Patent Description:
Furthermore, the present invention relates to a user equipment for being operated with a telecommunications network, wherein the user equipment is configured to request, while being connected to the telecommunications network, to be connected to or to access a further network, the further network being a virtual network as part of a cloud provider infrastructure and the further network being accessible, from within the cloud provider infrastructure, using a target network identifier information.

Additionally, the present invention relates to a telecommunications network for using a user equipment with the telecommunications network, wherein the user equipment requests, while being connected to the telecommunications network, to be connected to or to access a further network, wherein the telecommunications network comprises a control plane function and a user plane function, wherein the further network is a virtual network as part of a cloud provider infrastructure, and the further network being accessible, from within the cloud provider infrastructure, using a target network identifier information.

Furthermore, the present invention relates to a program and to a computer-readable medium for using a user equipment with the telecommunications network according to the inventive method.

In conventionally known telecommunications networks, in case that a user equipment - especially an application thereof or running on the user equipment - needs to have connectivity to a specific networking resource or resource provider, such connectivity typically requires the establishment or the provisioning of a data network, associated with a data network name (DNN), by the telecommunications network or within the respective core network of or assigned to the telecommunications network. As a consequence thereof, in conventionally known telecommunications networks, as a prerequisite of the user equipment (or an application thereof) having or getting connectivity to such a specific networking resource or resource provider, the respective (or considered) user equipment (or the application thereof) needs to request connectivity to a data network (or to a data network name, DNN) or to a combination of a data network (name) (DNN) and a network slice (S-NSSAI, single - network slice selection assistance information).

However, such a need (for the user equipment or the application thereof) to necessarily request connectivity to a data network name and/or a network slice typically renders the establishment of the connection or the connectivity to the specific networking resource or resource provider more cumbersome and/or more complicated than necessary.

<CIT> shows methods, apparatuses and systems directed to support provisioning domains, PvDs, in <NUM> networks. In particular, a network entity running a policy control function, PCF, may send to a wireless receive and transmit unit, WTRU, at least one WTRU route selection policy, URSP, rule associated with, for example, PvD descriptors. For example, URSP rules may be configured e.g., as part of the subscription profile and PvD descriptors may be configured e.g., as part of a network-wide configuration. An application function, AF, may use a network exposure function, NEF, application programming interface, API, to access and, for example, update, e.g. through any of NEF and PCF, any of URSP rules and PvD descriptors. Furthermore, a WTRU may participate in a data network access identifier, DNAI, selection by including a PvD ID in, for example, PDU session establishment messages.

An object of the present invention is to provide a technically simple, effective and cost effective solution for using a user equipment with a telecommunications network, wherein the user equipment requests, while being connected to the telecommunications network, to be connected to or to access a further network, the further network being accessible from within the cloud provider infrastructure and using a target network identifier information. A further object of the present invention is to provide a corresponding user equipment, a telecommunications network, and a corresponding program and computer-readable medium.

According to a first aspect, the present invention provides a method for using a user equipment with a telecommunications network, wherein the user equipment requests, while being connected to the telecommunications network, to be connected to or to access a further network, wherein the telecommunications network comprises a control plane function and a user plane function, wherein the further network is a virtual network as part of a cloud provider infrastructure,.

According to the present invention, it is advantageously possible that, in a telecommunications network (typically, but not necessarily, a mobile communication network), a user equipment is enabled to request connectivity to a specific networking resource or resource provider (i.e. to a further network that is accessible from within a cloud provider infrastructure) using a target network identifier information as opposed to the paradigm, in conventionally known telecommunications networks, of necessarily requesting connectivity to a combination of data network name (DNN) and/or a network slice.

In currently known telecommunications networks, in order for a user equipment to realize connectivity to a network within a cloud provider, this can only be done by means of a VPN - virtual private network. While the network operator (of the telecommunications network to which the user equipment is connected) can provide connectivity to a data network (DN), anything beyond that needs to happen over the top (OTT), i.e. typically the user equipment needs previous knowledge of certain parameters in order to achieve connectivity to the intended network. Such requirements of previous knowledge by (or at) the user equipment conflicts with an impulse to rather simplify the user equipments, as well as to allow user equipments to natively access third-party networks and allow the operator to abstract underlying network complexity.

In currently known telecommunications networks - typically being based on a separation between the user equipment, the (radio) access network and the core network -, in order to provide a user equipment with connectivity towards a data network (DN) - e.g., the internet -, the user equipment communicates with the access network (especially the radio access network in a mobile communication network, via a radio interface) and with the core network, and the data network provides connectivity towards applications (e.g. a backend for an application running on the user equipment) by means of a packet data unit session (PDU session) being established between the user equipment and the data network. In this sense, a conventionally known telecommunications network, e.g. a <NUM> system, provides a "pipe" (i.e. the packet data unit session) realizing connectivity to a given data network. Said connectivity is then typically exposed to application(s) in the user equipment by the operating system via a network interface, with the user equipment being addressable within the data network via, e.g., an IP address, e.g. IP address <NUM>. <NUM> assigned to the user equipment on PDU Session <NUM> and another IP address <NUM>. <NUM> assigned to the user equipment via (or on) PDU Session <NUM>.

Within the context of cloudification and the use of public/hybrid clouds, it is common to use virtual networks, i.e. further networks, being separated from the telecommunications network to which the user equipment is connected to. While different names may be used by different cloud providers (e.g. Virtual Network, "Vnet"; Virtual Private Cloud, "VPC"), a virtual network within a cloud is a virtual version of a physical network, implemented inside of a cloud provider's production network (i.e. inside a cloud provider infrastructure); typically, a virtual network can subsequently be further segmented in several subnetworks. A virtual network provides network connectivity and address allocation to elements (e.g. cloud resources such as virtual machines) within the virtual network.

According to the present invention, it is advantageously possible for a user equipment to easily realize connectivity to a cloud-based network (further network) which connectivity establishment requires previous knowledge of certain parameters so that the user equipment can achieve this connectivity to the intended network: The proposed method advantageously reduces the complexity of realizing such a connectivity for the considered user equipment: The user equipment only needs to know the further network (i.e. the respective target network identifier information thereof) it wants to connect to, indicate it to the network, and the rest is taken care of by the telecommunications network. Especially according to the present invention, the user equipment (or the application triggering the user equipment) triggers a communication session establishment (especially a packet data unit session establishment) targeting the further network that is not directly accessible (via the telecommunications network the user equipment is attached to). The user equipment is only required to know what the target network identifier information, i.e. the virtual network, (where connectivity is required to) is - not how to achieve it. According to the present invention, this is achieved by the user equipment including a virtual network identifier, i.e. the target network identifier information, in the communication session establishment request, typically a PDU session establishment request. Based on the subscriber data (e.g. whether the user equipment is allowed to get said connectivity, what quality-of-service level is to apply or is the user equipment allowed to, via what network slice should the connectivity be realized), the telecommunications network (to which the user equipment is connected to) either associates the communication session (or PDU session) to an existing data network name (DNN) and/or network slice (S-NSSAI) via which this information can be routed towards the further network within the cloud provider infrastructure, or the telecommunications network provisions connectivity to the respective further network. The user equipment then gets a communication session accept message (typically a PDU Session establishment accept message) and can transmit and/or receive data as normally done via communication sessions (or PDU Sessions) with the exception that in this case the connectivity (request of the user equipment initially) is typically not (or not necessarily) towards a DNN or combination of DNN/S-NSSAI but rather towards the further network being a virtual network.

According to the present invention, it is assumed that the user equipment is used with the telecommunications network, i.e. it is connected to the user equipment, and, while being connected to the telecommunications network, the user equipment requests to be connected to or to access the further network being a virtual network as part of a cloud provider infrastructure. The telecommunications network comprises a control plane function and a user plane function, and the further network is accessible from within (especially only from within, i.e. not from outside of) the cloud provider infrastructure, using a target network identifier information of the further network. It is furthermore assumed that, in order for the user equipment to use or to get access to the further network, a data network and associated data network name is required to be provisioned or established at the telecommunications network or between the telecommunications network and the cloud provider infrastructure. That is, the cloud provider infrastructure is reached from the telecommunications network via a data network. In the context of the present invention, the terms data network and data network name are used rather synonymously, especially the data network relating to an identifier information to indicate, or reference, - especially for the purposes of the telecommunications network or of its core network - the associated data network. In order for the user equipment to be actually connected to or to access the further network, the user equipment requests (in a first step of the inventive method) a communication session to be established to or towards the further network, using the target network identifier information as part of a request message being transmitted, by the user equipment, to the control plane function of the telecommunications network; the communication session is associated (in a second step of the inventive method) to the data network name in order to provide connectivity towards the further network via the cloud provider infrastructure using the data network name; furthermore the user equipment receives (in a third step of the inventive method) a communication session establishment accept message, transmitted by the control plane function of the telecommunications network; and, the user equipment uses (in a fourth step of the inventive method) the established communication session to access the further network via the user plane function of the telecommunications network. Especially, the communication session establishment request of the user equipment (in a first step of the inventive method) does not necessarily comprise a reference, or an indication, to a data network name (instance) to be used. Furthermore, when the user equipment requests the communication session to be established to or towards the further network, the data network name may not have been yet provisioned or established.

According to the present invention, it is furthermore advantageously possible and preferred that the further network is accessible, using the target network identifier information, only from within the cloud provider infrastructure,
wherein especially the further network is not directly accessible from the outside of the cloud provider infrastructure.

It is thereby advantageously possible to realize and implement the inventive method in a comparatively simple and efficient manner: Even though the further network is not (directly) accessible from the telecommunications network (only by means of using the target network identifier information), it is nevertheless advantageously possible, according to the present invention, that the user equipment is able to get connectivity to the further network.

According to the present invention, it is furthermore advantageously possible and preferred that the communication session is or corresponds to a protocol data unit, PDU, session, and/or wherein the control plane function is or corresponds to the session management function or a session management function instance.

It is thereby advantageously possible to realize and implement the inventive method in a comparatively simple and efficient manner.

Furthermore, it is advantageously possible and preferred according to the present invention that - after provisioning or establishing the data network name - the data network name and the further network as well as its target network identifier information are assigned to each other, wherein especially such assigning is stored in a repository entity or functionality of the telecommunications network, wherein especially such assigning is performed.

It is thereby advantageously possible to efficiently realize and implement the inventive method in a comparatively simple and flexible manner as the assignment of the data network name and the further network as well as its target network identifier information is possible to be performed at different points in time.

Furthermore, it is advantageously possible and preferred according to the present invention that the data network name and the further network and its target network identifier information are assigned to each other, wherein such assigning as well as the provisioning or establishing of the data network name is performed subsequent to the first step, especially subsequent to the third step. Furthermore, it is advantageously possible and preferred according to the present invention that the data network name associated to the further network provides a different, especially higher, quality of service compared to connectivity via the Internet, such that connectivity towards the further network can be achieved with higher reliability and/or quality compared to over-the-top methods. Furthermore, it is advantageously possible and preferred according to the present invention that for a given further network, when different user equipments request a communication session to be established to or towards the further network, different data networks providing connectivity towards the further network can be employed for different user equipments, especially where the choice of data network and/or associated quality is based on subscriber or policy information related to one or more user equipments. It is additionally advantageously possible and preferred according to the present invention that if the data network name is not in use or required anymore, e.g. when all user equipments requiring connectivity to the further network deregistered from the network, that the data network instance is un-provisioned, such that resource usage and/or costs, especially the instantiated resources, reserved capacity and/or connectivity required on the side of the cloud provider infrastructure, can be optimized.

Furthermore, it is advantageously possible and preferred according to the present invention that the cloud provider infrastructure comprises a cloud controller entity or functionality and/or a cloud ingress router entity or functionality, wherein provisioning or establishing the data network name and/or assigning or associating the data network name, the further network and its target network identifier information involves contacting, by the telecommunications network, the cloud controller entity or functionality and/or the cloud ingress router entity or functionality, and wherein the cloud ingress router entity is accessible from the telecommunications network via the data network name and forwards data packets between the further network and the telecommunications network.

Furthermore, it is advantageously possible and preferred according to the present invention that the target network identifier information is or corresponds to or comprises a universally unique identifier, UUID, information of the further network, wherein especially the target network identifier information comprises an infrastructure identifier information relating to the cloud provider infrastructure, or identifying the cloud provider infrastructure.

According to a second aspect, the present invention provides a user equipment for being operated with a telecommunications network, wherein the user equipment is configured to request, while being connected to the telecommunications network, to be connected to or to access a further network, the further network being a virtual network as part of a cloud provider infrastructure and the further network being accessible, from within the cloud provider infrastructure, using a target network identifier information,.

According to a third aspect, the present invention provides a telecommunications network for using a user equipment with the telecommunications network, wherein the user equipment requests, while being connected to the telecommunications network, to be connected to or to access a further network, wherein the telecommunications network comprises a control plane function and a user plane function, wherein the further network is a virtual network as part of a cloud provider infrastructure,.

According to a fourth aspect, the present invention provides a program comprising a computer readable program code which, when executed on a computer and/or on a user equipment and/or on a network node of a telecommunications network, especially a control plane function, or in part on the user equipment and/or in part on the network node of a telecommunications network, especially the control plane function, causes the computer and/or the user equipment and/or the network node of the telecommunications network to perform the inventive method.

According to a fifth aspect, the present invention provides a computer-readable medium comprising instructions which when executed on a computer and/or on a user equipment and/or on a network node of a telecommunications network, especially a control plane function, or in part on the user equipment and/or in part on the network node of a telecommunications network, especially the control plane function, causes the computer and/or the user equipment and/or the network node of the telecommunications network to perform the inventive method.

The present invention will be described with respect to particular embodiments and with reference to certain drawings, but the invention is not limited thereto but only by the claims. The drawings described are only schematic and are nonlimiting.

In <FIG>, a telecommunications network <NUM> comprising an access network <NUM>, and a core network <NUM> is schematically shown. The telecommunications network <NUM>, especially the core network <NUM>, typically comprises a number of network functions or services. The access network <NUM> comprises a plurality of radio cells <NUM>, <NUM>. In the exemplary situation or scenario shown in <FIG>, a first base station entity <NUM> generates or is associated with or spans the first radio cell <NUM>, and a second base station entity <NUM> generates or is associated with or spans the second radio cell <NUM>. In the exemplary situation shown in <FIG>, the user equipment <NUM> is connected to the telecommunications network <NUM> via a radio interface to the first base station entity <NUM>. The user equipment <NUM> is typically, but not necessarily, mobile i.e. able to move with respect to the (typically, but not necessarily, static) radio cells <NUM>, <NUM> or corresponding base station entities <NUM>, <NUM> of the access network <NUM>. According to the present invention, the user equipment <NUM> typically comprises an application <NUM> (schematically depicted, in <FIG>, as part of the user equipment <NUM>) typically running on the user equipment <NUM>, i.e. the user equipment <NUM> typically runs or executes an operating system (such as a mobile (devices) operating system, e.g., android, iOS, iPadOS, etc.), and the application <NUM> is running on the operating system; alternatively, the application <NUM> might also be a lower level application not running on or as part of the operating system but as part of, e.g., the subscriber identity module of the user equipment <NUM>. According to the present invention, the telecommunications network <NUM> is connected to a cloud provider infrastructure <NUM> comprising a further network <NUM> being a virtual network as part of the cloud provider infrastructure <NUM>. Furthermore, the cloud provider infrastructure <NUM> is represented, in <FIG>, as also comprising a cloud controller entity or functionality <NUM> and a cloud ingress router entity or functionality <NUM>.

In <FIG>, an example of a data network connectivity of the user equipment <NUM> (or of its application <NUM>) is schematically shown, wherein the user equipment <NUM> (the application <NUM>) uses the telecommunications network <NUM> - i.e. the access network and the core network, especially realized as a <NUM> system - to be provided, e.g., with services <NUM>, <NUM>, the data network connectivity of the user equipment <NUM> (the application <NUM>) being realized towards a plurality of data networks or data network names <NUM>, <NUM> using communication sessions, <NUM>, <NUM>, especially packet data unit sessions <NUM>, <NUM>. Such a data network connectivity of user equipments is already possible to be realized in currently known telecommunications networks; e.g. the connectivity to the data networks <NUM>, <NUM> is exposed to the user equipment <NUM> and/or its application <NUM> as network interfaces, for example with the user equipment <NUM> being addressable, within the data networks <NUM>, <NUM>, via, e.g., an IP address, respectively (e.g. IP address <NUM>. <NUM> assigned to the user equipment <NUM> (or application <NUM>) on the first packet data unit session <NUM> and usable by the first data network <NUM>, and another IP address <NUM>. <NUM> assigned to the user equipment <NUM> (or application <NUM>) on the second packet data unit session <NUM> and usable by the second data network <NUM>). Likewise, the connectivity to the user equipment <NUM> (or to the application <NUM>) is also exposed, to the first and/or second data networks <NUM>, <NUM> by means of network addresses, e.g. IP addresses. Hence, a first service <NUM> is able to be provided, to the user equipment <NUM> or the application <NUM> via (or using) the first data network <NUM> and the first packet data unit session <NUM>, and a second service <NUM> is able to be provided, to the user equipment <NUM> or the application <NUM> via (or using) the second data network <NUM> and the second packet data unit session <NUM>.

According to the present invention, the telecommunications network <NUM> is organized or structured - in accordance to current or conventionally known mobile networks - based on a separation between the user equipment <NUM>, the (radio) access network <NUM> and the core network, which applies, e.g., to <NUM> systems (5GS), i.e. telecommunications networks according to the <NUM> standard. The objective is to provide the user equipment <NUM> with connectivity towards a data network (DN), e.g., the Internet (e.g. such as the data networks <NUM>, <NUM> shown in <FIG>). In case of the telecommunications network <NUM> being a mobile communication network (or a cellular network), the user equipment <NUM> communicates with the radio access network <NUM> (or its base station entity <NUM>, especially a gNodeB) via a radio interface (Uu interface or reference point), which is used for conveying both signaling information and data traffic. The data network <NUM>, <NUM> provides connectivity towards services or backend applications <NUM>, <NUM> (e.g. a backend for an application <NUM> running on the user equipment <NUM>). Additionally, (network) slicing allows the telecommunications network <NUM> to be segmented into logical sections (i.e. "slices") which can be accessed by user equipments <NUM> and be used to offer differentiated services. Furthermore, both according to the present invention as in currently known networks, such systems typically separate a control plane from a user plane (i.e., signaling traffic and (user) data traffic are separated); the traffic between the user equipment <NUM> and the telecommunications network <NUM> is transmitted by means of the communication sessions <NUM>, <NUM>, especially packet data unit sessions <NUM>, <NUM>, which are anchored at a PDU session Anchor (PSA), especially the user plane function (UPF) in the case of the telecommunications network <NUM> being a <NUM> network (especially using the N3 interface or reference point between the gNB and the UPF). Similarly, an access and mobility management function (AMF) acts as a signaling anchor (so-called N1/N2 interface) for control plane traffic. In order for the user equipment <NUM> being able to have connectivity towards the services <NUM>, <NUM>, the data network <NUM>, <NUM> - or, a corresponding data network name - is required to be established as well as a corresponding communication session, especially a packet data unit session <NUM>, <NUM> needs to be established.

Especially in case of a conventionally known <NUM> system, such packet data unit session establishment procedure (according to 3GPP TS <NUM>, clause <NUM>. ) comprises, in a first part the following procedures: The procedure assumes that the user equipment has already registered on the AMF thus (unless the user equipment is emergency registered) the AMF has already retrieved the user subscription data from the unified data management (UDM); the user equipment transmits (to the access and mobility management function) a non-access stratum message comprising:.

Hence, in currently known telecommunications networks and as already mentioned, in order to provide a user equipment with connectivity towards a data network, the user equipment communicates with the access network and with the core network, and the data network provides connectivity towards services by means of a packet data unit session (PDU session), i.e. the telecommunications network, e.g. a <NUM> system, provides the packet data unit session as a 'pipe' realizing connectivity to a given data network. In case the further network (or the service connected by means of the packet data unit session) is part of a cloud provider infrastructure such resources within a virtual network, or the virtual network itself are typically not accessible by the user equipment and via the packet data unit session and the data network without prior or previous knowledge and/or prior configuration steps; this is explained in the following:
In a typical setup of a cloud-based virtual network, such a virtual network, e.g., comprises a plurality of virtual machines, a software as a service database and/or a Kubernetes cluster (k8s cluster). The associated or corresponding cloud provider infrastructure, e.g., comprises a load balancer having (or being related to) a public IP address (connected to the internet) by means of which IP address an internet user can access the load balancer (i.e. the cloud provider infrastructure) via its public IP address but the user could not access the virtual network itself. Furthermore, the cloud provider infrastructure, e.g., comprises a VPN gateway towards a corporate network (that also comprises a VPN gateway terminating the VPN tunnel on its other side); a corporate user is able to route traffic between the virtual network and the corporate network via the VPN tunnel. However, such connectivity to the virtual network is only possible as the VPN tunnel is (already) established; a virtual network or resources within a virtual network cannot be accessed directly from the "outside" (i.e. the internet) unless a given resource is allocated a public IP address (in this case the given resource can be addressed via the internet) or via the VPN tunnel (by means of which the virtual network can be connected to other networks at the other side of the VPN tunnel by means of routing mechanisms); furthermore, similar methods exist to connect different virtual networks within a cloud provider or cloud provider infrastructure.

Alternatively or cumulatively in terms of connectivity, it is also possible to implement connectivity towards a cloud or towards a virtual network via private connectivity: this is a preferred option when stringent performance requirements apply or when it is not desired that the traffic, even if in encrypted form, runs through the internet.

Hence, it is possible to connect to a virtual network via a VPN via the Internet, via dedicated connectivity and also using both methods simultaneously (e.g. for redundancy and/or cost-effective load balancing); an alternative in-between these two solutions would be reaching the cloud provider or virtual network not via the Internet but rather via a private peering point such that the VPN endpoints can be achieved more reliably as via the Internet.

In this respect, <FIG> schematically and exemplarily shows different connection possibilities or connectivity possibilities of (exemplary) different user equipments UE1, UE2, UE3, UE4 (being part of or connected to the telecommunications network <NUM>), and being potentially linked to (or provided connectivity towards) a first virtual network <NUM> or a second virtual network <NUM> of a cloud provider infrastructure <NUM> via either a VPN endpoint <NUM> of the cloud provider infrastructure <NUM> or a direct connection endpoint <NUM> of the cloud provider infrastructure <NUM>:
In currently known telecommunications networks, a user equipments UE1, UE2, UE3, UE4 (e.g. mobile devices but this is also applicable to a fixed-network device connecting via a 3GPP-based system) can request (and be provided with) connectivity via a PDU session establishment (request) to a given DNN <NUM>, <NUM>, <NUM> through a given slice (S-NSSAI/DNN pair). , UE1 might require connectivity to the first virtual network <NUM>; UE2 might require access to the second virtual network <NUM>; UE3 might require low latency and access to the second virtual network <NUM>; and UE4 might require low latency and access to the enterprise network (local network) of the enterprise, as well as the first virtual network <NUM>. In order to realize such a connectivity scenario, the network is able to be configured such that: the first data network name <NUM> is configured to provide access to the Internet; the second data network name <NUM> is configured to provide direct access to the second virtual network <NUM>; the third data network name <NUM> is configured to provide connectivity to the local network; A default (network) slice providing connectivity to the first and second data network name <NUM>, <NUM> is enabled for UE1 and UE2; additionally a prioritized (network) slice (e.g. reserved RAN resources), providing connectivity to the first, second and third data network name <NUM>, <NUM>, <NUM>, is enabled for UE3 and UE4; each one of the UEs is configured to request appropriate PDU session(s) for a Slice/DNN pair providing access to the correct data network name (i.e. corresponding to the above mentioned exemplary scenario). For the case of the first data network name <NUM>, the application (on the respective user equipment) will then have to additionally start a VPN client on top of the PDU Session with appropriate (reconfiguration so that the connection with the cloud provider's virtual network <NUM>, <NUM> can be established. Hence, such a connectivity scenario is possible to realize in a conventionally known telecommunications network, however keeping track of all those (potentially changing) configurations might be rather complex.

As already said, according to the present invention, it is advantageously possible that a user equipment is enabled to request connectivity to a specific networking resource or resource provider (i.e. to a further network that is accessible from within a cloud provider infrastructure) using a target network identifier information as opposed to the paradigm, in conventionally known telecommunications networks, of necessarily requesting connectivity to a combination of data network name (DNN) and/or a network slice.

Hence, also according to the present invention, the user equipment <NUM> is connected to the telecommunications network <NUM>, and, while being connected, requests to be connected to or to access the further network <NUM> - i.e. the virtual network being part of the cloud provider infrastructure <NUM> and being accessible, from within the cloud provider infrastructure <NUM>, using its target network identifier information <NUM>. Hereinafter, the further network <NUM> is also called virtual network <NUM>. Also according to the present invention, it is assumed that, in order for the user equipment <NUM> to use or to get access to the further network <NUM>, a data network and associated data network name is required to be provisioned or established at the telecommunications network <NUM> or between the telecommunications network <NUM> and the cloud provider infrastructure <NUM>, however, such data network name does not necessarily need to be instantiated (or exist) prior to or at the time of the connectivity request of the user equipment <NUM>. According to the present invention, the steps required for the user equipment <NUM> to be provided with connectivity towards the further network <NUM> comprise.

Hence, there is - according to the present invention - not necessarily a need for the user equipment <NUM> to transmit a data network (name) identifier or corresponding information as part of its request to establish the communication session via which the user equipment <NUM> can subsequently establish a communication with the cloud provider infrastructure <NUM>, neither for the user equipment <NUM> to store addressing information of control and/or user plane elements of the cloud provider infrastructure <NUM>. Thus, the complexity for providing the user equipment <NUM> with connectivity to the further network <NUM> or for providing access to the further network <NUM> is able to be reduced according to the present invention: the user equipment <NUM> only needs to know the network it wants to connect to (i.e. the target network identifier information), indicate it to the telecommunications network <NUM>, and the rest is taken care of. That is, there is no need for the user equipment <NUM> to be aware of any information related to an underlying data network (name), an underlying slice (identifier) and/or any other parameter such as quality of service that are used to provide connectivity between the telecommunications network <NUM> and the cloud provider infrastructure <NUM> so as to reach the further network <NUM>. Thus, the user equipment <NUM> (or the application <NUM> (running or being executed on the user equipment <NUM>) triggering the user equipment <NUM>) triggers a communication session establishment (especially a packet data unit session establishment) targeting the further network <NUM> that is not directly accessible (via the telecommunications network <NUM> the user equipment <NUM> is attached to); the user equipment <NUM> is only required to know the target network identifier information, i.e. the virtual network where connectivity is required to - not how to achieve such connectivity. According to the present invention, this is achieved by the user equipment <NUM> including a virtual network identifier, i.e. the target network identifier information <NUM>, in the communication session establishment request, typically a PDU session establishment request. Based on the subscriber and/or policy data relating to the user equipment <NUM> (e.g. whether the user equipment <NUM> is allowed to get said connectivity, what quality-of-service level is to be applied or is the user equipment <NUM> allowed to, via what network slice should the connectivity be realized), the telecommunications network <NUM> (to which the user equipment <NUM> is connected to) either associates the communication session (or PDU session) to an existing data network name (DNN) and/or network slice (S-NSSAI) via which this information can be routed, or the telecommunications network provisions connectivity to the respective further network. The user equipment <NUM> then gets a communication session accept message and can transmit and/or receive data as normally done via communication (PDU) sessions with the exception that in this case the connectivity is typically not (or not necessarily) requested towards a DNN/S-NSSAI but rather towards the further network <NUM> being a virtual network. According to first variants of the present invention, the connectivity (of the core network <NUM>, or parts thereof) to the virtual network <NUM> already exists (at the time of the connection request of the user equipment <NUM>), wherein according to second variants of the present invention, the connectivity to the virtual network <NUM> does not yet exists, i.e. needs to be established (at the time of the connection request of the user equipment <NUM>).

<FIG> relate to the first variants of the present invention. In <FIG>, the example of the user equipment <NUM> being connected (via the access network <NUM> and core network <NUM> of the telecommunications network <NUM>) to the virtual network <NUM> (as part of the cloud provider infrastructure <NUM>) is schematically shown where the connectivity (of the core network <NUM>, or parts thereof) to the virtual network <NUM> already exists: The user equipment <NUM> requests the communication session establishment by means of a request message comprising (especially instead of a DNN/S-NSSAI information) the target network identifier information <NUM> of the virtual network <NUM> in order to get connectivity to the further network <NUM>. Especially, the requested target network identifier information <NUM> of the virtual network <NUM> is (already) mapped, by the core network <NUM>, to a data network (name) (and/or to a S-NSSAI) that are configured to provide access to the specific requested (pre-configured) virtual network <NUM>; e.g. traffic from the user equipment <NUM> is directed to classless inter-domain routing (CIDR) <NUM>. <NUM>/<NUM>. The corresponding data network is e.g. connected via interface X, and the virtual network router interface via interface Y. Routing tables are typically configured, e.g. via border gateway protocol (BGP), to route traffic to <NUM>. <NUM>/<NUM> via interface Y. On the side of the cloud provider infrastructure <NUM>, incoming traffic (at interface Y) is routed based on configured routing tables (incoming interface, destination CIDR) to a virtual network within the cloud provider infrastructure <NUM> (other virtual networks might use the same (or overlapping) CIDR(s) but such virtual network would use other interfaces. Hence, in case that the connectivity of the telecommunications network <NUM> to the virtual network <NUM> already exists, when receiving (from the user equipment <NUM>) a request including a virtual network identifier (or target network identifier information <NUM>), the core network <NUM> maps the target user plane connectivity to a given existing connectivity, that is, a data network (name). That is, using the virtual network identifier (target network identifier information <NUM>) (as part of the connectivity request transmitted by the user equipment <NUM>) also results - just as the user equipment <NUM> (and any other user equipment requiring connectivity to the further network <NUM>) having been configured to map a connectivity request towards the further network <NUM> to a request to a given DNN or DNN/S-NSSAI pair - in the user equipment <NUM> being connected (or getting connectivity) to the further network <NUM> without the specific mapping needing to be configured and maintained on a user equipment <NUM> requiring connectivity to the further network <NUM>. Whether a specific user plane function (UPF) / session management function (SMF) is used (e.g. reserved for a given slice ID, S-NSSAI) can also be taken care of by the core network <NUM>, i.e. the user equipment <NUM> can be assigned a higher-QoS network function based on a mapping configured in the core network <NUM> and/or based on subscription information related to the user equipment <NUM> or credentials user by the user equipment <NUM>. In the example of <FIG>, the virtual network <NUM> (or further network <NUM>) uses a CIDR of <NUM>. <NUM>/<NUM>, which is routable by the router on the core network <NUM> and cloud provider side towards the configured virtual network <NUM>. While other virtual networks (as part of the cloud provider infrastructure <NUM>) may (and most probably do) use exactly the same CIDR, the combination of input interface (i.e. interfaces X and/or Y) and CIDR is unique, hence the traffic can be routed by a specific link (e.g. realized via a VLAN) between the telecommunications network <NUM> on the one hand, and the cloud provider infrastructure <NUM> on the other hand. Similar means are used by the cloud provider (i.e. the cloud provider infrastructure <NUM>) to route traffic towards the correct virtual network <NUM>.

In <FIG>, a communication diagram, especially regarding the flow of user plane data, between the user equipment <NUM>, a control plane function <NUM> of the telecommunications network <NUM> (or of its core network <NUM>), a user plane function <NUM> of the telecommunications network <NUM> (or of its core network <NUM>), and the cloud provider infrastructure <NUM> is schematically shown in case that the connectivity to the virtual network <NUM> already exists. the connectivity of the core network <NUM>, or of parts thereof, to the virtual network <NUM> already exists due to a pre-configured routed connection where traffic from a given router interface can be directly routed to an IP range within the virtual network <NUM> - then the core network <NUM> does not need to establish a new connectivity towards the virtual network <NUM>.

In a first processing step <NUM>, the user equipment requests a PDU Session to the further network <NUM> (or the virtual network <NUM>). In a second processing step <NUM>, a PDU session establishment accept message is transmitted to the user equipment <NUM>, especially comprising security parameters. In a third processing step <NUM>, a data packet is sent via user plane towards the endpoint in the virtual network <NUM> which means that such a data packet is transported, within the telecommunications network <NUM>, to the user plane function <NUM>. In a fourth processing step <NUM>, the user plane function <NUM> forwards the data packet to the cloud ingress router entity or functionality <NUM> of the cloud provider infrastructure <NUM>. In a fifth processing step <NUM>, the data packet is sent via user plane to the cloud ingress router entity or functionality <NUM>, and in a sixth processing step <NUM>, the data packet is sent to the virtual network <NUM>.

In <FIG>, a communication diagram, especially regarding the flow of user plane data, between the user equipment <NUM>, a control plane function <NUM> of the telecommunications network <NUM> (or of its core network <NUM>), a user plane function <NUM> of the telecommunications network <NUM> (or of its core network <NUM>), and the cloud provider infrastructure <NUM> is schematically shown in case that the connectivity to the virtual network <NUM> does not yet exists, i.e. needs to be established. The provision of connectivity to the virtual network <NUM> can be accomplished also assuring that end-to-end (E2E) security can be achieved. It may not be desired by the subscriber that the information exchanged between the user equipment <NUM> and the virtual network <NUM> is visible and/or modifiable and hence encryption and/or data protection may be desirable.

For this depiction, it is advantageous to separate the network functions into control plane (signaling) functionality and user plane (data traffic) functionality. In a first processing step <NUM>, the PDU session establishment request (transmitted by the user equipment <NUM>) is received by the control plane function <NUM> of the core network <NUM>. In a <NUM> network that would be the SM (session management) NAS (non-access stratum) container sent by the user equipment <NUM> via the access and mobility management function (AMF), transparently forwarded by the access network <NUM> towards the access and mobility management function via the NG-AP interface. This message triggers a request (cf. the second processing step <NUM> in <FIG>) for connectivity to virtual network <NUM> towards the cloud provider's control plane (cloud controller entity or functionality <NUM>), hereinafter also named "cloud controller". The following information is considered to be in the request for connectivity: the virtual network identifier (i.e. the target network identifier information <NUM>), the endpoint address of the user plane function (in a <NUM> network, that would be a user plane function) towards which the cloud provider can send user plane (data packets); information regarding the user equipment <NUM> that requested the connectivity. In a third processing step <NUM>, the cloud controller <NUM> sends back: an endpoint towards which the user plane function can send traffic to; additional security parameters the user equipment <NUM> can use to setup data protection for the data being sent via the network towards the virtual network <NUM>, e.g. encryption, integrity protection. In a fourth processing step <NUM>, the user equipment <NUM> receives the PDU session accept message and any additional parameters. In a fifth processing step <NUM>, security negotiation can be established between the user equipment <NUM> and the cloud controller <NUM>; existing means can be re-used for this. In a sixth processing step <NUM>, the user equipment <NUM> can then protect a data packet as per any negotiated parameters, e.g. encrypt the data packet so that its content is not visible to the telecommunications network <NUM>, add checksums/signatures so that it cannot be modified. In a seventh processing step <NUM>, the data packet is sent via user plane towards endpoint in the virtual network <NUM>, i.e. to the user plane function <NUM>. In an eighth processing step <NUM> and a ninth processing step <NUM>, the user plane function <NUM> forwards the packet to the ingress router <NUM> of the cloud provider infrastructure <NUM> as per the endpoints negotiated in the second and third processing steps <NUM>, <NUM>. The packet is then received by the ingress router <NUM>, which then forwards the data packet - in a tenth processing step <NUM> - towards the remote endpoint in the virtual network <NUM>.

Claim 1:
Method for using a user equipment (<NUM>) with a telecommunications network (<NUM>), wherein the user equipment (<NUM>) requests, while being connected to the telecommunications network (<NUM>), to be connected to or to access a further network (<NUM>), wherein the telecommunications network (<NUM>) comprises a control plane function (<NUM>) and a user plane function (<NUM>), wherein the further network (<NUM>) is a virtual network as part of a cloud provider infrastructure (<NUM>),
wherein the further network (<NUM>) is accessible, from within the cloud provider infrastructure (<NUM>), using a target network identifier information (<NUM>), wherein, in order for the user equipment (<NUM>) to use or to get access to the further network (<NUM>), a data network and associated data network name is required to be provisioned or established at the telecommunications network (<NUM>) or between the telecommunications network (<NUM>) and the cloud provider infrastructure (<NUM>),
wherein, in order for the user equipment (<NUM>) to be connected to or to access the further network (<NUM>), the method comprises the following steps:
-- in a first step, the user equipment (<NUM>) requests a communication session to be established to or towards the further network (<NUM>), using the target network identifier information (<NUM>) as part of a request message being transmitted, by the user equipment (<NUM>), to the control plane function (<NUM>) of the telecommunications network (<NUM>),
-- in a second step, the communication session is associated to the data network and/or data network name in order to provide connectivity towards the further network (<NUM>) via the cloud provider infrastructure (<NUM>) using the data network,
-- in a third step, the user equipment (<NUM>) receives a communication session establishment accept message, transmitted by the control plane function (<NUM>) of the telecommunications network (<NUM>),
-- in a fourth step, the user equipment (<NUM>) uses the established communication session to access the further network (<NUM>) via the user plane function (<NUM>) of the telecommunications network (<NUM>).