Patent Description:
When a user equipment (UE) is accessing a public land mobile network (PLMN) service via a stand-alone non-public network (SNPN) as specified in clause <NUM>. <NUM> and Annex D. <NUM> in the third generation partnership project (3GPP) TS <NUM> V17, the SNPN is acting as untrusted non-3GPP access for the PLMN. The UE first registers and establishes a packet data unit (PDU) session and a User Plane in the SNPN. Then UE connects to a non-3GPP interworking function (N3IWF) in the PLMN via the User Plane established in the SNPN, and performs registration and PDU session establishment in the PLMN. All the traffic between UE and PLMN is transported via the User Plane in SNPN, in the form of internet protocol security (IPsec) security association (SA).

<NPL>" in TR <NUM>-<NUM>, and discusses a solution for QoS for simultaneous access to SNPN and PLMN.

<NPL> and proposes to elaborate on the mapping in SLA regarding network initiated QoS, so that the underlay network can support the QoS required from the overlay network.

The present invention is directed to subject-matter as disclosed by the appended claims.

For user equipment initiated QoS modification, a requested QoS rule may be based on a network node (e.g., N3IWF) internet protocol (IP) address and a security parameter index (SPI) associated with an IPsecSA. The SPI may be dynamically allocated at the UE/network node side when establishing the IPsecSA, and may not be used for the network to determine if QoS request from the UE is authorized or not. Potential advantages provided by various embodiments of the present disclosure may include that a network that receives the UE request may be able to determine if the request is authorized, or not, directly according to a differentiated services code point (DSCP) value in the QoS rule and a service level agreement (SLA).

The term "network node" is used in a non-limiting manner and, as explained below, can refer without limitation to any type of network node in a telecommunications network performing support in a second network of a QoS of a first network for a communication device initiated QoS modification including, without limitation, a PLMN N3IWF node, an SNPN session management function (SMF) node, and/or an SNPN policy control function (PCF) node. As used herein, "first network" is used in a non-limiting manner and, as explained below, can refer to any type of network with respect to a second network that is an overlay network or an underlay network, respectively (e.g., a PLMN or a SNPN, respectively). As used herein, "second network" is used in a non-limiting manner and as explained below, can refer to any type of network with respect to the first network that is an underlay network or an overlay network, respectively (e.g., a SNPN or a PLMN, respectively).

The following explanation of potential problems with some approaches is a present realization as part of the present disclosure and is not to be construed as previously known by others.

In some approaches, e.g., in 3GPP TS <NUM> V17 clause <NUM>. <NUM> and Annex D. <NUM>, in order to differentiate the QoS for the IPsec SA in SNPN, there two mechanisms are specified. One mechanism is a network initiated QoS modification, where the two networks based on service level agreement (SLA) decide what differentiated services code point (DSCP) marking will be used on the IPsec SA and what are the corresponding QoS parameters to be used when the internet protocol (IP) header of the IPsec SA is marked with this DSCP value. A second mechanism is a UE initiated QoS modification, relying on the UE to request a proper QoS from the SNPN for handling the IPsec SA. The requested QoS in the SNPN is the QoS UE receives from the PLMN.

In another approach, the same principle applies when a UE is accessing a SNPN service via a PLMN as specified, e.g., in clause <NUM>. <NUM> and Annex D. <NUM> in 3GPP TS <NUM> V17.

In some approaches, for a UE initiated QoS modification, the requested QoS rule is based on a N3IWF IP address and the SPI associated with the IPsec SA. The SPI is dynamically allocated at the UE/N3IWF side when establishing the IPsec SA, and may not be used for the network to determine if such QoS request from the UE is authorized or not.

Thus, in such approaches, a UE-initiated QoS mechanism to support QoS differentiation when the UE is accessing a SNPN via a PLMN, or vice versa, does not have the SLA support. As a consequence, the network that receives the UE request may not know how to react on the UE request, e.g., whether or not to allocate the resources for the UE.

Various embodiments of the present disclosure may provide solutions to these and other potential problems. In various embodiments of the present disclosure, a DSCP value is introduced that is used on the IP header of the IPsec SA as extra information in the QoS rule requested by the UE. As a consequence, the DSCP value can be used by the network to determine if the QoS requested by UE can be authorized or not, according to a SLA.

Potential advantages provided by various embodiments of the present disclosure may include that the network that receives the UE request is able to determine if such request can be authorized or not according to the DSCP value in the QoS rule and the SLA.

<FIG> is a schematic diagram illustrating an example of a first network (e.g., PLMN <NUM>), a second network (e.g., SNPN <NUM>), and a communication device (e.g., UE <NUM>). PLMN <NUM> includes N3IWF node <NUM>, access mobility function (AMF) node <NUM>, SMF node <NUM>, user plane function node <NUM>, data network <NUM> and 3GPP access <NUM>. SNPN <NUM> includes next generation (NG) radio access network (RAN) node <NUM>, SMF node <NUM>, AMF node <NUM>, UPF node <NUM> and policy control function (PCF) node <NUM>.

<FIG> is a signalling diagram of methods of a first network node, a second network node and a communication device, respectively, in accordance with some embodiments of the present disclosure. <FIG> illustrates logic when UE <NUM> is accessing a first network (e.g., PLMN <NUM>) service via a second network (e.g., SNPN <NUM>). In other embodiments, the same logic applies when UE <NUM> is accessing an SNPN service via a PLMN.

Referring to operation <NUM> of <FIG>, UE <NUM> registers and establishes a PDU Session in SNPN <NUM> (e.g., the second network).

At operation <NUM>, UE <NUM> registers in a PLMN (e.g., the first network), via User Plane IP connectivity in SNPN <NUM>.

At operation <NUM>, UE <NUM> requests to establish a PDU session in PLMN <NUM>.

At operation <NUM>, SMF <NUM> in PLMN <NUM> accepts the UE <NUM> request via an N2 interface message sent to N3IWF <NUM>. The N2 message to N3IWF <NUM> includes a QoS profile(s) and corresponding QoS flow identifier (QFI), PDU session identifier, etc..

At operation <NUM>, a SLA is enabled for the UE-initiated QoS. N3IWF <NUM> in PLMN <NUM> checks the QoS profile for the QoS Flow with the SLA set up with SNPN <NUM> and determines if such QoS Flow can be supported by SNPN <NUM> as well. If yes, then N3IWF <NUM> decides to create a dedicated IPsec SA for handling this QoS Flow, and sets the DSCP value of this IPsec SA according to the SLA between the PLMN <NUM> and the SNPN <NUM>. The SLA is configured in N3IWF <NUM>, in PLMN <NUM> and in SMF <NUM> and/or PCF <NUM> in SNPN <NUM>.

Referring now to operation <NUM>, UE <NUM> and N3IWF <NUM> proceed with the User Plane IPSec SA establishment.

At operation <NUM>, UE <NUM> receives a non-access stratum (NAS) message PDU Session Establishment Accept, including the QoS Flow description from the PLMN SMF <NUM>.

At operation <NUM>, UE <NUM> initiates a request (e.g., PDU Session Modification Request) with SNPN SMF <NUM>. In the request, UE <NUM> requests the QoS rule with N3IWF <NUM> IP address, SPI and DSCP as a packet filter, and a set of QoS parameters to describe the QoS flow ("QoS Flow level QoS parameters") which UE <NUM> receives from PLMN SMF <NUM> in operation <NUM>. Operation <NUM> is in contrast to the approach discussed above in the existing UE-initiated QoS mechanism described in clause <NUM>. <NUM> and clause <NUM>. <NUM> in 3GPP TS <NUM>, in which a UE requests only a N3IWF IP address and SPI as a packet filter. In various embodiments of the present disclosure, by supporting SLA, a UE receives DSCP information (e.g., a DSCP value) from a first network node (e.g., N3IWF <NUM>) in a first network (e.g., PLMN <NUM>) at operation <NUM> and passes such information to a second network node (e.g., SMF109/PCF <NUM>) in a second network (e.g., SNPN <NUM>), thus, facilitating the two networks to cooperate on how to support the QoS agreed in SLA.

In various embodiments of the present disclosure, SMF <NUM>/PCF <NUM> in SNPN <NUM> is configured with the SLA between the PLMN and the SNPN.

At operation <NUM>, or alternatively at operation <NUM>, a second network node (e.g., PCF <NUM> in operation <NUM> or SMF <NUM> in operation <NUM>) checks if the DSCP value (which is from the UE <NUM> request) and the QoS Flow level QoS parameters is included in the SLA between the second network (e.g., SNPN <NUM>) and the first network (e.g., PLMN <NUM>). If yes, the second network node authorizes the UE <NUM> request.

At operation <NUM>, UE <NUM> and SMF <NUM> proceed with the PDU Session Modification, and establish a QoS Flow in the second network (e.g., SNPN <NUM>) supporting the IPsec SA with the proper QoS.

In some embodiments, the same logic and operations described above apply to UE initiated QoS when accessing SNPN services via a PLMN by swapping the SNPN and PLMN discussed above with reference to <FIG>.

<FIG> is a block diagram illustrating elements of a communication device <NUM> (also referred to as a user equipment, UE, a user equipment node/terminal/device, a mobile terminal, a mobile communication terminal, a wireless device, a wireless communication device, a wireless terminal, mobile device, a wireless communication terminal, etc.) configured to provide wireless communication according to embodiments of the present disclosure. As shown, communication device may include an antenna <NUM>, and transceiver circuitry <NUM> (also referred to as a transceiver) including a transmitter and a receiver configured to provide uplink and downlink radio communications with a base station(s) of a radio access network (e.g., PLMN <NUM>, SNPN <NUM>, etc.). Communication device may also include processing circuitry <NUM> (also referred to as a processor) coupled to the transceiver circuitry, and memory circuitry <NUM> (also referred to as memory) coupled to the processing circuitry. The memory circuitry <NUM> may include computer readable program code that when executed by the processing circuitry <NUM> causes the processing circuitry to perform operations according to embodiments disclosed herein. According to other embodiments, processing circuitry <NUM> may be defined to include memory so that separate memory circuitry is not required. Communication device may also include an interface (such as a user interface) coupled with processing circuitry <NUM>, and/or communication device may be incorporated in a vehicle.

As discussed herein, operations of communication device may be performed by processing circuitry <NUM> and/or transceiver circuitry <NUM>. For example, processing circuitry <NUM> may control transceiver circuitry <NUM> to transmit communications through transceiver circuitry <NUM> over a radio interface to a radio access network node (also referred to as a base station) and/or to receive communications through transceiver circuitry <NUM> from a RAN node over a radio interface. Moreover, modules may be stored in memory circuitry <NUM>, and these modules may provide instructions so that when instructions of a module are executed by processing circuitry <NUM>, processing circuitry <NUM> performs respective operations (e.g., operations discussed herein with respect to example embodiments relating to communication devices). According to some embodiments, a communication device <NUM> and/or an element(s)/function(s) thereof may be embodied as a virtual node/nodes and/or a virtual machine/machines.

<FIG> is a block diagram illustrating elements of a first network node (e.g., a PLMN N3IWF node, a SNPN N3IWF, etc.) of a first network (e.g., a PLMN or a SNPN) configured to provide cellular communication according to embodiments of the present disclosure. As shown, the first network node may include network interface circuitry <NUM> (also referred to as a network interface) configured to provide communications with other nodes of the first network and/or a second network, and/or a radio access network RAN. The first network node may also include a processing circuitry <NUM> (also referred to as a processor) coupled to the network interface circuitry, and memory circuitry <NUM> (also referred to as memory) coupled to the processing circuitry. The memory circuitry <NUM> may include computer readable program code that when executed by the processing circuitry <NUM> causes the processing circuitry to perform operations according to embodiments disclosed herein. According to other embodiments, processing circuitry <NUM> may be defined to include memory so that a separate memory circuitry is not required.

As discussed herein, operations of the first network node may be performed by processing circuitry <NUM> and/or network interface circuitry <NUM>. For example, processing circuitry <NUM> may control network interface circuitry <NUM> to transmit communications through network interface circuitry <NUM> to one or more other network nodes and/or to receive communications through network interface circuitry from one or more other network nodes. Moreover, modules may be stored in memory <NUM>, and these modules may provide instructions so that when instructions of a module are executed by processing circuitry <NUM>, processing circuitry <NUM> performs respective operations (e.g., operations discussed herein with respect to example embodiments relating to first network nodes). According to some embodiments, first network node <NUM> and/or an element(s)/function(s) thereof may be embodied as a virtual node/nodes and/or a virtual machine/machines.

<FIG> is a block diagram illustrating elements of a second network node (e.g., a SNPN SMF, a SNPN PCF, a PLMN SMF, a PLMN PCF, etc.) of a second network (e.g., a SNPN or a PLMN) configured to provide cellular communication according to embodiments of the present disclosure. As shown, the second network node may include network interface circuitry <NUM> (also referred to as a network interface) configured to provide communications with other nodes of the second network and/or a first network, and/or a radio access network RAN. The second network node may also include a processing circuitry <NUM> (also referred to as a processor) coupled to the network interface circuitry, and memory circuitry <NUM> (also referred to as memory) coupled to the processing circuitry. The memory circuitry <NUM> may include computer readable program code that when executed by the processing circuitry <NUM> causes the processing circuitry to perform operations according to embodiments disclosed herein. According to other embodiments, processing circuitry <NUM> may be defined to include memory so that a separate memory circuitry is not required.

As discussed herein, operations of the second network node may be performed by processing circuitry <NUM> and/or network interface circuitry <NUM>. For example, processing circuitry <NUM> may control network interface circuitry <NUM> to transmit communications through network interface circuitry <NUM> to one or more other network nodes and/or to receive communications through network interface circuitry from one or more other network nodes. Moreover, modules may be stored in memory <NUM>, and these modules may provide instructions so that when instructions of a module are executed by processing circuitry <NUM>, processing circuitry <NUM> performs respective operations (e.g., operations discussed herein with respect to example embodiments relating to second network nodes). According to some embodiments, second network node <NUM> and/or an element(s)/function(s) thereof may be embodied as a virtual node/nodes and/or a virtual machine/machines.

Now that the operations of the various components have been described, operations specific to a first network node (e.g., node <NUM> implemented using the structure of the block diagram of <FIG>) will now be discussed with reference to the flow charts of <FIG> according to some embodiments of inventive concepts. For example, modules may be stored in memory <NUM> of <FIG>, and these modules may provide instructions so that when the instructions of a module are executed by respective first network node processing circuitry <NUM>, processing circuitry <NUM> performs respective operations of the flow charts of <FIG>.

Each of the operations described in <FIG> can be combined and/or omitted in any combination with each other.

Referring first to <FIG>, a method is performed by a first network node (e.g., <NUM>, <NUM>) in a first network (e.g., <NUM>, <NUM>) for support in a second network (e.g., <NUM>, <NUM>) of a quality of service, QoS, of the first network for a communication device (e.g., <NUM>) initiated QoS modification when the communication device is accessing a service of the first network via the second network. The method includes checking (<NUM>) a QoS profile for a QoS flow of the first network based on a service level agreement, SLA, between the first network and the second network to determine whether the QoS flow is supported by the second network. The method further includes, when the QoS is supported by the second network, creating (<NUM>) a dedicated internet protocol security, IPsec, security association, SA, for handling the QoS flow in the second network. The method further includes setting (<NUM>) a differentiated services code point, DSCP, value of the dedicated IPsec SA according to the SLA.

In some embodiments, the SLA is configured in the first network node in the first network and in a second network node in the second network.

In some embodiments, the SLA includes a mapping between the DSCP value of the dedicated IPsec SA and a set of QoS parameters for the service of the first network.

Referring now to <FIG>, in some embodiments, the method further includes instructing (<NUM>) the communication device to set the DSCP value of the dedicated IPsec SA for the service of the first network based on the mapping in the SLA between the DSCP value of the dedicated IPsec SA and a set of QoS parameters for the service of the first network.

In some embodiments, the method further includes signalling (<NUM>) a message to the communication device including a set of QoS parameters describing the QoS flow. The method further includes, responsive to the request, signalling (<NUM>) a response to the communication device that includes the instruction to set the DSCP value.

In some embodiments, the setting a DSCP value includes marking on a plurality of DSCP bits in an internet protocol, IP, header of the dedicated IPsec SA.

In some embodiments, the first network is an overlay network and the second network is an underlay network.

Various operations from the flow chart of <FIG> may be optional with respect to some embodiments of a method performed by a first network node, and related methods. For example, operations of blocks <NUM>, <NUM>, <NUM> of <FIG> may be optional.

Operations specific to a second network node (e.g., SMF node <NUM> or PCF node <NUM> implemented using the structure of the block diagram of <FIG>) will now be discussed with reference to the flow charts of <FIG> according to some embodiments of inventive concepts. For example, modules may be stored in memory <NUM> of <FIG>, and these modules may provide instructions so that when the instructions of a module are executed by respective first network node processing circuitry <NUM>, processing circuitry <NUM> performs respective operations of the flow charts of <FIG>.

Referring first to <FIG>, a method is provided that is performed by a second network node (e.g., <NUM>, <NUM>, <NUM>) in a second network (e.g., <NUM>, <NUM>) for support in the second network of a quality of service, QoS, of a first network (e.g., <NUM>, <NUM>) for a communication device (e.g., <NUM>) initiated QoS modification when the communication device is accessing a service of the first network via the second network. The method includes receiving (<NUM>), from the communication device, a differentiated services code point, DSCP, value and a corresponding set of QoS parameters describing a QoS flow of the first network. The method further includes, responsive to the receiving, determining (<NUM>) whether the DSCP value and the corresponding set of QoS parameters describing the QoS flow is included in a service level agreement, SLA, between the first network and the second network.

Referring now to <FIG>, in some embodiments, the method further includes authorizing (<NUM>) the request of the communication device to modify the QoS to access the service when the DSCP value and the corresponding set of QoS parameters describing the QoS flow is included in the SLA.

In some embodiments, the SLA is configured in the second network node in the second network and in a first network node in the first network.

In some embodiments, the SLA includes a mapping between the DSCP value of a dedicated internet security, IPsec, security association, SA, and a set of QoS parameters for the service of the first network.

In some embodiments, the determining (<NUM>) is based on an internet protocol, IP, address for the first network node and the mapping in the SLA.

In some embodiments, the method further includes installing (<NUM>) a policy and charging control, PCC, rule on the second network node to create a new QoS flow in the second network using the set QoS parameters describing the QoS flow of the first network.

In some embodiments, the method further includes establishing (<NUM>) the QoS flow in the second network supporting the dedicated IPsecSA with the QoS of the first network.

Various operations from the flow chart of <FIG> may be optional with respect to some embodiments of a method performed by a second network node, and related methods. For example, operations of blocks <NUM>, <NUM>, <NUM> <FIG> may be optional.

Operations of a communication device (e.g., communication device <NUM> implemented using the structure of the block diagram of <FIG>) will now be discussed with reference to the flow charts of <FIG> according to some embodiments of inventive concepts. For example, modules may be stored in memory <NUM> of <FIG>, and these modules may provide instructions so that when the instructions of a module are executed by respective communication device processing circuitry <NUM>, processing circuitry <NUM> performs respective operations of the flow charts.

Referring first to <FIG>, a method is provided that is performed by a communication device (e.g., <NUM>, <NUM>) for support in a second network (e.g., <NUM>, <NUM>) of a quality of service, QoS, of a first network (e.g., <NUM>, <NUM>) for a QoS modification initiated by the communication device when the communication device is accessing a service of the first network via the second network. The method includes receiving (<NUM>), from a first network node in the first network, an instruction to set a differentiated services code point, DSCP, value of a dedicated IPsec SA for the service of the first network. The instruction is based on a mapping in a service level agreement, SLA, between the DSCP value of the dedicated IPsec SA and a set of QoS parameters for the service of the first network. The method further includes adding (<NUM>) the DSCP value to a packet filter when the communication device initiates the QoS modification in the second network.

In some embodiments, the method further includes receiving (<NUM>) a message from the first network node including a set of QoS parameters describing a QoS flow.

In some embodiments, the set a DSCP value comprises marking on a plurality of DSCP bits in an internet protocol, IP, header of the dedicated IPsec SA.

In some embodiments, the method further includes signalling (<NUM>) to the second network node a request for a QoS flow based on the set of QoS parameters describing the QoS flow. The QoS rule of the requested QoS flow includes the packet filter having an internet protocol, IP, address for the first network node, a security parameter index, SPI, and the DSCP value associated with the dedicated IPSec SA flow.

Various operations from the flow chart of <FIG> may be optional with respect to some embodiments of a method performed by a communication device, and related methods. For example, operations of blocks <NUM>, <NUM>, <NUM> of <FIG> may be optional.

Examples of network nodes include, but are not limited to, access points (APs) (e.g., radio access points), base stations (BSs) (e.g., radio base stations, Node Bs, evolved Node Bs (eNBs) and NR NodeBs (gNodeBs)). As another example, a network node may be a network node having cloud-based functions (e.g., a virtual network node deployed in a cloud environment or a network node having functions (e.g., a management system) deployed in a cloud environment as described herein.

In the above description of various embodiments of the present disclosure, it is to be understood that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of present inventive concepts.

Claim 1:
A method performed by a first network node (<NUM>, <NUM>) in a first network (<NUM>, <NUM>) for support in a second network (<NUM>, <NUM>) of a quality of service, QoS, of the first network for a communication device (<NUM>) initiated QoS modification when the communication device is accessing a service of the first network via the second network, the method comprising:
checking (<NUM>) a QoS profile for a QoS flow of the first network based on a service level agreement, SLA, between the first network and the second network to determine whether the QoS flow is supported by the second network;
when the QoS is supported by the second network, creating (<NUM>) a dedicated internet protocol security, IPsec, security association, SA, between the first network node and the communication device for handling the QoS flow in the second network;
setting (<NUM>) a differentiated services code point, DSCP, value of the dedicated IPsec SA according to the SLA; and
instructing (<NUM>) the communication device to set the DSCP value of the dedicated IPsec SA for the service of the first network based on a mapping comprised in the SLA between the DSCP value of the dedicated IPsec SA and a set of QoS parameters for the service of the first network.