. The computer program product includes computer-executable instructions, such as those included in program modules, being executed in a device on a target real or virtual processor, to carry out the method 1700 as described above with reference to Figs. 2-16. Generally, program modules include routines, programs, libraries, objects, classes, components, data structures, or the like that perform particular tasks or implement particular abstract data types. The functionality of the program modules may be combined or split between program modules as desired in various embodiments. Machine-executable instructions for program modules may be executed within a local or distributed device. In a distributed device, program modules may be located in both local and remote storage media.

Program code for carrying out methods of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general purpose computer, special purpose computer, or other programmable data processing apparatus, such that the program codes, when executed by the processor or controller, cause the functions/operations specified in the flowcharts and/or block diagrams to be implemented. The program code may execute entirely on a machine, partly on the machine, as a stand-alone software package, partly on the machine and partly on a remote machine or entirely on the remote machine or server.

In the context of the present disclosure, the computer program codes or related data may be carried by any suitable carrier to enable the device, apparatus or processor to perform various processes and operations as described above. Examples of the carrier include a signal, computer readable medium, and the like.

The computer readable medium may be a computer readable signal medium or a computer readable storage medium. A computer readable medium may include but not limited to an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of the computer readable storage medium would include an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM) , a read-only memory (ROM) , an erasable programmable read-only memory (EPROM or Flash memory) , an optical fiber, a portable compact disc read-only memory (CD-ROM) , an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. The term “non-transitory, ” as used herein, is a limitation of the medium itself (i.e., tangible, not a signal) as opposed to a limitation on data storage persistency (e.g., RAM vs. ROM) .

Further, while operations are depicted in a particular order, this should not be understood as requiring that such operations be performed in the particular order shown or in sequential order, or that all illustrated operations be performed, to achieve desirable results. In certain circumstances, multitasking and parallel processing may be advantageous. Likewise, while several specific implementation details are contained in the above discussions, these should not be construed as limitations on the scope of the present disclosure, but rather as descriptions of features that may be specific to particular embodiments. Certain features that are described in the context of separate embodiments may also be implemented in combination in a single embodiment. Conversely, various features that are described in the context of a single embodiment may also be implemented in multiple embodiments separately or in any suitable sub-combination.

Although the present disclosure has been described in languages specific to structural features and/or methodological acts, it is to be understood that the present disclosure defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.

Claims

A terminal device comprising:

at least one processor; and

at least one memory storing instructions that, when executed by the at least one processor, cause the terminal device at least to:

obtain a first routing indicator for an anchor function device for the terminal device;

obtain a second routing indicator for an authentication server function (AUSF) device for the terminal device; and

send a communication establishment request including at least the first routing indicator and the second routing indicator.
The terminal device of claim 1, wherein the terminal device is further caused to:

generate a key identifier (ID) of the terminal device to include the first routing indicator; and

send the communication establishment request including at least the second routing indicator and the key ID.
The terminal device of claim 2, wherein the communication establishment request further includes a home network public key ID (PKID) to be used by an AMF device.
The terminal device of claim 3, wherein:

the key ID, the second routing indicator, and the PKID are included in a subscription concealed identifier (SUCI) of the terminal device; and

the SUCI is included in the communication establishment request.
The terminal device of claim 1, wherein the terminal device is further caused to:

generate a key identifier (ID) of the terminal device to include the first routing indicator and the second routing indicator; and

send the communication establishment request including at least the key ID.
The terminal device of any of claims 1-5, wherein:

the anchor function device is a proximity based services (ProSe) anchor function device;

the key ID is a ProSe remote user key (PRUK) ID for 5G of the terminal device;

the terminal device is a remote terminal device; and

the remote terminal device is caused to send the communication establishment request by:

sending a ProSe direct link establishment request including the first routing indicator to be used by the AUSF device and the second routing indicator to be used by an access and mobility management (AMF) device of a relay terminal device.
The terminal device of any of claims 1-6, wherein the terminal device is caused to obtain the first routing indicator by at least one of the following:

receiving the first routing indicator provided by the AUSF device during an authentication procedure;

receiving the first routing indicator provided by a unified data management (UDM) device during a user equipment (UE) parameter update (UPU) procedure; or

retrieving the first routing indicator preconfigured in a universal integrated circuit card (UICC) of the terminal device.
The terminal device of claim 7, wherein the terminal device is caused to receive the first routing indicator during the authentication procedure by:

receiving an extensible authentication protocol (EAP) message including the first routing indicator during a ProSe specific authentication procedure.
The terminal device of claim 7, wherein the terminal device is caused to receive the first routing indicator during the UPU procedure by:

receiving UPU data including the first routing indicator during the UPU procedure.
A terminal device comprising:

at least one processor; and

at least one memory storing instructions that, when executed by the at least one processor, cause the terminal device at least to:

receive a routing indicator for an anchor function device for the terminal device, the routing indicator being provided by an authentication server function (AUSF) device for the terminal device; and

send a communication establishment request including at least the routing indicator.
The terminal device of claim 10, wherein the routing indicator is a first routing indicator, and

the terminal device is further caused to:

generate a key identifier (ID) of the terminal device to include the first routing indicator; and

send the communication establishment request including at least the key ID.
The terminal device of claim 10, wherein the routing indicator is a first routing indicator, and

the terminal device is further caused to:

generate a key identifier (ID) of the terminal device to include a second routing indicator for an authentication server function (AUSF) device for the terminal device and the first routing indicator; and

send the communication establishment request including at least the key ID.
The terminal device of any of claims 10-12, wherein:

the anchor function device is an authentication and key management for applications (AKMA) anchor function device;

the key ID is an AKMA key ID (A-KID) of the terminal device; and

the terminal device is caused to send the communication establishment request by:

sending an application session establishment request including the routing indicator to be used by an application function device.
The terminal device of any of claims 10-13, wherein the terminal device is caused to obtain the routing indicator by at least one of the following:

receiving the routing indicator provided by the AUSF device during an authentication procedure;

receiving, from a unified data management (UDM) device, the routing indicator during a user equipment (UE) parameter update (UPU) procedure; or

retrieving the routing indicator preconfigured in a universal integrated circuit card (UICC) of the terminal device.
The terminal device of claim 14, wherein the terminal device is caused to receive the routing indicator during the authentication procedure by:

receiving an authentication request including the routing indicator during a primary authentication procedure.
The terminal device of claim 14, wherein the terminal device is caused to receive the routing indicator during the UPU procedure by:

receiving UPU data including the routing indicator during the UPU procedure.
An authentication server function (AUSF) device comprising:

at least one processor; and

at least one memory storing instructions that, when executed by the at least one processor, cause the AUSF device at least to:

obtain a first routing indicator for an anchor function device for a terminal device; and

send the first routing indicator to be used by the terminal device.
The AUSF device of claim 17, wherein:

the anchor function device is a proximity based services (ProSe) anchor function (PAnF) device; and

the key ID is a ProSe remote user key (PRUK) ID for 5G of the terminal device.
The AUSF device of claim 18, wherein the terminal device is a remote terminal device, the AUSF device is an AUSF device of the remote terminal device, and the AUSF device is caused to send the first routing indicator by:

send the first routing indicator to be used for the remote terminal device.
The AUSF device of claim 18, wherein the terminal device is caused to send the first routing indicator by:

sending a ProSe authenticate response including the first routing indicator during a ProSe specific authentication procedure.
The AUSF device of claim 17, wherein:

the anchor function device is an authentication and key management for applications (AKMA) anchor function (AAnF) device; and

the key ID is an AKMA key ID (A-KID) of the terminal device.
The AUSF device of claim 21, wherein the terminal device is caused to send the first routing indicator by:

send an authentication response message including the first routing indicator during a primary authentication procedure.
The AUSF device of any of claims 17-22, the AUSF device is further caused to:

generate a key identifier (ID) for the terminal device to include one of the following:

the first routing indicator; or

both a second routing indicator for the AUSF device for the terminal device and the first routing indicator.
The AUSF device of any of claims 17-23, wherein the AUSF device is caused to obtain the first routing indicator by:

selecting the anchor function device from a plurality of anchor function devices; and

retrieving a routing indicator of the selected anchor function device from a network function (NF) .
The AUSF device of claim 24, wherein the AUSF device is caused to retrieve the routing indicator of the selected anchor function device from the NF by:

retrieve the routing indicator of the selected anchor function device from NF profile of the anchor function device in one of:

the anchor function device; or

a network repository Function (NRF) device.
The AUSF device of any of claims 17-23, wherein the AUSF device is caused to obtain the first routing indicator by:

receiving, from a unified data management (UDM) device, the first routing indicator preconfigured in the UDM device.
An access and mobility management (AMF) device of a relay terminal device, comprising:

at least one processor; and

at least one memory storing instructions that, when executed by the at least one processor, cause the AMF device at least to:

receive, from the relay terminal device, a relay key request including at least a routing indicator for an authentication server function (AUSF) device; and

determine, based on the routing indicator, the AUSF device from a plurality of AUSF devices.
The AMF device of claim 27, wherein the relay key request further includes a home network public key ID (PKID) ; and

the AMF device is caused to determine the AUSF device from the plurality of AUSF devices by:

determine, based on both the routing indicator and the PKID, the AUSF device from the plurality of AUSF devices.
An unified data management (UDM) device comprising:

at least one processor; and

at least one memory storing instructions that, when executed by the at least one processor, cause the UDM device at least to:

store a routing indicator for an anchor function device for a terminal device; and

send the routing indicator to the terminal device during a user equipment (UE) parameter update (UPU) procedure.
The UDM device of claim 29, wherein the UDM device is caused to send the routing indicator during the UPU procedure by:

sending UPU data including the routing indicator during the UPU procedure.
A method comprising:

obtaining, at a terminal device, a first routing indicator for an anchor function device for the terminal device;

obtaining a second routing indicator for an authentication server function (AUSF) device for the terminal device; and

sending a communication establishment request including at least the first routing indicator and the second routing indicator.
A method comprising:

receiving, at a terminal device, a routing indicator for an anchor function device for the terminal device, the routing indicator being provided by an authentication server function (AUSF) device for the terminal device; and

sending a communication establishment request including at least the routing indicator.
A method comprising:

obtaining, at an authentication server function (AUSF) device, a first routing indicator for an anchor function device for a terminal device; and

sending the first routing indicator to be used by the terminal device.
A method comprising:

receiving, at an access and mobility management (AMF) device of a relay terminal device, from the relay terminal device, a relay key request including at least a routing indicator for an authentication server function (AUSF) device; and

determining, based on the routing indicator, the AUSF device from a plurality of AUSF devices.
A method comprising:

storing, at a unified data management (UDM) device, a routing indicator for an anchor function device for a terminal device; and

sending the routing indicator to the terminal device during a user equipment (UE) parameter update (UPU) procedure.
An apparatus comprising:

means for obtaining, at a terminal device, a first routing indicator for an anchor function device for the terminal device;

means for obtaining a second routing indicator for an authentication server function (AUSF) device for the terminal device; and

means for sending a communication establishment request including at least the first routing indicator and the second routing indicator.
An apparatus comprising:

means for receiving, at a terminal device, a routing indicator for an anchor function device for the terminal device, the routing indicator being provided by an authentication server function (AUSF) device for the terminal device; and

means for sending a communication establishment request including at least the routing indicator.
An apparatus comprising:

means for obtaining, at an authentication server function (AUSF) device, a first routing indicator for an anchor function device for a terminal device; and

means for sending the first routing indicator to be used by the terminal device.
An apparatus comprising:

means for receiving, at an access and mobility management (AMF) device of a relay terminal device, from the relay terminal device, a relay key request including at least a routing indicator for an authentication server function (AUSF) device; and

means for determining, based on the routing indicator, the AUSF device from a plurality of AUSF devices.
An apparatus comprising:

means for storing, at a unified data management (UDM) device, a routing indicator for an anchor function device for a terminal device; and

means for sending the routing indicator to the terminal device during a user equipment (UE) parameter update (UPU) procedure.
A non-transitory computer readable medium comprising program instructions that, when executed by an apparatus, cause the apparatus to perform at least the method of any of claims 31-35.