Patent Description:
In the <NUM> system, for roaming scenarios, a Network Function (NF) in the visited PLMN needs to interact with Network Functions in a home PLMN. Such signaling interaction must traverse a border entity called SEPP (Security Edge Protection Proxy), located in the edge of both PLMNs.

The security requirements of the signaling typically impose the requirement to protect via TLS (Transport Layer Security) the signaling between NFs, even inside a given PLMN. Therefore, the URIs (Uniform Resource Identifier) used by the visited NF to address a given NF in the home PLMN are usually "https" URIs. an AMF (vPLMN) interacting with UDM (hPLMN) could use the following URI:
https://udm1. home-operator. com/nudm-sdm/v1/.

At the same time, the SEPP located in the visited PLMN needs to be able to access the contents of the message, in clear text, to apply a certain business logic.

However, using TLS (https) requires the message to be encrypted end-to-end, making it impossible for the SEPP to get access to the message.

To solve this, the concept of "Telescopic Fully Qualified Domain Name (FQDN)" was introduced in TS <NUM>, with the goal to terminate the TLS connection at the visited SEPP. The example URI above would be transformed into:
https://udm1. home-operator. visited-operator. com
(That is, in this telescopic FQDN the FQDN of the home UDM is concatenated with the FQDN of the visited SEPP.

The DNS of the visited PLMN is configured in such a way that any address ending in ". visited-operator. com" would be resolved to the IP address of the visited SEPP.

There is an additional issue to take into account: the visited SEPP, in order to terminate the TLS connection, needs to present a valid Public Key Infrastructure (PKI) Certificate to the visited NF (originator of the TLS connection). The certificate is "valid", when the target URI "matches" the FQDN, or FQDNs, found in the certificate, in the Subject Alternative Name field.

Given that the telescopic FQDN is dynamically built, and given that the first part is the FQDN of the visited NF, it is not possible to create a certificate with such an FQDN inside the certificate. The solution is to create a "wildcard certificate", as e.g. disclosed in "<NPL>, clause <NUM>. in the example above, the wildcard certificate would contain the Subject Alternative Name as:
*. visited-operator.

An important limitation of wildcard certificates is that the "*" can only represent a single-level domain in the FQDN. Therefore the above example would match:
node1. visited-operator.

But the above example would NOT match the telescopic FQDN, in its general multi-level form:
udm1. home-operator. visited-operator.

The consequence is that the telescopic FQDN must be transformed, once again, in such a way that the FQDN of the NF in the home PLMN is "flattened" into a single label. , e.g.
udm1. home-operator. com -> label
and then, the final URI would be in the form of:
https://label. visited-operator. com
which would match successfully when the visited SEPP presents to the visited NF a wildcard certificate as shown above (*. visited-operator.

There currently exist certain challenge(s). As mentioned above, Telescopic Fully Qualified Domain Name (FQDN)" was introduced in TS <NUM>. However, it is stated in TS <NUM> that the algorithm for generating such a single label, from the FQDN of the home NF, is left for CT4 to define.

However, CT4 has never done it, for the following reason:
An NF in the visited PLMN typically gets the FQDN of the NF in the home PLMN via the Discovery Service Request of the NRF. This means that the messages of the Discovery Service Request also go through the SEPP, and therefore the visited SEPP can create the telescopic FQDN of the discovered NFs of the home PLMN before sending the Discovery Service Response to the visited NF. At this point, the visited SEPP can apply any proprietary algorithm it chooses, to generate the "single label" domain required for the telescopic FQDN.

Then, the visited NF will use such telescopic FQDN built by the visited SEPP in order to send the actual "service" request (e.g. the AMF sends the service request to the discovered UDM).

The request is received by the visited SEPP and it must do the reverse transformation of the telescopic FQDN into the original FQDN of the home NF. https://label. visited-operator. com -> https://udm1. home-operator.

Given that the SEPP created the "label" from "udm1. home-operator. com", it can always transform it back into the original FQDN "udm1. home-operator. com" (either applying an algorithmic transformation, or by keeping a mapping table between labels and FQDNs).

The problem with the above assumption is that there are cases where the SEPP may not have been previously involved in the signaling path, and the visited NF needs to interact with a home N F. Such scenarios are cases when the "Visited NF" and the "Home NF" mentioned so far are, in fact, a "visited NRF" and a "home NRF". In particular:.

In all those cases, the Visited NRF learns the FQDN of the Home NRF, either by means of:.

Therefore, in those cases, the visited NRF must compose a telescopic FQDN of the home NRF that points to the visited SEPP. :
https://nrf. home-operator. visited-operator.

And this needs to be transformed into a single-label domain, such as:
https://label. visited-operator.

Therefore, there is a need for improved systems and methods for the visited SEPP to do the reverse transform, and convert "label" into "nrf. home-operator. com", given that the original transform was done in another entity (visited NRF).

Certain aspects of the present disclosure and their embodiments may provide solutions to the aforementioned or other challenges. The present disclosure proposes a new service offered by SEPP, so other NFs may request the SEPP to generate a telescopic FQDN (and flatten the original FQDN into a single label), and also to do the reverse mapping, converting the flattened telescopic FQDN into the original FQDN of the NF in the home PLMN.

: Visited NRF needs to contact:
https://nrf. home-operator.

So, it sends a GET request to the visited SEPP, like this:
GET https://sepp. visited-operator. com/telescopic?fqdn="nrf. home-operator. com", wherein "sepp. visited-operator. com" is the FQDN of the visited SEPP and "nrf. home-operator. com" is the FQDN of the home NRF.

And the visited SEPP would answer, e.g., with a JSON document like this:
{"telescopic": "0x1273bc89. visited-operator.

(That is, in this telescopic FQDN "0x1273bc89. visited-operator. com" the FQDN of the home NRF has been flattened to the label "0x1273bc89", which is concatenated with the FQDN of the visited SEPP, i.e. "sepp. visited-operator.

A reverse service could also be offered:
GET https://sepp. visited-operator. com/telescopic?label="0x1273bc89".

And the visited SEPP would answer, e.g.:
{"fqdn": "nrf. home-operator.

A mechanism and associated services offered by the SEPP, allowing other NFs to obtain telescopic FQDNs of NFs in another PLMN, in such a way that, later, the SEPP can do the reverse mapping and obtain the FQDN of the foreign NF based on the telescopic FQDN.

Certain embodiments may provide one or more of the following technical advantage(s). The solution provides a lot of flexibility and eases the inter-operability in the generation and handling of the telescopic FQDNs.

Other suggested approaches to solve this problem relied on very rudimentary algorithmic transformation of the original telescopic FQDN, e.g. by replacing the ". " in the original FQDN of the visited NF, with the symbol "-", to create a single label like:
nrf. com -> nrf-operator-com.

So, the telescopic FQDN would be:
nrf-operator-com. visited-operator.

This is really an ugly and inflexible solution, because FQDNs such as the example used repeatedly in this current disclosure:
nrf. home-operator. com
would not be possible to be transformed with such algorithm, due to the presence of "-" in the original FQDN. It should be noted that the only non-alphabetic symbol allowed in FQDNs is the "-" symbol, so no other symbol can be used to replace ".

It was also suggested to overcome this problem by replacing "-" itself with multiple "-" symbols, but again, this is extremely ugly and inflexible (e.g. internationalized domain names often contain <NUM> consecutive "-" symbols).

Also, another limitation of an algorithmic transformation is that the total length of any given label cannot exceed <NUM> characters, so for long domain names involving multiple domain levels, the upper limit in length can be easily reached.

Another approach mentioned to solve this problem has been to configure the telescopic FQDN for the Home NRF at the Visited NRF. This is also a very inefficient and cumbersome type of solution as configuration shall involve the Home NRFs in each and every HPLMN a given PLMN has roaming agreements with. Furthermore, this configuration is not only required at the Visited NRF but also at the Visited SEPP as the Visited SEPP needs to be able to map the telescopic FQDN for a Home NRF to the FQDN of the original Home NRF.

The proposed solutions are now described, by way of example, with reference to the accompanying drawings, in which:.

Some examples of a core network node include, e.g., a Mobility Management Entity (MME), a Packet Data Network Gateway (P-GW), a Service Capability Exposure Function (SCEF) or the like, e.g. such as any of the core network nodes illustrated in <FIG> and <FIG>.

<FIG> illustrates one example of a cellular communications network <NUM> according to some embodiments of the present disclosure. In the embodiments described herein, the cellular communications network <NUM> is a <NUM> NR network. In this example, the cellular communications network <NUM> includes base stations <NUM>-<NUM> and <NUM>-<NUM>, which in LTE are referred to as eNBs and in <NUM> NR are referred to as gNBs, controlling corresponding macro cells <NUM>-<NUM> and <NUM>-<NUM>. The base stations <NUM>-<NUM> and <NUM>-<NUM> are generally referred to herein collectively as base stations <NUM> and individually as base station <NUM>. Likewise, the macro cells <NUM>-<NUM> and <NUM>-<NUM> are generally referred to herein collectively as macro cells <NUM> and individually as macro cell <NUM>. The cellular communications network <NUM> may also include a number of low power nodes <NUM>-<NUM> through <NUM>-<NUM> controlling corresponding small cells <NUM>-<NUM> through <NUM>-<NUM>. The low power nodes <NUM>-<NUM> through <NUM>-<NUM> can be small base stations (such as pico or femto base stations) or Remote Radio Heads (RRHs), or the like. Notably, while not illustrated, one or more of the small cells <NUM>-<NUM> through <NUM>-<NUM> may alternatively be provided by the base stations <NUM>. The low power nodes <NUM>-<NUM> through <NUM>-<NUM> are generally referred to herein collectively as low power nodes <NUM> and individually as low power node <NUM>. Likewise, the small cells <NUM>-<NUM> through <NUM>-<NUM> are generally referred to herein collectively as small cells <NUM> and individually as small cell <NUM>. The base stations <NUM> (and optionally the low power nodes <NUM>) are connected to a core network <NUM>.

<FIG> illustrates a wireless communication system represented as a <NUM> network architecture composed of core Network Functions (NFs), where interaction between any two NFs is represented by a point-to-point reference point/interface. <FIG> can be viewed as one particular implementation of the system <NUM> of <FIG>.

Seen from the access side the <NUM> network architecture shown in <FIG> comprises a plurality of User Equipment (UEs) connected to either a Radio Access Network (RAN) or an Access Network (AN) as well as an Access and Mobility Management Function (AMF). Typically, the R(AN) comprises base stations, e.g. such as evolved Node Bs (eNBs) or <NUM> base stations (gNBs) or similar. Seen from the core network side, the <NUM> core NFs shown in <FIG> include such core network nodes as a Network Slice Selection Function (NSSF), an Authentication Server Function (AUSF), a Unified Data Management (UDM), an AMF, a Session Management Function (SMF), a Policy Control Function (PCF), and an Application Function (AF).

Reference point representations of the <NUM> network architecture are used to develop detailed call flows in the normative standardization. The N1 reference point is defined to carry signaling between the UE and AMF. The reference points for connecting between the AN and AMF and between the AN and UPF are defined as N2 and N3, respectively. There is a reference point, N11, between the AMF and SMF, which implies that the SMF is at least partly controlled by the AMF. N4 is used by the SMF and UPF so that the UPF can be set using the control signal generated by the SMF, and the UPF can report its state to the SMF. N9 is the reference point for the connection between different UPFs, and N14 is the reference point connecting between different AMFs, respectively. N15 and N7 are defined since the PCF applies policy to the AMF and SMP, respectively. N12 is required for the AMF to perform authentication of the UE. N8 and N10 are defined because the subscription data of the UE is required for the AMF and SMF.

The <NUM> core network aims at separating user plane and control plane. The user plane carries user traffic while the control plane carries signaling in the network. In <FIG>, the UPF is in the user plane and all other NFs, i.e., the AMF, SMF, PCF, AF, AUSF, and UDM, are in the control plane. Separating the user and control planes guarantees each plane resource to be scaled independently. It also allows UPFs to be deployed separately from control plane functions in a distributed fashion. In this architecture, UPFs may be deployed very close to UEs to shorten the Round Trip Time (RTT) between UEs and data network for some applications requiring low latency.

The core <NUM> network architecture is composed of modularized functions. For example, the AMF and SMF are independent functions in the control plane. Separated AMF and SMF allow independent evolution and scaling. Other control plane functions like the PCF and AUSF can be separated as shown in <FIG>. Modularized function design enables the <NUM> core network to support various services flexibly.

<FIG> illustrates a <NUM> network architecture using service-based interfaces between the NFs in the control plane, instead of the point-to-point reference points/interfaces used in the <NUM> network architecture of <FIG>. However, the NFs described above with reference to <FIG> correspond to the NFs shown in <FIG>. The service(s) etc. that a NF provides to other authorized NFs can be exposed to the authorized NFs through the service-based interface. In <FIG> the service based interfaces are indicated by the letter "N" followed by the name of the NF, e.g. Namf for the service based interface of the AMF and Nsmf for the service based interface of the SMF etc. The Network Exposure Function (NEF) and the Network Repository Function (NRF) in <FIG> are not shown in <FIG> discussed above. However, it should be clarified that all NFs depicted in <FIG> can interact with the NEF and the NRF of <FIG> as necessary, though not explicitly indicated in <FIG>.

Some properties of the NFs shown in <FIG> and <FIG> may be described in the following manner. The AMF provides UE-based authentication, authorization, mobility management, etc. A UE even using multiple access technologies is basically connected to a single AMF because the AMF is independent of the access technologies. The SMF is responsible for session management and allocates Internet Protocol (IP) addresses to UEs. It also selects and controls the UPF for data transfer. If a UE has multiple sessions, different SMFs may be allocated to each session to manage them individually and possibly provide different functionalities per session. The AF provides information on the packet flow to the PCF responsible for policy control in order to support Quality of Service (QoS). Based on the information, the PCF determines policies about mobility and session management to make the AMF and SMF operate properly. The AUSF supports authentication function for UEs or similar and thus stores data for authentication of UEs or similar while the UDM stores subscription data of the UE. The Data Network (DN), not part of the <NUM> core network, provides Internet access or operator services and similar.

The UDM is similar to the HSS in LTE/EPC networks discussed above. UDM supports Generation of 3GPP AKA authentication credentials, user identification handling, access authorization based on subscription data, and other subscriber-related functions. To provide this functionality, the UDM uses subscription data (including authentication data) stored in the 5GC unified data repository (UDR). In addition to the UDM, the UDR supports storage and retrieval of policy data by the PCF, as well as storage and retrieval of application data by NEF.

<FIG> shows an exemplary roaming <NUM> reference architecture with service-based interfaces. In this reference architecture, the user roams into a Visited Public Land Mobile Network (VPLMN) that is different than the user's Home PLMN (HPLMN). In particular, <FIG> shows a roaming architecture that supports home-routed data services, in which the home operator's administrative domain is involved in the user's data session and the UE interfaces the data network (DN) in the HPLMN. From the user's perspective, the various network functions of the HPLMN shown in the non-roaming architecture of <FIG> are distributed among the HPLMN and VPLMN in the home-routed roaming architecture shown in <FIG>. For example, the AMF is in the VPLMN, the AUSF is in the HPLMN, and the SMF and UPF exist in both (e.g., are split between) VPLMN and HPLMN. To distinguish between these functions existing in both networks, a prefix of "H" or "V" can be used, such as "H-UPF" and "V-UPF".

In both roaming and non-roaming scenarios, a user (e.g., a UE) may want to establish a data session (also referred to as a "PDU session") with a data network (DN, e.g., Internet) via the <NUM> network. The term "PDU", short for "protocol data unit," is often used to refer to a unit of data specified in a protocol layer and comprising protocol control information and possibly user data. "PDU" is often used interchangeably with "packet. " A PDU Session establishment may correspond to any of the following:.

For a UE-initiated (or UE-requested) PDU session establishment based on home-routed roaming, functions in the VPLMN often need to exchange information about the user with their peer and/or corresponding function in the HPLMN. For example, the V-SMF often needs to exchange information with the H-SMF. However, various problems and/or difficulties can arise due to the VPLMN function (e.g., V-SMF) lacking necessary information about the corresponding HPLMN function (e.g., H-SMF).

The NF may be a NF instance.

<FIG> shows an example of some embodiments of the current disclosure. Visited NRF (e.g. a NRF instance) needs to send a message (service request) to Home NRF (e.g. a NRF instance) (step <NUM>). Use cases may be:.

The FQDN of the Home NRF may be determined by the visited NRF as:.

Visited NRF sends, before sending a service request to the Home NRF, a request to visited SEPP to obtain a telescopic FQDN for the Home NRF's FQDN (step <NUM>). The visited NRF sends a GET request to the visited SEPP, like:
GET https://sepp. visited-operator. com/telescopic?fqdn="nrf. home-operator. com, wherein "sepp. visited-operator. com" is the FQDN of the visited SEPP, and "nrf. home-operator. com" is the FQDN of the home NRF. The address/ID of the visited SEPP (e.g. sepp. visited-operator. com) can be locally configured in the visited NRF unless Visited SEPPs offering this new service register themselves in the Visited NRF as any other NF within the 5GC in which case, the visited NF may do a service discovery with respect to the visited NRF to discover a service offered by the visited SEPP.

Visited SEPP creates the telescopic FQDN (step <NUM>), e.g. by generating a random label (e.g. having only letters, digits and possibly the "-" symbol) and appending it to it the FQDN of the visited SEPP, for example in a JSON document like this:
{"telescopic": "0x1273bc89. visited-operator. Here, the exemplifying random label is "0x1273bc89". The telescopic FQDN for the Home NRF is returned to the visited NRF (step <NUM>), wherein the FQDN for the Home NRF is flattened to a single label.

The visited NRF sends the service request (step <NUM>) (discovery, token request, subscription. ) using the flattened telescopic FQDN, e.g. by concatenating the flattened telescopic FQDN and the FQDN of the visited SEPP, which effectively points to an IP address of the visited SEPP, and therefore, the SEPP can terminate the TLS connection and exhibit a valid wildcard certificate. Given that the TLS is terminated at the visited SEPP, it can decrypt the message (service request) and proceed with the necessary modifications before sending it externally towards another PLMN.

The visited SEPP checks the mapping table and obtains the actual FQDN of the home NRF (step <NUM>), based on the telescopic FQDN (flattened to single-label) sent by the visited NRF.

The visited SEPP routes the message to the home PLMN (step <NUM>), effectively sending the message towards the home SEPP, and potentially traversing additional intermediaries in the IPX. The rest of the flow is outside the scope of this disclosure.

An additional embodiment proposes the possibility that the Visited SEPP exposing the new service to generate a telescopic FQDN to other NFs is different from the Visited SEPP through which the NF will send the actual service request; i.e. the Visited SEPP used in step <NUM> and step <NUM> in <FIG> are different Visited SEPP instances. This is illustrated in <FIG>.

Visited NRF gets a telescopic FQDN for the Home NRF's FQDN from one instance of the SEPP exposing this service within VPLMN, Visited SEPP1, as depicted in <FIG> (steps <NUM>-<NUM>, correspond to steps <NUM>-<NUM> in <FIG> respectively).

According to some embodiments of the current disclosure, the Visited SEPP1 offering this service could select the actual visited SEPP the visited NRF should use to send the actual service request towards the HPLMN (e.g. Visited SEPP2). For this purpose, the Visited SEPP1 could generate the telescopic FQDN in the domain of SEPP2 as follows:
{"telescopic": "label. visited-operator.

The visited NRF sends the service request (step <NUM>) (discovery, token request, subscription. ) to the flattened telescopic FQDN, which effectively points to an IP address of a visited SEPP. The NRF chooses a visited SEPP instance (visited SEPP <NUM>) different from the visited SEPP instance used in step <NUM> above based e.g. on local configuration or based on the information within the telescopic FQDN provided by visited SEPP1.

If the visited SEPP2 does not recognize the label within the telescopic FQDN, the visited SEPP2 obtains the actual FQDN of the home NRF based on the telescopic FQDN sent by the visited NRF from the visited SEPP1 which generated it (step <NUM>); i.e. Visited SEPP <NUM> (e.g. "sepp1-0x1273bc89").

In this case, the visited SEPP1 also exposes a service to resolve telescopic FQDNs (i.e. to map the label to the FQDN of the Home NRF). The flow continues as described in <FIG> with step <NUM> being similar to step <NUM>.

<FIG> is a schematic block diagram of a node <NUM> (e.g. a core network node) implementing a network function according to some embodiments of the present disclosure. The node <NUM> may be, for example, a core network node e.g. such as any one of a, NEF, an AUSF, a UDM, an AMF, a SMF, a PCF, a UPF or similar and in particular an NSSF or a NRF or a SEPP or similar. As illustrated, the node <NUM> includes a control system <NUM> that includes one or more processors <NUM> (e.g., Central Processing Units (CPUs), Application Specific Integrated Circuits (ASICs), Field Programmable Gate Arrays (FPGAs), and/or the like), memory <NUM>, and a network interface <NUM>. The one or more processors <NUM> are also referred to herein as processing circuitry. The one or more processors <NUM> operate to provide one or more functions of a node <NUM> as described herein. In some embodiments, the function(s) are implemented in software that is stored, e.g., in the memory <NUM> and executed by the one or more processors <NUM>.

<FIG> is a schematic block diagram that illustrates a virtualized embodiment of the node <NUM> according to some embodiments of the present disclosure.

As used herein, a "virtualized" node is an implementation of the node <NUM> in which at least a portion of the functionality of the node <NUM> is implemented as a virtual component(s) (e.g., via a virtual machine(s) executing on a physical processing node(s) in a network(s)). As illustrated, in this example, the node <NUM> includes the control system <NUM> that includes the one or more processors <NUM> (e.g., CPUs, ASICs, FPGAs, and/or the like), the memory <NUM>, and the network interface <NUM> The control system <NUM> is connected to one or more processing nodes <NUM> coupled to or included as part of a network(s) <NUM> via the network interface <NUM>. Each processing node <NUM> includes one or more processors <NUM> (e.g., CPUs, ASICs, FPGAs, and/or the like), memory <NUM>, and a network interface <NUM>.

In this example, functions <NUM> of the node <NUM> described herein are implemented at the one or more processing nodes <NUM> or distributed across the control system <NUM> and the one or more processing nodes <NUM> in any desired manner. In some particular embodiments, some or all of the functions <NUM> of the node <NUM> described herein are implemented as virtual components executed by one or more virtual machines implemented in a virtual environment(s) hosted by the processing node(s) <NUM>. As will be appreciated by one of ordinary skill in the art, additional signaling or communication between the processing node(s) <NUM> and the control system <NUM> is used in order to carry out at least some of the desired functions <NUM>. Notably, in some embodiments, the control system <NUM> may not be included, in which case the radio unit(s) <NUM> communicate directly with the processing node(s) <NUM> via an appropriate network interface(s).

In some embodiments, a computer program including instructions which, when executed by at least one processor, causes the at least one processor to carry out the functionality of node <NUM> or a node (e.g., a processing node <NUM>) implementing one or more of the functions <NUM> of the node <NUM> in a virtual environment according to any of the embodiments described herein is provided.

<FIG> is a schematic block diagram of the node <NUM> according to some other embodiments of the present disclosure. The node <NUM> includes one or more modules <NUM>, each of which is implemented in software. The module(s) <NUM> provide the functionality of the node <NUM> described herein.

Claim 1:
A method performed by a first node (<NUM>) implementing a visited Network Repository Function, NRF, in a Visited Public Land Mobile Network, VPLMN, for communicating with a third node (<NUM>) implementing a home NRF in a Home Public Land Mobile Network, HPLMN, the method comprises:
- determining (<NUM>, <NUM>) that the third node should be communicated with;
- sending (<NUM>, <NUM>) towards a second node (<NUM>) implementing a visited Security Edge Protection Proxy, SEPP in the VPLMN, a GET request for a telescopic Fully Qualified Domain Name, FQDN, for the third node in the HPLMN to be used by the first node in the VPLMN to communicate with the third node in the HPLMN, which request comprises a FQDN of the third node in the HPLMN;
- receiving (<NUM>, <NUM>), from the second node, a telescopic FQDN for the third node wherein the FQDN for the third node in the HPLMN is flattened to a single label to be used by the first node to communicate with the third node.