Patent Description:
In certain wireless communication systems, a User Equipment device ("UE") is able to connect with a fifth-generation ("<NUM>") core network (i.e., "5GC") in a Public Land Mobile Network ("PLMN") or to connect with a 5GC in a Non-Public Network ("NPN"). In addition, a UE may be enabled to connect to a 5GC in a PLMN (second core network) via a 5GC in an NPN (first core network), and vice versa. However, the connection to the second core network via the first core network may be transparent to the first network. Therefore, the first core network is unaware of Quality of Service ("QoS") requirements of the connection to the second core network via the first core network.

<CIT> discloses a gateway apparatus which includes a processor, a first interface supporting a first data connection with a <NUM> core network over a first access and a second interface that communicates with a UE over a second access. The processor of the gateway apparatus receives a request to establish a second data connection with the UE and determines whether the second data connection can be mapped into one of a plurality of QoS flows established over the first data connection. The processor sends a request to establish a new QoS flow over the first data connection upon determining that the second data connection cannot be mapped into an existing QoS flow of the first data connection and relays traffic between the second data connection and the new QoS flow over the first data connection.

<CIT> discloses apparatus having a transceiver which communicates with a gateway function in a non-3GPP access network. The apparatus includes a processor that receives a create security association request for each of at least one security association. Here, each create security association request includes additional QoS information for the security association.

Disclosed are procedures for modifying a first data connection during the establishment of a second data connection. Said procedures may be implemented by apparatus, systems, methods, and/or computer program products.

One method of a User Equipment device ("UE") includes receiving a first request via a first data connection with a first mobile communication network, the first data connection supporting a plurality of QoS flows. Here, the first request containing a first set of parameters for establishing a second data connection with an interworking function in a second mobile communication network, where data traffic of the second data connection is to be transferred through the first data connection. The first method includes sending a second request to modify the first data connection in response to receiving the first request. Here, the second request containing a second set of parameters derived from the first set of parameters, where the second set of parameters modify the first data connection for supporting the data traffic of the second data connection. The first method includes transmitting the data traffic of the second data connection through the modified first data connection.

The embodiments of <FIG>, <FIG> and <FIG> as well as their associated text are part of the invention and covered by claims. All other exemplary embodiments disclosed below are merely explanatory, and are not part of the invention.

Code for carrying out operations for embodiments may be any number of lines and may be written in any combination of one or more programming languages including an object-oriented programming language such as Python, Ruby, Java, Smalltalk, C++, or the like, and conventional procedural programming languages, such as the "C" programming language, or the like, and/or machine languages such as assembly languages. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network ("LAN"), wireless LAN ("WLAN"), or a wide area network ("WAN"), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider ("ISP")).

The code may also be loaded onto a computer, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce a computer implemented process such that the code which execute on the computer or other programmable apparatus provide processes for implementing the functions/acts specified in the flowchart diagrams and/or block diagrams.

Generally, the present disclosure describes systems, methods, and apparatus for modifying a first data connection during the establishment of a second data connection. In certain embodiments, the methods may be performed using computer code embedded on a computer-readable medium. In certain embodiments, an apparatus or system may include a computer-readable medium containing computer-readable code which, when executed by a processor, causes the apparatus or system to perform at least a portion of the below described solutions.

The present disclosure described how the second PDU Session can support data communication with certain QoS given that all data traffic goes through the first PDU Session, which is unaware of the QoS requirements of the second PDU Session.

Disclosed herein are solutions to enable the UE to modify a first PDU Session with a first <NUM> core network (e.g., NPN) when the UE attempts to establish a second PDU Session with a second <NUM> core network (e.g., PLMN), so that the first PDU Session is capable of transferring the one or more Internet Protocol Security ("IPsec") child Security Associations ("SAs") of the second PDU Session by providing the necessary QoS handling.

<FIG> depicts a wireless communication system <NUM> for modifying a first data connection during the establishment of a second data connection, according to embodiments of the disclosure. In one embodiment, the wireless communication system <NUM> includes at least one remote unit <NUM>, a radio access network ("RAN") <NUM>, a first mobile core network <NUM>, e.g., in a non-public network (i.e., private network), and a second mobile core network <NUM>, e.g., in a public network. The RAN <NUM> and the mobile core network <NUM> form a mobile communication network. The RAN <NUM> may be composed of a base unit <NUM> with which the remote unit <NUM> communicates using wireless communication links <NUM>. While the RAN <NUM> is depicted as connecting to only the mobile core network <NUM> in the non-public network, in other embodiments the RAN <NUM> may connect to only the mobile core network <NUM> in the public network.

Even though a specific number of remote units <NUM>, base units <NUM>, wireless communication links <NUM>, RANs <NUM>, and mobile core networks <NUM>, <NUM> are depicted in <FIG>, one of skill in the art will recognize that any number of remote units <NUM>, base units <NUM>, wireless communication links <NUM>, RANs <NUM>, and mobile core networks <NUM>, <NUM> may be included in the wireless communication system <NUM>.

In one implementation, the RAN <NUM> is compliant with the <NUM> system specified in the Third Generation Partnership Project ("3GPP") specifications. For example, the RAN <NUM> may be a NG-RAN, implementing NR RAT and/or LTE RAT. In another example, the RAN <NUM> may include non-3GPP RAT (e.g., Wi-Fi® or Institute of Electrical and Electronics Engineers ("IEEE") <NUM>-family compliant WLAN). In another implementation, the RAN <NUM> is compliant with the LTE system specified in the 3GPP specifications. More generally, however, the wireless communication system <NUM> may implement some other open or proprietary communication network, for example Worldwide Interoperability for Microwave Access ("WiMAX") or IEEE <NUM>-family standards, among other networks.

In one embodiment, the remote units <NUM> may include computing devices, such as desktop computers, laptop computers, personal digital assistants ("PDAs"), tablet computers, smart phones, smart televisions (e.g., televisions connected to the Internet), smart appliances (e.g., appliances connected to the Internet), set-top boxes, game consoles, security systems (including security cameras), vehicle on-board computers, network devices (e.g., routers, switches, modems), or the like. Moreover, the remote units <NUM> may be referred to as the UEs, subscriber units, mobiles, mobile stations, users, terminals, mobile terminals, fixed terminals, subscriber stations, user terminals, wireless transmit/receive unit ("WTRU"), a device, or by other terminology used in the art. In various embodiments, the remote unit <NUM> includes a subscriber identity and/or identification module ("SIM") and the mobile equipment ("ME") providing mobile termination functions (e.g., radio transmission, handover, speech encoding and decoding, error detection and correction, signaling and access to the SIM). In certain embodiments, the remote unit <NUM> may include a terminal equipment ("TE") and/or be embedded in an appliance or device (e.g., a computing device, as described above).

The remote units <NUM> may communicate directly with one or more of the base units <NUM> in the RAN <NUM> via uplink ("UL") and downlink ("DL") communication signals. Furthermore, the UL and DL communication signals may be carried over the wireless communication links <NUM>. Here, the RAN <NUM> is an intermediate network that provides the remote units <NUM> with access to the mobile core network <NUM>.

In some embodiments, the remote units <NUM> communicate with an application server <NUM> via a network connection with the mobile core network <NUM>. For example, an application <NUM> (e.g., web browser, media client, telephone and/or Voice-over-Internet-Protocol ("VoIP") application) in a remote unit <NUM> may trigger the remote unit <NUM> to establish a protocol data unit ("PDU") session (or other data connection) with the mobile core network <NUM> via the RAN <NUM>. The mobile core network <NUM> then relays traffic between the remote unit <NUM> and the application server <NUM> in the packet data network <NUM> using the PDU session. The PDU session represents a logical connection between the remote unit <NUM> and the User Plane Function ("UPF") <NUM>.

In order to establish the PDU session (or PDN connection), the remote unit <NUM> must be registered with the mobile core network <NUM> (also referred to as "attached to the mobile core network" in the context of a Fourth Generation ("<NUM>") system). Note that the remote unit <NUM> may establish one or more PDU sessions (or other data connections) with the mobile core network <NUM>. As such, the remote unit <NUM> may have at least one PDU session for communicating with the packet data network <NUM>. The remote unit <NUM> may establish additional PDU sessions for communicating with other data networks and/or other communication peers.

In the context of a <NUM> system ("5GS"), the term "PDU Session" refers to a data connection that provides end-to-end ("E2E") user plane ("UP") connectivity between the remote unit <NUM> and a specific Data Network ("DN") through the UPF <NUM>. A PDU Session supports one or more Quality of Service ("QoS") Flows. In certain embodiments, there may be a one-to-one mapping between a QoS Flow and a QoS profile, such that all packets belonging to a specific QoS Flow have the same <NUM> QoS Identifier ("5QI").

In the context of a <NUM>/LTE system, such as the Evolved Packet System ("EPS"), a Packet Data Network ("PDN") connection (also referred to as EPS session) provides E2E UP connectivity between the remote unit and a PDN. The PDN connectivity procedure establishes an EPS Bearer, i.e., a tunnel between the remote unit <NUM> and a Packet Gateway ("PGW", not shown) in the mobile core network <NUM>. In certain embodiments, there is a one-to-one mapping between an EPS Bearer and a QoS profile, such that all packets belonging to a specific EPS Bearer have the same QoS Class Identifier ("QCI").

As described in greater detail below, the remote unit <NUM> may use a first data connection (e.g., PDU Session) established with the first mobile core network <NUM> to establish a second data connection (e.g., part of a second PDU session) with the second mobile core network <NUM>. When establishing a data connection (e.g., PDU session) with the second mobile core network <NUM>, the remote unit <NUM> uses the first data connection to register with the second mobile core network <NUM>.

The base units <NUM> may be distributed over a geographic region. In certain embodiments, a base unit <NUM> may also be referred to as an access terminal, an access point, a base, a base station, a Node-B ("NB"), an Evolved Node B (abbreviated as eNodeB or "eNB," also known as Evolved Universal Terrestrial Radio Access Network ("E-UTRAN") Node B), a <NUM>/NR Node B ("gNB"), a Home Node-B, a relay node, a RAN node, or by any other terminology used in the art. The base units <NUM> are generally part of a RAN, such as the RAN <NUM>, that may include one or more controllers communicably coupled to one or more corresponding base units <NUM>. These and other elements of radio access network are not illustrated but are well known generally by those having ordinary skill in the art. The base units <NUM> connect to the mobile core network <NUM> via the RAN <NUM>.

The base units <NUM> may serve a number of remote units <NUM> within a serving area, for example, a cell or a cell sector, via a wireless communication link <NUM>. The base units <NUM> may communicate directly with one or more of the remote units <NUM> via communication signals. Generally, the base units <NUM> transmit DL communication signals to serve the remote units <NUM> in the time, frequency, and/or spatial domain. Furthermore, the DL communication signals may be carried over the wireless communication links <NUM>. The wireless communication links <NUM> may be any suitable carrier in licensed or unlicensed radio spectrum. The wireless communication links <NUM> facilitate communication between one or more of the remote units <NUM> and/or one or more of the base units <NUM>. Note that during NR-U operation, the base unit <NUM> and the remote unit <NUM> communicate over unlicensed radio spectrum.

In one embodiment, the mobile core networks <NUM> and <NUM> are 5GC or an Evolved Packet Core ("EPC") networks, which may be coupled to a packet data network <NUM>, like the Internet and private data networks, among other data networks. A remote unit <NUM> may have a subscription or other account with the non-public mobile core network <NUM>. Additionally, the remote unit <NUM> may have a subscription or other account with the public mobile core network <NUM>. In various embodiments, each mobile core network <NUM>, <NUM> belongs to a single mobile network operator ("MNO").

The mobile core network <NUM> includes several network functions ("NFs"). As depicted, the mobile core network <NUM> includes at least one UPF <NUM>. The mobile core network <NUM> also includes multiple control plane ("CP") functions including, but not limited to, an Access and Mobility Management Function ("AMF") <NUM> that serves the RAN <NUM>, a Session Management Function ("SMF") <NUM>, a Policy Control Function ("PCF") <NUM>, a Unified Data Management function ("UDM") and a User Data Repository ("UDR").

The UPF(s) <NUM> is responsible for packet routing and forwarding, packet inspection, QoS handling, and external PDU session for interconnecting Data Network (DN), in the <NUM> architecture. The AMF <NUM> is responsible for termination of NAS signaling, NAS ciphering & integrity protection, registration management, connection management, mobility management, access authentication and authorization, security context management. The SMF <NUM> is responsible for session management (i.e., session establishment, modification, release), remote unit (i.e., UE) IP address allocation & management, DL data notification, and traffic steering configuration for UPF for proper traffic routing.

The PCF <NUM> is responsible for unified policy framework, providing policy rules to CP functions, access subscription information for policy decisions in UDR. The UDM is responsible for generation of Authentication and Key Agreement ("AKA") credentials, user identification handling, access authorization, subscription management. The UDR is a repository of subscriber information and can be used to service a number of network functions. For example, the UDR may store subscription data, policy-related data, subscriber-related data that is permitted to be exposed to third party applications, and the like. In some embodiments, the UDM is co-located with the UDR, depicted as combined entity "UDM/UDR" <NUM>.

In various embodiments, the mobile core network <NUM> may also include an Authentication Server Function ("AUSF") (which acts as an authentication server), a Network Repository Function ("NRF") (which provides NF service registration and discovery, enabling NFs to identify appropriate services in one another and communicate with each other over Application Programming Interfaces ("APIs")), a Network Exposure Function ("NEF") (which is responsible for making network data and resources easily accessible to customers and network partners), or other NFs defined for the 5GC. In certain embodiments, the mobile core network <NUM> may include an authentication, authorization, and accounting ("AAA") server.

The public mobile core network <NUM> includes several network functions ("NFs"). As depicted, the mobile core network <NUM> includes at least one UPF <NUM>. The mobile core network <NUM> also includes multiple control plane ("CP") functions including, but not limited to, an Access and Mobility Management Function ("AMF") <NUM> that serves the RAN <NUM>, a Session Management Function ("SMF") <NUM>, a Policy Control Function ("PCF") <NUM>, and a Unified Data Management function ("UDM"). In some embodiments, the UDM is co-located with a User Data Repository ("UDR"), depicted as combined entity "UDM/UDR" <NUM>. The roles of the UPF <NUM>, AMF <NUM>, SMF <NUM>, PCF <NUM> and UDM/UDR <NUM> are the same as those described above with reference to the UPF <NUM>, AMF <NUM>, SMF <NUM>, PCF <NUM> and UDM/UDR <NUM>. In various embodiments, the mobile core network <NUM> may also include an Authentication Server Function ("AUSF"), a Network Repository Function ("NRF"), or other NFs defined for the 5GC. In certain embodiments, the mobile core network <NUM> may include an authentication, authorization, and accounting ("AAA") server.

In various embodiments, the each of the mobile core networks <NUM> and <NUM> supports different types of mobile data connections and different types of network slices, wherein each mobile data connection utilizes a specific network slice. Here, a "network slice" refers to a portion of a core network optimized for a certain traffic type or communication service. A network instance may be identified by a single-network slice selection assistance information ("S-NSSAI") while a set of network slices for which the remote unit <NUM> is authorized to use is identified by network slice selection assistance information ("NSSAI"). Here, "NSSAI" refers to a vector value including one or more S-NSSAI values. In certain embodiments, the various network slices may include separate instances of network functions, such as the SMF <NUM>/<NUM> and UPF <NUM>/<NUM>. In some embodiments, the different network slices may share some common network functions, such as the AMF <NUM>/<NUM>. The different network slices are not shown in <FIG> for ease of illustration, but their support is assumed.

Although specific numbers and types of network functions are depicted in <FIG>, one of skill in the art will recognize that any number and type of network functions may be included in the mobile core networks <NUM> and <NUM>. While depicted as a mobile core in a non-public network, in other embodiments the mobile core <NUM> may be a mobile core is a separate PLMN than the mobile core network <NUM>. In such embodiments, the remote unit <NUM> may establish a data connection with the mobile core network <NUM> to register with the mobile core network <NUM> via the Non-3GPP Interworking Function ("N31WF") <NUM>.

The N3IWF <NUM> is a network function that supports access to a 5GC via non-3GPP access networks. In general, the N3IWF <NUM> supports connectivity to one or more 5GC networks for UEs which support the NAS protocol over non-3GPP access and the applicable NAS procedures. Here, the N3IWF <NUM> is also being used to support access of the remote unit <NUM> to the mobile core network <NUM> via another mobile network, here the non-public mobile core network <NUM>.

While <FIG> depicts components of a <NUM> RAN and a <NUM> core network, the described embodiments for modifying a first data connection during the establishment of a second data connection apply to other types of communication networks and RATs, including IEEE <NUM> variants, Global System for Mobile Communications ("GSM", i.e., a <NUM> digital cellular network), General Packet Radio Service ("GPRS"), Universal Mobile Telecommunications System ("UMTS"), LTE variants, CDMA <NUM>, Bluetooth, ZigBee, Sigfox, and the like.

Moreover, in an LTE variant where the mobile core network <NUM> and/or the mobile core network <NUM> is an EPC, the depicted network functions may be replaced with appropriate EPC entities, such as a Mobility Management Entity ("MME"), a Serving Gateway ("SGW"), a PGW, a Home Subscriber Server ("HSS"), and the like. For example, the AMF may be mapped to an MME, the SMF may be mapped to a control plane portion of a PGW and/or to an MME, the UPF may be mapped to an SGW and a user plane portion of the PGW, the UDM/UDR may be mapped to an HSS, etc..

In the following descriptions, the term "RAN node" is used for the base station but it is replaceable by any other radio access node, e.g., gNB, eNB, Base Station ("BS"), Access Point ("AP"), etc. Further, the operations are described mainly in the context of <NUM> NR. However, the proposed solutions/methods are also equally applicable to other mobile communication systems modifying a first data connection during the establishment of a second data connection.

To solve the problem of appropriate QoS handling for a second PDU Session whose traffic goes through the first PDU Session, described above, the present disclosure proposes solutions that enables a UE (e.g., the remote unit <NUM>) that has established a first data connection with a first mobile network (i.e., mobile core <NUM> in NPN), the first data connection having a first set of QoS characteristics, to establish a second data connection with a second mobile network (i.e., mobile core <NUM> in PLMN), the second data connection having a second set of QoS characteristics, wherein the traffic of the second data connection is transferred via the first data connection, and wherein the second data connection is established after modifying the first data connection to support the second QoS characteristics.

<FIG> depicts a network deployment <NUM> comprising a UE <NUM> which registers with a non-public network ("NPN") <NUM>. In one embodiment, the NPN <NUM> may be a standalone NPN ("SNPN"), i.e., having its own network function and not relying on network functions provided by a PLMN. In another embodiment, the NPN <NUM> may be a public network integrated NPN ("PNI-NPN), i.e., a non-public network deployed with the support of a PLMN. The NPN <NUM> includes at least an AMF ("AMF-<NUM>") <NUM>, a SMF ("SMF-<NUM>") <NUM>, and a UPF ("UPF-<NUM>") <NUM>. In various embodiments, the NPN <NUM> includes additional NFs as described above with reference to <FIG>. Note that the UE <NUM> connects to the NPN <NUM> via an Access Network <NUM>.

As depicted, the UE <NUM> is simultaneously connected to two <NUM> core networks: a first 5GC in the NPN <NUM> and a second 5GC in the PLMN <NUM>. After the UE <NUM> registers with the first 5GC in the NPN <NUM>, it can access a second 5GC in the PLMN <NUM> as follows;.

First, the UE <NUM> establishes an IP-type PDU Session <NUM> with the first 5GC in the NPN according to the existing procedures and, thus, obtains IP connectivity. This is the first PDU Session of the UE <NUM> and (as any other PDU Session) is composed of one or more QoS flows, each one carrying the data traffic of the PDU Session with certain QoS requirements. Through the first PDU Session, the UE <NUM> obtains connectivity to the Data Network <NUM> (DN-<NUM>) <NUM>. As depicted, the NPN <NUM> and the PLMN <NUM> are connected via a data network ("DN-<NUM>") <NUM>.

When the UE <NUM> decides to connect to the PLMN <NUM>, the UE <NUM> discovers the IP address of an N3IWF <NUM> in this PLMN <NUM> (e.g., by performing DNS procedures via the first PDU Session) and establishes a signaling IPsec SA <NUM> with the N3IWF <NUM>. The UE <NUM> then registers to this PLMN <NUM> by performing an existing procedure for <NUM> registration via the N3IWF <NUM> or, equivalently, for <NUM> registration via untrusted non-3GPP access. This registration procedure is conducted by exchanging NAS messages between the UE <NUM> and AMF-<NUM><NUM> via the N3IWF <NUM> and via the first PDU Session <NUM> of the UE <NUM> (i.e., via the UPF-<NUM><NUM> in the NPN <NUM> and via the Access Network <NUM>). As depicted, the PLMN <NUM> includes at least the N3IWF <NUM>, an AMF ("AMF-<NUM>") <NUM>, a SMF ("SMF-<NUM>") <NUM>, and a UPF ("UPF-<NUM>") <NUM>. In various embodiments, the PLMN <NUM> includes additional NFs as described above with reference to <FIG>.

After registering with the PLMN <NUM> via the N3IWF <NUM> and via the first PDU Session <NUM>, the UE <NUM> requests to establish a (second) PDU Session with the PLMN <NUM>, which provides connectivity to the Data Network <NUM> (DN-<NUM>) <NUM>. This is the second PDU Session of the UE <NUM> and all data traffic of this second PDU Session is transported over the first PDU Session <NUM>. It is important to note that the second PDU Session with the PLMN <NUM> is established completely transparently to the NPN <NUM>. In other words, the NPN <NUM> cannot determine if and when the UE <NUM> establishes the second PDU Session because all NAS messages exchanged between the UE <NUM> and AMF-<NUM><NUM> to establish this PDU Session are transmitted as encrypted data packets via the first PDU Session.

Moreover, after registering with the PLMN <NUM>, the UE <NUM> has an N1 connection with the AMF-<NUM><NUM> for the NPN and also an N1 connection with the AMF-<NUM><NUM> for the PLMN. After establishing a second PDU session with the PLMN CN <NUM>, the UE <NUM> may access another data network ("DN-<NUM>") <NUM> via the UPF-<NUM><NUM>.

In one example, the second PDU Session might be set up by the UE <NUM> in order to access real-time voice services in the PLMN <NUM>. Therefore, the voice traffic over the second PDU Session is to be transmitted with appropriate QoS handling so that the delay and the loss rate do not exceed certain bounds. As noted above, the second PDU Session is established transparently to the NPN and, thus, the QoS flows supported by the first PDU Session <NUM> do not take into account the QoS requirements of the second PDU Session. Therefore, the solutions disclosed herein enable the UE <NUM> to modify the PDU session <NUM> to provide appropriate QoS handling to the voice traffic of the second PDU Session, e.g., in order to support QoS for real-time voice traffic.

<FIG> depicts a network architecture <NUM> showing user-plane traffic, according to embodiments of the disclosure. The network architecture <NUM> includes a UE <NUM> which is registered with a first mobile communication network <NUM>. In various embodiments, the first mobile communication network <NUM> is a non-public network, such as the mobile core network <NUM> and/or the NPN <NUM>.

In the scenario of <FIG>, the UE <NUM> has established a first PDU Session <NUM> with the first mobile communication network <NUM> (i.e., PDU Session <NUM>) having two QoS flows for communicating with Data Network-<NUM><NUM>, e.g., the Internet. All data packets in the first PDU Session <NUM> are transmitted over one of these two QoS flows (QoS Flow-<NUM><NUM> and QoS Flow-<NUM><NUM>), each one offering different QoS characteristics.

The UE <NUM> may be configured with QoS rules that map the uplink data traffic of the UE <NUM> to one of these QoS flows. Similarly, the UPF-<NUM><NUM> may be configured with N4 rules that map the downlink data traffic of the UE <NUM> to one of these QoS flows. The first PDU Session <NUM> is anchored at the UPF-<NUM><NUM>. As depicted in <FIG>, data between the UPF-<NUM> and the DN-<NUM><NUM> is over the N6 interface.

Again referencing <FIG>, the UE <NUM> registers with the 5GC in the second mobile communication network <NUM> in via the first PDU session <NUM> and establishes a second PDU Session ("PDU Session <NUM>") <NUM> for communicating with Data Network-<NUM><NUM>, e.g., an enterprise network. Here, the second PDU Session <NUM> is anchored at UPF-<NUM><NUM>. Note that traffic of the second PDU session <NUM> goes through a gateway or an interworking function, depicted here as the N3IWF <NUM>, in the second mobile communication network <NUM>. Note that the second mobile communication network <NUM> may be a public network, such as the mobile core network <NUM> and/or the PLMN <NUM>.

After the establishment of the second PDU Session (PDU Session <NUM>) <NUM> with the second mobile communication network <NUM> (e.g., PLMN), an IPsec child SA <NUM> is established between the UE <NUM> and the N3IWF <NUM> and all data traffic of the second PDU Session <NUM> is transported over this child SA, which establishment is described in greater detail with reference to <FIG>. In one embodiment, the traffic of the IPsec child SA is transferred via one of the existing QoS flows of the first PDU Session. However, as aforementioned, it is possible for the first PDU Session to have no QoS flows suitable to provide the QoS required by the IPsec child SA of the second PDU Session.

If an established QoS flow supports the appropriate QoS for the second PDU session <NUM>, then the UE <NUM> modifies the first PDU session <NUM> by indicating the existing QoS flow suitable to carry the data traffic of the second PDU session <NUM> and provides packet filters identifying the data traffic of the second PDU session <NUM>. Examples of such packet filters include an IP address of the N3IWF <NUM> and security parameter index ("SPI") assigned by the N3IWF <NUM>.

If no established QoS flow for the first PDU session <NUM> supports the appropriate QoS for the second PDU session <NUM>, then the UE <NUM> modifies the first PDU session <NUM> by creating a new QoS flow <NUM> that will carry the IPsec traffic of the second PDU session <NUM> and maps the IPsec traffic of the second PDU session <NUM> onto this new QoS flow <NUM>. In this way, the IPsec traffic of the second PDU session <NUM> receives the appropriate QoS handling when going through the first PDU Session <NUM>. In the depicted example, it is assumed that a new QoS flow <NUM> is created to support the QoS requirements of the second PDU session <NUM>.

Note that in <FIG>, the first data connection corresponds to the first PDU Session <NUM> and the second data connection corresponds to the IPsec child SA <NUM> between the UE and N3IWF (not to the second PDU Session). While the depicted embodiment shows only one IPsec child SA <NUM>, in other embodiments the second PDU Session <NUM> may have multiple IPsec child SAs, each one dedicated to carrying the traffic with similar QoS requirements.

In the general case, where the second PDU Session <NUM> is composed of multiple IPsec SAs, then the UE <NUM> may establish a new QoS flow for every IPsec SA. Alternatively, the UE <NUM> may establish a new QoS for some IPsec SAs and map the other IPsec SAs into existing QoS flows. For ease of illustration, only a single IPsec SA <NUM> is shown in <FIG>.

<FIG> depicts a scenario <NUM> where the UE <NUM> has established a first data connection <NUM> (i.e., PDU Session <NUM>) with the first mobile communication network <NUM>. In the depicted example, the first data connection includes two QoS flows: a first QoS flow ("QoS Flow-<NUM>") <NUM> and a second QoS flow ("QoS Flow-<NUM>") <NUM>; however, in other embodiments the first data connection may be established with more or fewer QoS flows. The first QoS flow <NUM> is used to transfer data having first QoS requirements, while the second QoS flow <NUM> may be used to transfer data traffic <NUM> having different QoS requirements. Notably, the second QoS flow <NUM> is used to establish a signaling Internet Protocol Security ("IPsec") security association ("SA") <NUM> with the N3IWF <NUM> via the DN-<NUM><NUM>. The signaling IPsec SA <NUM> established here may be an implementation of the signaling IPsec SA <NUM>, described above. In certain embodiments, the second QoS flow <NUM> may carry other data traffic <NUM> to the DN-<NUM><NUM>, i.e., having the same QoS requirements and the signaling IPsec SA <NUM>. Note that the N3IWF <NUM> in the second mobile communication network <NUM> terminates the signaling IPsec SA <NUM> and uses an N2 connection established with the AMF-<NUM><NUM> to carry signaling traffic from the UE <NUM> to the AMF-<NUM><NUM>.

<FIG> depict a procedure <NUM> for registering with a mobile network through another mobile network, according to embodiments of the disclosure. The procedure <NUM> involves the UE <NUM>, a Next Generation RAN ("NG-RAN") <NUM>, an AMF, SMF, UPF and PCF in a first mobile communication network <NUM> (i.e., the AMF-<NUM><NUM>, the SMF-<NUM><NUM>, the UPF-<NUM><NUM> and a "PCF-<NUM>" <NUM>), and a N3IWF, AMF, SMF, UPF, PCF and UDM in a second mobile communication network <NUM> (i.e., the N3IWF <NUM>, the AMF-<NUM><NUM>, the SMF-<NUM><NUM>, the UPF-<NUM><NUM>, a "PCF-<NUM>" <NUM> and a "UDM-<NUM>" <NUM>, respectively).

The procedure <NUM> enables the UE <NUM> to modify a first PDU Session with a first mobile communication network <NUM> (e.g., NPN) when the UE <NUM> attempts to establish a second PDU Session with a second mobile communication network <NUM> (e.g., PLMN), so that the first PDU Session is capable of transferring the one or more IPsec child SAs of the second PDU Session by providing the necessary QoS handling. While the procedure <NUM> assumes that the first mobile communication network <NUM> is an NPN and the second mobile communication network <NUM> is a PLMN, in an alternative embodiment, the roles of the NPN and the PLMN can be interchanged. In other words, it is also possible the apply the principles and the procedure described below in a scenario where the UE <NUM> is connected to a PLMN (consisting of NG-RAN access and 5GC core network) and uses a PDU Session via the PLMN to connect to an NPN consisting of at least a <NUM> core network by using a N3IWF in the NPN. This scenario is beneficial in case when the NPN coverage is limited and the UE <NUM> can use the PLMN to access the NPN services when the UE <NUM> is outside the NPN coverage.

At <FIG>, the procedure <NUM> begins at Step <NUM> where, as a precondition, the UE <NUM> has registered with the 5GC in the first mobile communication network <NUM> (e.g., NPN) and has established the first PDU Session <NUM> that is composed of two QoS flows (see block <NUM>). Also, the UE <NUM> has registered with the, e.g., 5GC in the second mobile communication network <NUM> via the N3IWF <NUM> and, thus, has established the so-called "signaling IPsec SA" with the N3IWF <NUM>, via which all Non-Access Stratum ("NAS") messages between the UE <NUM> and AMF-<NUM><NUM> are exchanged. Note that all these NAS messages are encrypted and cannot be inspected by UPF-<NUM><NUM> or another network function in first mobile communication network <NUM>.

At Step 1a, the UE <NUM> sends a NAS message (e.g., PDU Session Establishment Request) in order to establish the second PDU Session with the second mobile communication network <NUM>. This NAS message is transferred via the Signaling IPsec SA <NUM> to the N3IWF <NUM> and is then forwarded to AMF-<NUM><NUM> (see messaging <NUM>). The PDU Session Establishment Request contains a PDU Session Identity ("ID"), which identifies the second PDU Session, denoted here as "PDU Session ID-<NUM>".

At Step 1b, the AMF-<NUM><NUM> sends a Session Management ("SM") Context Create Request message to the SMF-<NUM><NUM> (see messaging <NUM>) and, at Step 1c, normal PDU Session establishment procedure initiates in the 5GC of the second mobile communication network <NUM>, e.g., as specified in 3GPP TS <NUM> (see block <NUM>). At Step 1d, the SMF-<NUM><NUM> sends a N1N2 Message Transfer to the AMF-<NUM><NUM> (see messaging <NUM>).

At Step <NUM>, as part of the second PDU Session Establishment procedure, the N3IWF <NUM> receives a PDU Session Resource Setup Request message from the AMF-<NUM><NUM> (see messaging <NUM>), requesting the N3IWF <NUM> to reserve access resources to support (e.g.) two QoS flows: One Guaranteed Bit Rate ("GBR") QoS flow, identified by QFI-<NUM>, and one non-GBR QoS flow, identified by QFI-<NUM>. Each of the two QoS flows is associated with a set of QoS parameters that designate the QoS requirements for the QoS flow, e.g., the packet delay budget ("PDB") and the packet error rate ("PER"). For the GBR QoS flow, the QoS parameters also include the GBR QoS Flow Info, which contains the required maximum and guaranteed flow bit rates.

The 5GC in the second mobile communication network <NUM> (e.g., PLMN) determines the number of QoS flows and the QoS parameters of each QoS flow on the second PDU Session based on subscription information of the UE <NUM>, pre-configured policies of the second mobile communication network <NUM>, etc..

At Step <NUM>, to reserve the appropriate access resources, the N3IWF <NUM> decides to establish two IPsec child SAs with the UE <NUM> (see block <NUM>). Here, a first IPsec child SA is to carry the traffic of the GBR flow, and a second IPsec child SA is to carry the traffic of the non-GBR flow.

Continuing on <FIG>, at Step <NUM> the N3IWF <NUM> sends to the UE <NUM> an IKEv2 Create Child SA Request to establish the first IPsec child SA for the GBR flow (see messaging <NUM>). As specified in 3GPP TS <NUM>, the IKEv2 Create Child SA Request includes several parameters associated with the requested IPsec child SA, e.g., an SPI assigned by the N3IWF <NUM> for the first IPsec child SA (here denoted as "SPI-i-<NUM>"), the PDU Session ID of the second PDU Session (PDU Session ID-<NUM>), the Differentiated Services Code Point ("DSCP"), the QoS Flow ID ("QFI") of the GBR flow, the Additional QoS Information, etc. The Additional QoS Information contains parameters that define the QoS requirements of the first IPsec child SA, including the packet delay budget, the packet error rate, the maximum and guaranteed flow rates, etc..

In one example, the Additional QoS Information includes:.

At Step <NUM>, the UE <NUM> decides to request a new QoS flow on the first PDU Session in order to transfer the traffic of the first IPsec child SA because the UE <NUM> determines that none of the existing QoS flows on the first PDU Session <NUM> is suitable to fulfill the QoS requirements of the first IPsec child SA as expressed by the Additional QoS information (see block <NUM>).

At Step <NUM>, to establish a new QoS flow on the first PDU Session, the UE <NUM> initiates the UE-initiated PDU Session Modification procedure <NUM> with the first mobile communication network <NUM>. The UE <NUM> provides to the AMF-<NUM><NUM> (and SMF-<NUM><NUM>) a PDU session ID, which identifies the first PDU Session (here denoted as "PDU Session ID-<NUM>"), and the Requested QoS rules element that describes the data traffic which will be carried over the first IPsec child SA (see messaging <NUM>). In addition, the UE <NUM> provides to the AMF-<NUM><NUM> (and SMF-<NUM><NUM>) the Requested QoS flow descriptions element that describes the QoS requirements of the traffic which will be carried over the first IPsec child SA.

In one example, the UE <NUM> provides the following Requested QoS rules element and Requested QoS flow descriptions element to first mobile communication network <NUM>:.

Note that the UE <NUM> derives the elements included in the PDU Session Modification Request sent to the first mobile communication network <NUM> by using the parameters received in step <NUM> from the N3IWF <NUM>, e.g., the SPI-i-<NUM> and the Additional QoS Information-<NUM>. In addition, the UE <NUM> provides the SPI-r-<NUM> which is assigned by the UE <NUM> to the first IPsec child SA. As used herein, the label "SPI-i" is used to indicate a network-assigned SPI (e.g., assigned by the N3IWF <NUM>), while the label "SPI-r" is used to indicate a UE-assigned SPI.

If the first mobile communication network <NUM> (e.g., NPN) accepts the PDU Session modification requested by the UE <NUM>, the UPF-<NUM><NUM>, the AMF-<NUM><NUM>, the SMF-<NUM><NUM> and the PCF-<NUM><NUM> modify the first PDU session <NUM> and reserve resources to support QoS requirements of the second IPsec child SA (see block <NUM>). Via the AMF-<NUM><NUM>, the SMF-<NUM><NUM> responds to the UE <NUM> with a PDU Session Modification Command including the Authorized QoS rules element and the Authorized QoS flow descriptions element, which are essentially the same as the Requested QoS rules element and the Requested QoS flow descriptions element provided by the UE <NUM>, respectively, except that they include a specific QFI value assigned by the first mobile communication network <NUM> for the newly created QoS flow (referred to as QoS flow <NUM>) (see messaging <NUM>). The UE <NUM> acknowledges the PDU Session Modification Command by sending a PDU Session Modification Complete message (see messaging <NUM>).

At Step <NUM>, after successfully reserving resources on the first PDU Session in the first mobile communication network <NUM> to support the QoS requirements of the first IPsec child SA of the second PDU Session, the UE <NUM> sends an IKEv2 Create Child SA Response to N3IWF <NUM> including its own SPI for the first IPsec child SA (here denoted as "SPI-r-<NUM>"), which completes the establishment of the first IPsec child SA (see messaging <NUM>).

Continuing on <FIG>, because in step <NUM> the N3IWF <NUM> decided to establish two IPsec child SAs for the second PDU Session, then the steps similar to steps <NUM>-<NUM> are executed again for the establishment of the second IPsec child SA and the associated resources on the first PDU Session. As a result, another new QoS flow is created on the first PDU Session (referred to as QoS flow <NUM>) to support the QoS requirements of the second IPsec child SA.

At Step <NUM>, the N3IWF <NUM> sends to the UE <NUM> an IKEv2 Create Child SA Request to establish the second IPsec child SA for the non-GBR flow (see messaging <NUM>). Again, the IKEv2 Create Child SA Request includes several parameters associated with the requested IPsec child SA, e.g., an SPI assigned by the N3IWF <NUM> for the second IPsec child SA (here denoted as "SPI-i-<NUM>"), the PDU Session ID of the second PDU Session (i.e., PDU Session ID-<NUM>), the DSCP, the QFI of the non-GBR flow, the Additional QoS Information, etc. The Additional QoS Information contains parameters that define the QoS requirements of the second IPsec child SA (non-GBR), including the packet delay budget ("PDB"), the packet error rate ("PER"), etc. Note, however, that since the second IPsec child SA carries the traffic of a non-GBR flow, the Additional QoS Information contains only the QoS characteristics component and does not contain a GBR QoS flow info component.

At Step <NUM>, the UE <NUM> decides to request a new QoS flow on the second PDU Session in order to transfer the traffic of the second IPsec child SA, i.e., because the UE <NUM> determines that none of the existing QoS flows on the first PDU Session <NUM> is suitable to fulfill the QoS requirements of the second IPsec child SA as expressed by the Additional QoS information (see block <NUM>).

At Step <NUM>, to establish a new QoS flow on the first PDU Session, the UE <NUM> initiates the UE-initiated PDU Session Modification procedure <NUM> with the first mobile communication network <NUM> (e.g., NPN). The UE <NUM> provides to the AMF-<NUM><NUM> (and SMF-<NUM><NUM>) a PDU session ID, which identifies the first PDU Session (i.e., PDU Session ID-<NUM>), and the Requested QoS rules element that describes the data traffic which will be carried over the second IPsec child SA (see messaging <NUM>). Additionally, the UE <NUM> provides to the AMF-<NUM><NUM> (and SMF-<NUM><NUM>) the Requested QoS flow descriptions element that describes the QoS requirements of the traffic which will be carried over the second IPsec child SA.

If the first mobile communication network <NUM> accepts the PDU Session modification requested by the UE <NUM>, the UPF-<NUM><NUM>, the AMF-<NUM><NUM>, the SMF-<NUM><NUM> and the PCF-<NUM><NUM> modify the first PDU session <NUM> and reserve resources to support QoS requirements of the second IPsec child SA (see block <NUM>). The SMF-<NUM><NUM> sends to the UE <NUM>, via the AMF-<NUM><NUM>, a PDU Session Modification Command containing PDU Session ID, Authorized QoS Rules, and Authorized QoS Flow Descriptions (see signaling <NUM>). The UE <NUM> acknowledges the PDU Session modification command by sending a PDU Session modification complete message (see messaging <NUM>).

Note that Steps <NUM> and <NUM> (the UE-initiated PDU Session Modification) are needed even if the UE <NUM> determines that the traffic of a requested IPsec child SA can be mapped to an existing QoS flow, i.e., when there is no need to establish a new QoS flow to support the first IPsec child SA and/or the second IPsec child SA. In this case, the UE <NUM> sends a PDU Session Modification Request including a Requested QoS rules information element ("IE") indicating "modify existing QoS rule and add packet filters" and will include the packet filters identifying the traffic of the first IPsec child SA and/or the second IPsec child SA.

At Step <NUM>, after successfully reserving resources on the first PDU Session in first mobile communication network <NUM> to support the QoS requirements of the second IPsec child SA (i.e., for non-GBE flow) of the second PDU Session, the UE <NUM> sends an IKEv2 Create Child SA Response to N3IWF <NUM> including its own SPI for the second IPsec child SA (here denoted as "SPI-r-<NUM>"), which completes the establishment of the second IPsec child SA (see messaging <NUM>).

At Step <NUM>, the N3IWF <NUM> responds to AMF-<NUM><NUM> with a PDU Session Resource Setup Response indicating that the access resources for the second PDU Session are reserved (see messaging <NUM>). At this point, the data traffic of the second PDU Session can be communicated between the UE <NUM> and UPF-<NUM><NUM>, via the first PDU Session. Note that the data traffic of the second PDU Session is composed of the data traffic of the first IPsec child SA and the data traffic of the second IPsec child SA. The traffic of the first IPsec child SA is transferred on the QoS flow <NUM> (created in step <NUM>) of the first PDU Session and the data traffic of the second IPsec child SA is transferred on the QoS flow <NUM> (created in step <NUM>) of the first PDU Session.

By using the procedure <NUM>, the UE <NUM> ensures that the traffic of the two IPsec child SAs (second data connection and third data connection) of the second PDU Session is transferred via the first PDU Session (first data connection) by receiving the appropriate QoS handling. This enables the UE <NUM> to establish a PDU Session with the second mobile communication network <NUM> (e.g., PLMN), via the first mobile communication network <NUM> (e.g., NPN), which can receive the expected QoS handling.

<FIG> depicts a scenario <NUM> where a first data connection has been modified to support establishment of a second data connection, e.g., according to the procedure described above with refence to <FIG>. Here, it is assumed that a modified first data connection <NUM> (i.e., modified first PDU session) initially included the first QoS flow <NUM> and the second QoS flow <NUM>, but that UE <NUM> determined that new QoS flows were needed to support IPsec child SAs for a second PDU Session <NUM> established with the second mobile communication network <NUM> via the first PDU session.

In the depicted example, the UE <NUM> has created two new QoS flows to support the second PDU session <NUM>, specifically: a third QoS flow ("QoS Flow-<NUM>") <NUM> and a fourth QoS flow ("QoS Flow-<NUM>") <NUM>. The third QoS flow <NUM> is used to transfer data traffic of a first IPsec Child SA <NUM> (e.g., a GBR flow), while the fourth QoS flow <NUM> is to be used to transfer data traffic of a second IPsec Child SA <NUM> (e.g., a non-GBR flow). Note that the second QoS flow <NUM> supports the signaling Internet Protocol Security ("IPsec") security association ("SA") <NUM> with the N3IWF <NUM> via the DN-<NUM><NUM>. Further note that the N3IWF <NUM> terminates the first and second IPsec child SAs <NUM>, <NUM> and uses an N3 tunnel established with the UPF-<NUM><NUM> in the second mobile communication network <NUM> to carry data traffic of the second PDU session <NUM>, which includes both the data traffic of the first IPsec child SA <NUM> and the data traffic of the second IPsec child SA <NUM>.

In <FIG>, the first data connection corresponds to the first PDU Session <NUM>, the second data connection corresponds to the first IPsec child SA <NUM> between the UE and N3IWF (not to the second PDU Session), and the third data connection corresponds to the second IPsec child SA 625between the UE and N3IWF (not to the second PDU Session).

<FIG> depicts a user equipment apparatus <NUM> that may be used for modifying a first data connection during the establishment of a second data connection, according to embodiments of the disclosure. In various embodiments, the user equipment apparatus <NUM> is used to implement one or more of the solutions described above. The user equipment apparatus <NUM> may be one embodiment of the remote unit <NUM> and/or the UE <NUM>, described above. Furthermore, the user equipment apparatus <NUM> may include a processor <NUM>, a memory <NUM>, an input device <NUM>, an output device <NUM>, and a transceiver <NUM>.

In some embodiments, the input device <NUM> and the output device <NUM> are combined into a single device, such as a touchscreen. In certain embodiments, the user equipment apparatus <NUM> may not include any input device <NUM> and/or output device <NUM>. In various embodiments, the user equipment apparatus <NUM> may include one or more of: the processor <NUM>, the memory <NUM>, and the transceiver <NUM>, and may not include the input device <NUM> and/or the output device <NUM>.

As depicted, the transceiver <NUM> includes at least one transmitter <NUM> and at least one receiver <NUM>. In some embodiments, the transceiver <NUM> communicates with one or more cells (or wireless coverage areas) supported by one or more base units <NUM>. In various embodiments, the transceiver <NUM> is operable on unlicensed spectrum. Moreover, the transceiver <NUM> may include multiple UE panel supporting one or more beams. Additionally, the transceiver <NUM> may support at least one network interface <NUM> and/or application interface <NUM>. The application interface(s) <NUM> may support one or more APIs. The network interface(s) <NUM> may support 3GPP reference points, such as Uu, N1, PC5, etc. Other network interfaces <NUM> may be supported, as understood by one of ordinary skill in the art.

In certain embodiments, the processor <NUM> may include an application processor (also known as "main processor") which manages application-domain and operating system ("OS") functions and a baseband processor (also known as "baseband radio processor") which manages radio functions.

In various embodiments, the processor <NUM> controls the user equipment apparatus <NUM> to implement the above described UE behaviors. For example, the processor <NUM> may receive a first request (e.g., IKE Create Child SA request) via a first data connection(e.g., PDU Session <NUM>) with a first mobile communication network over a first access network, the first data connection supporting a plurality of quality of service ("QoS") flows. The first request contains a first set of parameters (e.g., SPI, Additional QoS information) for establishing a second data connection (e.g., IPsec child SA) with an interworking function (e.g., N3IWF) in a second mobile communication network. Here, data traffic of the second data connection is to be transferred through the first data connection (e.g., IPsec child SA is transported inside the PDU Session <NUM>).

In some embodiments, the first mobile communication network includes a non-public network ("NPN"), and the second mobile communication network includes a public land mobile network ("PLMN"). In other embodiments, the first mobile communication network includes a PLMN and the second mobile communication network includes an NPN.

Via the transceiver <NUM>, the processor <NUM> sends a second request (e.g., PDU Session Modification Request) to modify the first data connection in response to receiving the first request, the second request containing a second set of parameters (e.g., Requested QoS Rules, Requested QoS flow descriptions) derived from the first set of parameters (e.g., SPI, Additional QoS information), wherein the second set of parameters modify the first data connection for supporting the data traffic of the second data connection. Via the transceiver <NUM>, the processor <NUM> transmits the data traffic of the second data connection through the modified first data connection.

As used herein, modifying the first data connection means either (a) add a new QoS flow to the first data connection that is suitable to carry the data traffic of the second data connection, or (b) indicate an existing QoS flow of the first data connection that is suitable to carry the data traffic of the second data connection. The user equipment apparatus <NUM> decides option (a) when it determines that none of the existing QoS flows can support the required QoS of the second data connection, as indicated by the "Additional QoS Information" in the first request.

In some embodiments, the second set of parameters indicate to establish a new QoS flow over the first data connection. Here, the new QoS flow is to carry the data traffic of the second data connection. In such embodiments, the second set of parameters indicate to establish a new QoS flow over the first data connection in response to determining that none of the existing QoS flows over the first data connection is suitable to carry the data traffic of the second data connection. Note that a QoS flow is not suitable to carry the data traffic of the second data connection when the QoS provided by this QoS flow cannot provide the QoS required by the Additional QoS information. In certain embodiments, the second set of parameters includes packet filters (e.g., IP address of N3IWF and SPI) identifying the data traffic of the second data connection.

In some embodiments, the second set of parameters indicate an existing QoS flow of the first data connection. Here, the existing QoS flow is to carry the data traffic of the second data connection. In certain embodiments, the second set of parameters includes packet filters (e.g., IP address of N3IWF and SPI) identifying the data traffic of the second data connection.

In some embodiments, the second data connection includes an Internet Protocol Security ("IPsec") child security association ("SA"), wherein first set of parameters includes a security parameter index ("SPI") and additional QoS information for the IPsec child SA. In certain embodiments, the second set of parameters includes requested QoS rules and requested QoS flow descriptions for modifying the first data connection to support the data traffic of the IPsec child SA. Note that the requested QoS flow description is needed only when the IPsec child SA carries Guaranteed Bit-Rate ("GBR") traffic.

In some embodiments, the first request is an Internet Key Exchange ("IKE") Create Child SA request received from a non-3GPP interworking function ("N3IWF"). In such embodiments, the processor <NUM> further sends an IKE Create Child SA response message to the N3IWF in response to successfully modifying the first data connection and prior to transmitting the data traffic of the second data connection through the modified first data connection. In some embodiments, the first request (e.g., IKE Create Child SA request) is received in response to transmitting a PDU session establishment request via the first data connection, requesting the establishment of a PDU session in the second mobile communication network via the interworking function in the second mobile communication network. Note that the PDU session in the second mobile communication network may be composed of one or more child IPsec SAs, e.g., a second data connection, a third data connection, etc..

In some further embodiments, the processor <NUM> receives a third request (e.g., a second IKE Create Child SA request) via the first data connection, the third request containing a third set of parameters (e.g., SPI-<NUM>, Additional QoS information-<NUM>) for establishing a third data connection (e.g., IPsec Child SA-<NUM>) with the interworking function. Here, data traffic of the third data connection is to be transferred through the first data connection (e.g., IPsec Child SA-<NUM> is also transported inside PDU session-<NUM>), where the second data connection and the third data connection form a PDU session with the second mobile communication network.

In one embodiment, the processor <NUM> sends a fourth request (e.g., PDU Session Modification Request) to establish a new QoS flow over the first data connection in response to receiving the third request. In another embodiment, the processor <NUM> sends a fourth request (e.g., PDU Session Modification Request) to indicate an existing QoS flow of the first data connection that is to carry the data traffic of the third data connection, in response to receiving the third request. In either embodiment, the fourth request contains a fourth set of parameters (e.g., Request QoS Rules, Requested QoS flow descriptions) derived from the third set of parameters. Via the transceiver <NUM>, the processor <NUM> transmits the data traffic of the third data connection through either the new QoS flow of the first data connection or the indicated existing QoS flow of the first data connection.

In some embodiments, the memory <NUM> stores data related to modifying a first data connection during the establishment of a second data connection. For example, the memory <NUM> may store various parameters, panel/beam configurations, resource assignments, policies, and the like as described above. In certain embodiments, the memory <NUM> also stores program code and related data, such as an operating system or other controller algorithms operating on the apparatus <NUM>.

The transceiver <NUM> communicates with one or more network functions of a mobile communication network via one or more access networks. The transceiver <NUM> operates under the control of the processor <NUM> to transmit messages, data, and other signals and also to receive messages, data, and other signals. For example, the processor <NUM> may selectively activate the transceiver <NUM> (or portions thereof) at particular times in order to send and receive messages.

The transceiver <NUM> includes at least transmitter <NUM> and at least one receiver <NUM>. One or more transmitters <NUM> may be used to provide UL communication signals to a base unit <NUM>, such as the UL transmissions described herein. Similarly, one or more receivers <NUM> may be used to receive DL communication signals from the base unit <NUM>, as described herein. Although only one transmitter <NUM> and one receiver <NUM> are illustrated, the user equipment apparatus <NUM> may have any suitable number of transmitters <NUM> and receivers <NUM>. Further, the transmitter(s) <NUM> and the receiver(s) <NUM> may be any suitable type of transmitters and receivers. In one embodiment, the transceiver <NUM> includes a first transmitter/receiver pair used to communicate with a mobile communication network over licensed radio spectrum and a second transmitter/receiver pair used to communicate with a mobile communication network over unlicensed radio spectrum.

In various embodiments, one or more transmitters <NUM> and/or one or more receivers <NUM> may be implemented and/or integrated into a single hardware component, such as a multi-transceiver chip, a system-on-a-chip, an ASIC, or other type of hardware component. In certain embodiments, one or more transmitters <NUM> and/or one or more receivers <NUM> may be implemented and/or integrated into a multi-chip module. In some embodiments, other components such as the network interface <NUM> or other hardware components/circuits may be integrated with any number of transmitters <NUM> and/or receivers <NUM> into a single chip. In such embodiment, the transmitters <NUM> and receivers <NUM> may be logically configured as a transceiver <NUM> that uses one more common control signals or as modular transmitters <NUM> and receivers <NUM> implemented in the same hardware chip or in a multi-chip module.

<FIG> depicts a network apparatus <NUM> that may be used for modifying a first data connection during the establishment of a second data connection, according to embodiments of the disclosure. In one embodiment, network apparatus <NUM> may be one implementation of a RAN node, such as the base unit <NUM>, the RAN node <NUM>, or gNB, described above. Furthermore, the base network apparatus <NUM> may include a processor <NUM>, a memory <NUM>, an input device <NUM>, an output device <NUM>, and a transceiver <NUM>.

In some embodiments, the input device <NUM> and the output device <NUM> are combined into a single device, such as a touchscreen. In certain embodiments, the network apparatus <NUM> may not include any input device <NUM> and/or output device <NUM>. In various embodiments, the network apparatus <NUM> may include one or more of: the processor <NUM>, the memory <NUM>, and the transceiver <NUM>, and may not include the input device <NUM> and/or the output device <NUM>.

As depicted, the transceiver <NUM> includes at least one transmitter <NUM> and at least one receiver <NUM>. Here, the transceiver <NUM> communicates with one or more remote units <NUM>. Additionally, the transceiver <NUM> may support at least one network interface <NUM> and/or application interface <NUM>. The application interface(s) <NUM> may support one or more APIs. The network interface(s) <NUM> may support 3GPP reference points, such as Uu, N1, N2 and N3. Other network interfaces <NUM> may be supported, as understood by one of ordinary skill in the art.

For example, the processor <NUM> may be a microcontroller, a microprocessor, a CPU, a GPU, an auxiliary processing unit, a FPGA, or similar programmable controller.

In various embodiments, the network apparatus <NUM> is a RAN node (e.g., gNB) that sends UE configurations and receives measurement reports, as described herein. In such embodiments, the processor <NUM> controls the network apparatus <NUM> to perform the above described behaviors. When operating as a RAN node, the processor <NUM> may include an application processor (also known as "main processor") which manages application-domain and operating system ("OS") functions and a baseband processor (also known as "baseband radio processor") which manages radio functions.

In various embodiments, the network apparatus <NUM> is a gateway function and/or interworking function, such as the N3IWF <NUM> and/or N3IWF <NUM>, described above. In such embodiments, the processor <NUM> may control the network interface <NUM> to send and receive messages between the UE and core NFs in the second mobile communication network <NUM> (i.e., via a PDU session or other data connection with the first mobile communication network <NUM>). Additionally, the processor <NUM> may process PDU session establishment messages exchanged between the UE and core NFs in the second mobile communication network <NUM> and determine a number of IPsec Child SAs to establish for the PDU session established with the second mobile communication network <NUM>, as described above.

In some embodiments, the memory <NUM> stores data related to modifying a first data connection during the establishment of a second data connection. For example, the memory <NUM> may store parameters, configurations, resource assignments, policies, and the like, as described above. In certain embodiments, the memory <NUM> also stores program code and related data, such as an operating system or other controller algorithms operating on the apparatus <NUM>.

As another, non-limiting, example, the output device <NUM> may include a wearable display separate from, but communicatively coupled to, the rest of the network apparatus <NUM>, such as a smart watch, smart glasses, a heads-up display, or the like.

The transceiver <NUM> includes at least transmitter <NUM> and at least one receiver <NUM>. One or more transmitters <NUM> may be used to communicate with the UE, as described herein. Similarly, one or more receivers <NUM> may be used to communicate with network functions in the NPN, PLMN and/or RAN, as described herein. Although only one transmitter <NUM> and one receiver <NUM> are illustrated, the network apparatus <NUM> may have any suitable number of transmitters <NUM> and receivers <NUM>. Further, the transmitter(s) <NUM> and the receiver(s) <NUM> may be any suitable type of transmitters and receivers.

<FIG> depicts one embodiment of a method <NUM> for modifying a first data connection during the establishment of a second data connection, according to embodiments of the disclosure. In various embodiments, the method <NUM> is performed by a user equipment device in a mobile communication network, such as the remote unit <NUM>, the UE <NUM>, and/or the user equipment apparatus <NUM>, described above. In some embodiments, the method <NUM> is performed by a processor, such as a microcontroller, a microprocessor, a CPU, a GPU, an auxiliary processing unit, a FPGA, or the like.

The method <NUM> begins and receives <NUM> a first request (i.e., an IKE Create Child SA request) via a first data connection (i.e., via PDU Session-<NUM>) with a first mobile communication network (i.e., mobile core network <NUM>, NPN <NUM> and/or first network <NUM>), the first data connection supporting a plurality of QoS flows. Here, the first request containing a first set of parameters (i.e., SPI, Additional QoS information) for establishing a second data connection (i.e., an IPsec child SA) with an interworking function (i.e., the N3IWF <NUM> and/or N3IWF <NUM>) in a second mobile communication network (i.e., mobile core network <NUM>, PLMN <NUM> and/or second network <NUM>), where data traffic of the second data connection is to be transferred through the first data connection (i.e., the IPsec child SA is transported inside the PDU Session-<NUM>).

The method <NUM> includes sending <NUM> a second request (i.e., PDU Session Modification Request) to modify the first data connection in response to receiving the first request. Here, the second request containing a second set of parameters (i.e., Request QoS Rules, Requested QoS flow descriptions) derived from the first set of parameters (i.e., SPI, Additional QoS information), where the second set of parameters modify the first data connection for supporting the data traffic of the second data connection. The method <NUM> includes transmitting <NUM> the data traffic of the second data connection through the modified first data connection. The method <NUM> ends.

Disclosed herein is a first apparatus for modifying a first data connection during the establishment of a second data connection, according to embodiments of the disclosure. The first apparatus may be implemented by a user equipment device in a mobile communication network, such as the remote unit <NUM>, the UE <NUM>, and/or the user equipment apparatus <NUM>, described above. The first apparatus includes a processor and a transceiver that supports a first data connection (e.g., a first PDU Session) with a first mobile communication network over a first access network, the first data connection supporting a plurality of quality of service ("QoS") flows. The processor receives a first request (e.g., IKE Create Child SA request) via the first data connection, the first request containing a first set of parameters (e.g., SPI, Additional QoS information) for establishing a second data connection (e.g., IPsec child SA) with an interworking function (e.g., N3IWF) in a second mobile communication network. Here, data traffic of the second data connection is to be transferred through the first data connection (e.g., IPsec child SA is transported inside the first PDU Session). Via the transceiver, the processor sends a second request (e.g., PDU Session Modification Request) to modify the first data connection in response to receiving the first request, the second request containing a second set of parameters (e.g., Requested QoS Rules, Requested QoS flow descriptions) derived from the first set of parameters (e.g., SPI, Additional QoS information), wherein the second set of parameters modify the first data connection for supporting the data traffic of the second data connection and transmits the data traffic of the second data connection through the modified first data connection.

In some embodiments, the second set of parameters indicate to establish a new QoS flow over the first data connection. Here, the new QoS flow is to carry the data traffic of the second data connection. In such embodiments, the second set of parameters indicate to establish a new QoS flow over the first data connection in response to determining that none of the existing QoS flows over the first data connection is suitable to carry the data traffic of the second data connection. In certain embodiments, the second set of parameters includes packet filters (e.g., IP address of N3IWF and SPI) identifying the data traffic of the second data connection.

In some embodiments, the second data connection includes an Internet Protocol Security ("IPsec") child security association ("SA"), wherein first set of parameters includes a security parameter index ("SPI") and additional QoS information for the IPsec child SA. In certain embodiments, the second set of parameters includes requested QoS rules and requested QoS flow descriptions for modifying the first data connection to support the data traffic of the IPsec child SA. In some embodiments, the first mobile communication network includes a non-public network ("NPN"), and the second mobile communication network includes a public land mobile network ("PLMN"). In other embodiments, the first mobile communication network includes a PLMN, and the second mobile communication network includes an NPN.

In some embodiments, the first request is an Internet Key Exchange ("IKE") Create Child SA request received from a non-3GPP interworking function ("N3IWF"). In such embodiments, the processor further sends an IKE Create Child SA response message to N3IWF in response to successfully modifying the first data connection and prior to transmitting the data traffic of the second data connection through the modified first data connection. In some embodiments, the first request (e.g., IKE Create Child SA request) is received in response to transmitting a PDU session establishment request via the first data connection, requesting the establishment of a PDU session in the second mobile communication network via the interworking function in the second mobile communication network.

In some further embodiments, the processor receives a third request (e.g., a second IKE Create Child SA request) via the first data connection, the third request containing a third set of parameters (e.g., SPI-<NUM>, Additional QoS information-<NUM>) for establishing a third data connection (e.g., IPsec Child SA-<NUM>) with the interworking function. Here, data traffic of the third data connection is to be transferred through the first data connection (e.g., IPsec child SA-<NUM> is also transported inside PDU session-<NUM>), where the second data connection and the third data connection form a PDU session with the second mobile communication network. In such embodiments, the processor sends a fourth request (e.g., PDU Session Modification Request) to establish a new QoS flow over the first data connection in response to receiving the third request and transmits the data traffic of the third data connection through the new QoS flow of the first data connection, where the fourth request contains a fourth set of parameters (e.g., Request QoS Rules, Requested QoS flow descriptions) derived from the third set of parameters.

In some further embodiments, the processor receives a third request (e.g., IKE Create Child SA request) via the first data connection, the third request containing a third set of parameters for establishing a third data connection (e.g., IPsec Child SA-<NUM>) with the interworking function. Here, data traffic of the third data connection is to be transferred through the first data connection (e.g., IPsec child SA-<NUM> is also transported inside PDU session <NUM>), wherein the second data connection and third data connection form a PDU session with the second mobile communication network. In such embodiments, the processor sends a fourth request (e.g., PDU Session Modification Request) to indicate an existing QoS flow of the first data connection that is to carry the data traffic of the third data connection, in response to receiving the third request and transmits the data traffic of the third data connection through the indicated existing QoS flow of the first data connection, where the fourth request contains a fourth set of parameters (e.g., Request QoS Rules, Requested QoS flow descriptions) derived from the third set of parameters.

Disclosed herein is a first method for modifying a first data connection during the establishment of a second data connection, according to embodiments of the disclosure. The first method may be performed by a user equipment device in a mobile communication network, such as the remote unit <NUM>, the UE <NUM>, and/or the user equipment apparatus <NUM>. The first method includes receiving a first request (e.g., an IKE Create Child SA request) via a first data connection (e.g., via PDU Session-<NUM>) with a first mobile communication network over a first access network, the first data connection supporting a plurality of QoS flows. Here, the first request containing a first set of parameters (e.g., SPI, Additional QoS information) for establishing a second data connection (e.g., an IPsec child SA) with an interworking function (e.g., the N3IWF <NUM>) in a second mobile communication network, where data traffic of the second data connection is to be transferred through the first data connection (e.g., the IPsec child SA is transported inside the PDU Session-<NUM>). The first method includes sending a second request (e.g., PDU Session Modification Request) to modify the first data connection in response to receiving the first request. Here, the second request containing a second set of parameters (e.g., Request QoS Rules, Requested QoS flow descriptions) derived from the first set of parameters (e.g., SPI, Additional QoS information), where the second set of parameters modify the first data connection for supporting the data traffic of the second data connection. The first method includes transmitting the data traffic of the second data connection through the modified first data connection.

In some embodiments, the second set of parameters indicate to establish a new QoS flow over the first data connection, where the new QoS flow is to carry the data traffic of the second data connection. In such embodiments, the second set of parameters indicate to establish a new QoS flow over the first data connection in response to determining that none of the existing QoS flows over the first data connection is suitable to carry the data traffic of the second data connection. In certain embodiments, the second set of parameters includes packet filters (e.g., IP address of N3IWF and SPI) identifying the data traffic of the second data connection.

In some embodiments, the second set of parameters indicate an existing QoS flow of the first data connection, where the existing QoS flow is to carry the data traffic of the second data connection. In certain embodiments, the second set of parameters includes packet filters (e.g., IP address of N3IWF and SPI) identifying the data traffic of the second data connection.

In some embodiments, the second data connection includes an IPsec child SA, wherein first set of parameters includes a SPI and additional QoS information for the IPsec child SA. In certain embodiments, the second set of parameters includes requested QoS rules and requested QoS flow descriptions for the modifying the first data connection to support the data traffic of the IPsec child SA. In some embodiments, the first mobile communication network includes an NPN, and the second mobile communication network includes a PLMN. In other embodiments, the first mobile communication network includes a PLMN, and the second mobile communication network includes an NPN.

In some embodiments, the first request is an IKE Create Child SA request received from a N3IWF. In such embodiments, the first method may include sending an IKE Create Child SA response message to N3IWF in response to successfully modifying the first data connection and prior to transmitting the data traffic of the second data connection through the modified first data connection.

In some embodiments, the first request is received in response to transmitting a PDU session establishment request, via the first data connection, requesting the establishment of a PDU session in the second mobile communication network via the interworking function in the second mobile communication network.

In some embodiments, the first method further includes receiving a third request (e.g., a second IKE Create Child SA request) via the first data connection, the third request containing a third set of parameters (e.g., SPI-<NUM>, Additional QoS information-<NUM>) for establishing a third data connection (e.g., IPsec Child SA-<NUM>) with the interworking function. Here, data traffic of the third data connection is to be transferred through the first data connection (e.g., IPsec child SA-<NUM> is also transported inside PDU session <NUM>), where the second data connection and the third data connection form a PDU session with the second mobile communication network. In such embodiments, the first method further includes sending a fourth request (e.g., PDU Session Modification Request) to establish a new QoS flow over the first data connection in response to receiving the third request and transmitting the data traffic of the third data connection through the new QoS flow of the first data connection, where the fourth request contains a fourth set of parameters (e.g., Request QoS Rules, Requested QoS flow descriptions) derived from the third set of parameters.

In some embodiments, the first method further includes receiving a third request (e.g., IKE Create Child SA request) via the first data connection, the third request containing a third set of parameters (e.g., SPI-<NUM>, Additional QoS information-<NUM>) for establishing a third data connection (e.g., IPsec Child SA-<NUM>) with the interworking function. Here, data traffic of the third data connection is to be transferred through the first data connection (e.g., IPsec child SA-<NUM> is also transported inside PDU session <NUM>), where the second data connection and third data connection form a PDU session with the second mobile communication network. In such embodiments, the first method further includes sending a fourth request (e.g., PDU Session Modification Request) to indicate an existing QoS flow of the first data connection that is to carry the data traffic of the third data connection, in response to receiving the third request and transmitting the data traffic of the third data connection through the indicated existing QoS flow of the first data connection, where the fourth request contains a fourth set of parameters (e.g., Request QoS Rules, Requested QoS flow descriptions) derived from the third set of parameters.

Claim 1:
A User Equipment, UE, (<NUM>, <NUM>) for wireless communication, the UE (<NUM>, <NUM>) comprising at least one memory (<NUM>) and at least one processor (<NUM>) coupled with the at least one memory (<NUM>) and configured to cause the UE (<NUM>, <NUM>) to:
in response to receiving a first request via a first data connection (<NUM>, <NUM>) with a first mobile communication network (<NUM>, <NUM>), the first data connection (<NUM>, <NUM>) supporting a plurality of quality of service, QoS, flows, the first request containing a first set of parameters for establishing a second data connection (<NUM>) with an interworking function (<NUM>) in a second mobile communication network (<NUM>, <NUM>), wherein the first request is received from the interworking function, and
wherein data traffic of the second data connection (<NUM>) is to be transferred through the first data connection (<NUM>, <NUM>), and in response to determining that none of the existing QoS flows of the first data connection (<NUM>, <NUM>) is suitable to fulfill the QoS requirements of the second data connection (<NUM>):
initiate a modification procedure with the first mobile communication network (<NUM>, <NUM>) by sending a second request to modify the first data connection (<NUM>, <NUM>), the second request containing a second set of parameters derived from the first set of parameters, wherein the second set of parameters indicate to establish a new QoS flow over the first data connection (<NUM>, <NUM>), wherein the new QoS flow is to carry the data traffic of the second data connection (<NUM>), and the second set of parameters modify the first data connection (<NUM>, <NUM>) for supporting the data traffic of the second data connection (<NUM>); and
transmit the data traffic of the second data connection (<NUM>) through the modified first data connection (<NUM>, <NUM>).