Patent Description:
In general, both a subscriber and a regular mobile operator prefer that roaming activities be done with local operators whose prices are reasonable and the quality of whose networks is high. The option for a home network to select a hosting network, while the UE is in roaming, is called steering of roaming (or preferred roaming), and can be performed by two methods such as (i) network-based steering, and (ii) Subscriber Identity Module (SIM)-based steering.

The home operator selects roaming partners based on control costs, and call quality etc. The roaming partners which are not preferred by the home operator, also called as non-preferred PLMN or low preferred PLMN can interfere with the steering process which is called as anti-steering of roaming.

In the current scenario, an anti-steering roaming is not detectable actively as the signaling from the HPLMN can be blocked by the VPLMN, but the UE never knows that the signaling from the HPLMN is blocked by the VPLMN. Usually, the UE decides on the serving network based on the radio conditions. The anti-steering of roaming is detected passively by estimating a number of roaming subscribers of different types, including a number of unique active roamers, a number of unique steered roamers, and a number of unique anti-steered roamers.

In the current solutions, there are lot of difficulties such as (i) a home network operator will not be able to actively prevent anti-steering of roaming mechanisms and the home network operator will just be able to identify if any such activities are happening passively, (ii) the network operator have to install a Value Added Service (VAS) product called as anti-steering of roaming for just passive detection of such frauds. Further adding to the cost of the product and its maintenance, (iii) the user experience is hampered as it is charged more and also it may affect the quality of service till a Home Public Land Mobile Network (HPLMN) is able to detect the fraud, (iv) There are no standardized mechanism to stop this fraud actively, and (v) due to anti-steering mechanism employed by a non-preferred or low-preferred visited network, HPLMN can face more signaling load and/or pay more for service provided by the non-preferred or low-preferred visited network compare to the preferred visited network. Finally, there are no low operational cost solutions for actively detecting and preventing the anti-steering mechanisms. In similar regards, publication <CIT> relates to methods for connecting a terminal to a visiting network in which the home network sends a list of preferred visiting networks to the terminal via a connected visiting network and publication "3GPP STANDARD; Reference: 3rd Generation Partnership Project; Technical Specification Group Core Network and Terminals; <NUM> System - Phase <NUM>; CT WG1 Aspects (Release <NUM>)" relates to cordless telephone generation <NUM> (CT1) aspects including the non-access-stratum (NAS) functions to be performed by the user equipment (UE) in idle mode and the NAS signaling procedures between the UE and the <NUM> System (5GS).

The present invention is directed to the subject matter as defined in the appended claims. In accordance with an aspects of the disclosure, there are provided methods and devices as set out in the appended claims.

The principal object of the embodiments herein is to provide a method and system for anti-steering of roaming activity in a wireless communication network.

Another object of the embodiments herein is to protect, by a HPLMN, a preferred PLMN list using at least one security parameter and at least HPLMN specific security key.

Another object of the embodiments herein is to send, by the HPLMN, the protected preferred PLMN list to a Visited Public Land Mobile Network (VPLMN) along with the security information and parameters, so that blocking/removing/modification of the preferred PLMN list is identifiable.

Another object of the embodiments herein is to transparently and mandatorily send, by the VPLMN, a request message including the protected preferred PLMN list to a User Equipment (UE), where the protected preferred PLMN list is received from the HPLMN.

Another object of the embodiments herein is to verify, by the UE, whether a response message to the request message including the preferred PLMN list is mandatorily provided by the VPLMN and a security check on the received preferred PLMN list is successful.

Another object of the embodiments herein is to send, by the UE, a reject message to the VPLMN and perform a PLMN selection procedure when the verification is failed.

Another object of the embodiments herein is performing a local Non-Access Stratum (NAS) signaling connection release and performing a PLMN selection procedure when the verification is failed.

Another object of the embodiments herein is to send, by the UE, an accept message to the VPLMN when the verification is successful.

By the method and system of the present application anti-steering of roaming activity in a wireless communication network can be managed effectively.

This invention is illustrated in the accompanying drawings, throughout which like reference letters indicate corresponding parts in the various figures. The embodiments herein will be better understood from the following description with reference to the drawings, in which:.

Accordingly, embodiments herein there are provided methods and devices corresponding to the appended claims.

Many changes and modifications may be made within the scope of the embodiments herein without departing from the scope of the appended claims.

As is traditional in the field, embodiments may be described and illustrated in terms of blocks which carry out a described function or functions. These blocks, which may be referred to herein as units or modules or the like, are physically implemented by analog or digital circuits such as logic gates, integrated circuits, microprocessors, microcontrollers, memory circuits, passive electronic components, active electronic components, optical components, hardwired circuits, or the like, and may optionally be driven by firmware and software. The circuits may, for example, be embodied in one or more semiconductor chips, or on substrate supports such as printed circuit boards and the like. The circuits constituting a block may be implemented by dedicated hardware, or by a processor (e.g., one or more programmed microprocessors and associated circuitry), or by a combination of dedicated hardware to perform some functions of the block and a processor to perform other functions of the block. Each block of the embodiments may be physically separated into two or more interacting and discrete blocks without departing from the scope of the invention. Likewise, the blocks of the embodiments may be physically combined into more complex blocks without departing from the scope of the invention.

The accompanying drawings are used to help easily understand various technical features and it should be understood that the embodiments presented herein are not limited by the accompanying drawings. As such, the present disclosure should be construed to extend to any alterations, equivalents and substitutes in addition to those which are particularly set out in the accompanying drawings.

Throughout this disclosure, the term "protection" means integrity protection and/or confidentiality protection (encryption/decryption). The terms "encryption" and "ciphering" used herein can be used interchangeably without departing from the scope of the embodiments.

Throughout this disclosure, the terms "PLMN and RAT list", "PLMN and Access Technology List", "Home PLMN preferred VPLMN list", "Preferred PLMN and RAT list", "Preferred PLMN and Access Technology list", "Network Steering information", "Steering of Roaming information list", "SoR Information List", "SoR List", "list of preferred PLMN/access technology", "List", "preferred PLMN/access technology combination", "preferred PLMN/access technology combinations (or HPLMN indication that 'no change of the "Operator Controlled PLMN Selector with Access Technology" list stored in the UE is needed and thus no list of preferred PLMN/access technology combinations is provided')", "Steering of Roaming information", "Operator Controlled PLMN Selector with Access Technology list in priority order", "PLMN Selector List", and "Preferred PLMN list" used herein can be used interchangeably without departing from the scope of the embodiments. Throughout this disclosure, the terms "Counter SoR", "SoR Counter", "counter value" and "COUNT", used herein can be used interchangeably without departing from the scope of the embodiments. The terms "verification" and "security check" used herein can be used interchangeably without departing from the scope of the embodiments.

Throughout this disclosure, The term "PLMN selection", "UE selects some other higher priority PLMN after making current PLMN as lowest priority", "UE attempting to obtain service on a higher priority PLMN as specified in 3GPP TS <NUM> by acting as if timer T that controls periodic attempts has expired" can be used interchangeably without departing from the scope of the embodiments.

Accordingly, embodiments herein provide a system for managing anti-steering of roaming in a wireless communication network. The system includes a HPLMN, a VPLMN and a UE. The HPLMN is configured to obtain a register request message from the VPLMN and derive at least one HPLMN specific security key based on at least one security parameter. Further, the HPLMN is configured to protect a preferred PLMN list (for illustration, Operator Controlled PLMN Selector list or PLMN Selector list, which may contain a list of preferred PLMNs in priority order and shall be possible to have an associated Access Technology identifier) using the at least one HPLMN specific security key and send the protected preferred PLMN list to the VPLMN. Further, the VPLMN is configured to receive the protected preferred PLMN list from the HPLMN and send a message including the protected preferred PLMN list to the UE. The message mandates the VPLMN to send the preferred PLMN list transparently to the UE. Further, the UE is configured to receive the message including the preferred PLMN list from the VPLMN. Further, the UE is configured to verify whether the message including the preferred PLMN list provided by the HPLMN and the VPLMN mandatorily sent the preferred PLMN list transparently, and a security check is successful on the received preferred PLMN list using at least one HPLMN specific security key. Further, the UE is configured to send a reject message to the VPLMN for a NAS signaling connection release and perform a PLMN selection procedure when the security check is failed, or perform a local NAS signaling connection release and perform a PLMN selection procedure when the verification is failed or send an accept message to the VPLMN when the verification is successful.

<FIG> is an overview of a system 1000a for managing an anti-steering of roaming in the wireless communication network, according to embodiments as disclosed herein. In an embodiment, the system 1000a includes a UE <NUM>, a VPLMN <NUM> and a HPLMN <NUM>. The UE <NUM> can be, for example but not limited to, a cellular phone, a tablet, a smart phone, a laptop, a Personal Digital Assistant (PDA), a global positioning system, a multimedia device, a game console, or the like. The UE <NUM> may also be referred to by those skilled in the art as a mobile station, a subscriber station, a mobile unit, a subscriber unit, a wireless unit, a remote unit, a mobile device, a wireless device, a wireless communications device, a mobile subscriber station, an access terminal, a mobile terminal, a wireless terminal, a remote terminal, a handset, a user agent, a mobile client, or the like.

The HPLMN <NUM> is configured to obtain a register request message from the VPLMN <NUM> and derive at least one HPLMN specific security key based on at least one security parameter. Further, the HPLMN <NUM> is configured to protect a preferred PLMN list using the at least one HPLMN specific security key and send the protected preferred PLMN list to the VPLMN <NUM>.

Further, the VPLMN <NUM> is configured to receive the protected preferred PLMN list from the HPLMN <NUM> and send a request message mandatorily including the protected preferred PLMN list to the UE <NUM>. In an embodiment, the request message includes one of an authentication request message and a registration accept request message.

Further, the UE <NUM> is configured to receive the request message from the VPLMN <NUM> and verify whether the request message including the preferred PLMN list provided by the HPLMN <NUM> is available and the verification of the security check on the received preferred PLMN list is successful. Further, the UE <NUM> is configured to send a reject message to the VPLMN <NUM>, or release the NAS signaling connection locally and perform a PLMN selection procedure when the verification is failed, or send an accept message to the VPLMN <NUM> when the verification is successful. In an embodiment, the reject message includes one of an authentication reject message and a NAS message. In another embodiment, the accept message includes one of an authentication accept message and a registration complete message and a NAS message.

In an embodiment, the verification is failed, when the preferred PLMN list provided by the HPLMN <NUM> is not available in the request message or the preferred PLMN list provided by the HPLMN <NUM> is available in the request message but the security check on the preferred PLMN list is not successful.

In an embodiment, the verification is successful, when the preferred PLMN list provided by the HPLMN <NUM> is available in the request message and the security check on the received preferred PLMN list is successful.

Considering, when the UE <NUM> sends a request to the VPLMN <NUM> for accessing the wireless communication network, the VPLMN <NUM> sends a request to the HPLMN <NUM> to provide one or more than one Authentication Vectors (AVs). The HPLMN <NUM> provides one or more than one AVs along with the preferred PLMN list signed with one or more security parameter using at least one security key of the home network to the VPLMN <NUM> and the VPLMN <NUM> sends the received PLMN list along with one or more security parameter transparently to the UE <NUM> over a NAS message. The UE <NUM> verifying the one or more security parameter to confirm no alterations/modifications are done to the received PLMN list using the at least one security key and mandatory requirement is applied for the VPLMN <NUM> to provide PLMN list IE (or information) part of the NAS message, otherwise the UE <NUM> may decide to select some other PLMN. The security parameter can be, for example, but not limited to a digital signature, a public Key, a KASME, an authentication key, a IK key, an CK key, a secret key, a KAUSF, KH-int, KH-enc, or the like.

The preferred PLMN list is protected by using a digital signature mechanism. In an example, when the UE <NUM> sends the request to the VPLMN <NUM> for accessing the wireless communication network, the VPLMN <NUM> sends the request to the HPLMN <NUM> to provide one or more than one AVs. The HPLMN <NUM> provides one or more than one AVs along with the preferred PLMN list signed with a digital signature using a private key of the home network to the VPLMN <NUM> and the VPLMN <NUM> sends the received PLMN list along with the digital signature transparently to the UE <NUM> over the NAS message. The UE <NUM> verifying the digital signature to confirm no alterations/modifications are done to the received PLMN list using the secret key (The secret key is obtained using the public key of the home network) and mandatory requirement is applied for the VPLMN <NUM> to provide PLMN list IE (or information) part of the NAS message, otherwise the UE <NUM> may decide to select some other PLMN.

The preferred PLMN list is protected by using a public key of the UE <NUM>. In another example, when the UE <NUM> sends the request to the VPLMN <NUM> for accessing the communication network, the VPLMN <NUM> sends the request to the HPLMN <NUM> to provide one or more than one AV. The HPLMN <NUM> provides the AV along with the PLMN list which is encrypted using a public key of the UE <NUM> and the VPLMN <NUM> sends the received PLMN list transparently to the UE <NUM> over the NAS message. The UE <NUM> decrypts the received PLMN list using the private key obtained using the public key and mandatory requirement is applied for the VPLMN <NUM> to provide the PLMN list IE (or information) part of an attach accept message otherwise, the UE <NUM> may decide to select some other PLMN.

The preferred PLMN list is protected by using KASME. In another example, when the UE <NUM> sends the request to the VPLMN <NUM> for accessing the wireless communication network, the VPLMN <NUM> sends request to the HPLMN <NUM> which provides the PLMN list and an intermediate key (in an example, in case of LTE, the intermediate key is the KASME) to the VPLMN <NUM>. The intermediate key is the key generated by the HSS/AUSF and provided to the MME/SEAF/AMF. Throughout the disclosure, the KASME is referred as the intermediate key and appropriate key (for example, KAUSF) in the other 3GPP systems like <NUM> system. The KASME is generated with the PLMN list as one of the parameters. In an embodiment, the KASME is generated using the PLMN list as one parameter out of which further keys are derived like NAS anchor key and AS anchor keys (KeNB and/or KgNB). The VPLMN <NUM> sends the received PLMN list transparently to the UE <NUM> over the NAS message. In an embodiment, the input PLMN list contains the PLMN IDs in sequence according to priority, so that, the UE <NUM> obtains the preferred PLMN list in the priority order. The UE <NUM> generate the KASME using the PLMN list as one parameter out of which further keys are derived and mandatory requirement is applied for the VPLMN <NUM> to provide the PLMN list IE (or information) part of the attach accept message otherwise, the UE <NUM> may decide to select some other PLMN.

The preferred PLMN list is protected by using Authentication Key (Ak) key. In another example, The UE <NUM> sends the request to the VPLMN <NUM> for accessing the wireless communication network. The VPLMN <NUM> sends the request to the HPLMN <NUM> to provide one or more than one AVs. Further, the HPLMN <NUM> provides the PLMN list to the VPLMN <NUM> and also Expected Response(XRES*) along with other parameters to the VPLMN <NUM>. The XRES* is generated with the PLMN list as one of the parameters. Further, the VPLMN <NUM> sends the received PLMN list transparently to the UE <NUM> over the NAS message. The UE <NUM> generates the Response(RES*) using the received PLMN list as one of the parameter, the UE <NUM> responds to the NAS message with calculated the RES* value. The VPLMN <NUM> checks if the received RES* is equivalent to the XRES*. If the RES* and XRES* are not same, the authentication procedure fails. Mandatory requirement is applied for the VPLMN <NUM> to provide PLMN list IE (or information) part of the NAS message otherwise, the UE <NUM> may decide to select some other PLMN.

The preferred PLMN list is protected by using the Message Authentication Code(MAC) function. In another example, when the UE <NUM> sends the request to the VPLMN <NUM> for accessing the wireless communication network, the VPLMN <NUM> sends the request to the HPLMN <NUM> for providing the PLMN list and Authentication Token(AUTN) to the VPLMN <NUM>. The AUTN is generated with the PLMN list as one of the parameters and the VPLMN <NUM> sends the received PLMN list transparently to the UE <NUM> over the NAS message. The UE <NUM> generates the Expected Mac(XMAC) using the PLMN list as one parameter, the UE <NUM> validates if the XMAC and MAC are same to check if the PLMN list received by UE <NUM> is not distorted. The mandatory requirement is applied for the VPLMN <NUM> to provide the PLMN list IE (or information) part of attach accept message (In 5GS context, its REGISTRATION ACCEPT message) otherwise, the UE <NUM> may decide to select some other PLMN. The MAC is derived using PLMN list as one of the inputs as shown in the <FIG>.

The preferred PLMN list is protected by using key "K": In another example, when the UE <NUM> sends the request to the VPLMN <NUM> for accessing the wireless communication network, the VPLMN <NUM> sends the request to the HPLMN <NUM> which provides one or more than one AVs. The HPLMN <NUM> provides the AVs along with PLMN list which is encrypted or integrity protected using a secret key ("K") and the VPLMN sends the received PLMN list transparently to the UE <NUM> over the NAS message. The UE <NUM> decrypts the received PLMN list using the secret key ("K") and applies the mandatory requirement for the VPLMN <NUM> to provide the PLMN list IE (or information) part of the attach accept message (in 5GS context, its REGISTRATION ACCEPT message) or the authentication request message otherwise, the UE <NUM> may decide to select some other PLMN to get the preferred PLMN list IE.

The preferred PLMN list is protected by using KASME of the HPLMN <NUM>: In another example, when the UE <NUM> sends a request to the VPLMN <NUM> for accessing the wireless communication network, the VPLMN <NUM> sends the request to the HPLMN <NUM> which provides one or more than one AVs. The VPLMN <NUM> sends the received PLMN list which is encrypted and/or integrity protected using a Home KASME. The Home KASME is derived as similar process of deriving KASME but by using SNID=HPLMN ID. Further, the VPLMN <NUM> send the received PLMN list transparently to the UE <NUM> over the NAS message and the UE <NUM> decrypts the received PLMN list using the IK or CK keys and the mandatory requirements is applied for the VPLMN <NUM> to provide the PLMN list IE (or information) part of attach accept (In 5GS context, its REGISTRATION ACCEPT message) or authentication procedures otherwise, the UE <NUM> will decide to select some other PLMN.

The preferred PLMN list is protected by using IK and CK keys: In another example, when the UE <NUM> sends the request to the VPLMN <NUM> for accessing the wireless communication network, the VPLMN <NUM> sends the request to the HPLMN <NUM> which provides one or more than one AVs. The HPLMN <NUM> provides the AVs along with PLMN list which is encrypted or integrity protected using IK or CK keys and the VPLMN <NUM> sends the received PLMN list transparently to the UE <NUM> over the NAS message. The UE <NUM> decrypts the received PLMN list using the IK or CK keys and applies the mandatory requirement for the VPLMN <NUM> to provide PLMN list IE (or information) part of attach accept message or authentication procedures otherwise, the UE <NUM> will decide to select some other PLMN.

Although the <FIG> show various hardware components of the system 1000a but it is to be understood that other embodiments are not limited thereon. In other embodiments, the system 1000a may include less or more number of components. Further, the labels or names of the components are used only for illustrative purpose and does not limit the scope of the invention. One or more components can be combined together to perform same or substantially similar function to manage the anti-steering of roaming in the wireless communication network.

<FIG> is another overview of a system 1000b for managing the anti-steering of roaming in the wireless communication network, according to embodiments as disclosed herein. In an embodiment, the system 1000a includes the UE <NUM>, the VPLMN <NUM> and the HPLMN <NUM>. The VPLMN <NUM> includes an AMF(Access and Mobility Function) <NUM> and a SEAF(Security Anchor Function) <NUM>. The HPLMN <NUM> includes an AUSF(Authentication Server Function) <NUM> and a UDM(Unified Data Management) <NUM>.

In an embodiment, the UE <NUM> sends a register request message to the AMF <NUM>. Further, the AMF <NUM> requests the AUSF <NUM> to perform a primary authentication. Further, the AUSF <NUM> requests the UDM <NUM> to provide the AV to carry out the authentication.

Based on a HPLMN policy, the UDM <NUM> decides to add the preferred PLMN list along with the AVs or later within the registration procedure and the UDM <NUM> provides the AV(s) with the preferred PLMN list to the AUSF <NUM>.

Further, the AUSF <NUM> protects the preferred PLMN list using the at least one security parameter (e.g., digital signature or Public Key or KASME or Authentication Key or IK keys or CK keys or Secret Key or KAUSF or KH-int or KH-enc or the like).

Further, the AUSF <NUM> sends the <NUM> Authentication Initiation Answer (<NUM>-AIA) message over a N12 to the SEAF <NUM>. In the <NUM>-AIA message, the AUSF <NUM> includes the integrity protected preferred PLMN list using at least one security parameter. Further, the AMF <NUM>/SEAF <NUM> sends the received protected PLMN list(s) transparently to the UE <NUM> over the NAS message (i.e., authentication request message). In an embodiment, the AMF <NUM>/SEAF <NUM> selects the AV, if receives multiple AVs, and sends the corresponding protected PLMN list(s) transparently to the UE <NUM> over the NAS message.

Further, based on the configuration of the USIM in the UE <NUM>, the UE <NUM> expects the protected PLMN and RAT list in the authentication response message. If the configuration indicates mandatory check for preferred PLMN list, then the UE <NUM> verifies the integrity of the received PLMN list by deriving the key in the same way as the AUSF <NUM>.

If the security check fails, the UE <NUM> sends the authentication reject message to the VPLMN <NUM>. The UE <NUM> performs the PLMN selection, if the protected PLMN and RAT list is missing or verification fails.

Further, if the security check is passed and a serving PLMN is not the preferred PLMN, the UE <NUM> sends the authentication reject message to the VPLMN <NUM>. Further, the UE <NUM> performs the PLMN selection considering the PLMN list provided by the HPLNM <NUM>.

Further, if the security check is passed and the serving PLMN is in the preferred PLMN list, the UE <NUM> sends the authentication accept message to the VPLMN <NUM>.

In another embodiment, the UE <NUM> sends the register request message to the AMF <NUM>. Further, the AMF <NUM> registers with the UDM <NUM> by initiating Nudm_UECM_Registration procedure. Between first two steps, other procedure may be performed, for example an authentication procedure or registration procedure.

In an embodiment, the AMF <NUM> may provide the Subscription Permanent Identifier (SUPI), Sequence Number of the AV and/or ngKSI and/or RAND of the AV and/or KAUSF Key Set Identifier along with SUPI, so that the AUSF <NUM> identifies the appropriate KAUSF.

Further, based on the HPLMN policy, the UDM <NUM> decides to add the preferred PLMN list. Further, the UDM <NUM> request the AUSF <NUM> to apply protection for the PLMN/RAT list.

Further, the AUSF <NUM> protects the preferred PLMN list using the at least one security parameter. Further, the AUSF <NUM> sends the <NUM> Authentication Initiation Answer (<NUM>-AIA) message over the N12 to the SEAF <NUM>. In the <NUM>-AIA message, the AUSF <NUM> includes the integrity protected preferred PLMN list using at least one security parameter.

Further, the AMF <NUM>/SEAF <NUM> sends the received protected PLMN list(s) transparently to the UE <NUM> over the NAS message (i.e., attach request message). In an embodiment, the AMF <NUM>/SEAF <NUM> selects the AV, if receives multiple AVs, and sends the corresponding protected PLMN list(s) transparently to UE <NUM> over the NAS message.

Further, the security check fails, the UE <NUM> sends the registration reject message to the VPLMN <NUM>. Further, the UE <NUM> performs the PLMN selection, if the protected PLMN and RAT list is missing or verification fails.

In an embodiment, if the security check is passed and serving PLMN is not the preferred PLMN, the UE <NUM> sends the registration reject message to the VPLMN <NUM>. Further, the UE <NUM> performs the PLMN selection considering the PLMN list provided by HPLNM <NUM>.

If the security check is passed and the serving PLMN is in the preferred PLMN list, the UE <NUM> sends the registration accept message to the VPLMN <NUM>.

However, the detailed procedures of the providing the list of preferred PLMN list during the authentication procedure or the registration accept procedure, while managing the anti-steering of the roaming activity in the wireless communication network, are explained in the conjunction with the <FIG> to the <FIG>.

Although the <FIG> shows various hardware components of the system 1000b but it is to be understood that other embodiments are not limited thereon. In other embodiments, the system 1000b may include less or more number of components. Further, the labels or names of the components are used only for illustrative purpose and does not limit the scope of the invention. One or more components can be combined together to perform same or substantially similar function to manage the anti-steering of roaming in the wireless communication network.

<FIG> is a sequence flow diagram illustrating step by step procedures for providing the list of preferred PLMN list during the authentication procedure in the wireless communication network, according to embodiments as disclosed herein.

As shown in the <FIG>, at <NUM>, the UE <NUM> sends a register request message to the AMF <NUM>. At <NUM>, the AMF <NUM> requests the AUSF <NUM> to perform the primary authentication. At <NUM>, the AUSF <NUM> requests the UDM <NUM> to provide the AV to carry out the authentication.

At <NUM>, based on the HPLMN policy, the UDM <NUM> decides to add the preferred PLMN list along with the AVs. At <NUM>, the UDM <NUM> provides the AV(s) with the preferred PLMN list to the AUSF <NUM>.

At <NUM>, the AUSF <NUM> protects the preferred PLMN list using the at least one security parameter (e.g., digital signature or Public Key or KASME or Authentication Key or IK keys or CK keys or Secret Key or KAUSF or KH-int or KH-enc or the like).

At <NUM>, the AUSF <NUM> sends the <NUM>-AIA message over the N12 to the SEAF <NUM>. In the <NUM>-AIA message, the AUSF <NUM> includes the integrity protected preferred PLMN list using at least one security parameter.

At <NUM>, the AMF <NUM>/SEAF <NUM> sends the received protected PLMN list(s) transparently to the UE <NUM> over the NAS message (i.e., authentication request message). In an embodiment, the AMF <NUM>/SEAF <NUM> selects the AV, if receives multiple AVs, and sends the corresponding protected PLMN list(s) transparently to UE <NUM> over the NAS message.

At <NUM>, based on the configuration of the USIM in the UE <NUM>, the UE <NUM> expects the protected PLMN and RAT list in the authentication response message. If the configuration indicates mandatory check for preferred PLMN list, then the UE <NUM> verifies the integrity of the received PLMN list by deriving the key in the same way as the AUSF <NUM>.

At 10a, if the security check fails, the UE <NUM> sends the authentication reject message to the VPLMN <NUM>. At 10b, the UE <NUM> performs the PLMN selection, if the protected PLMN and RAT list is missing or verification fails.

At 11a, if the security check is passed and serving PLMN is not the preferred PLMN, the UE <NUM> sends the authentication reject message to the VPLMN <NUM>. At 11b, the UE <NUM> performs the PLMN selection considering the PLMN list provided by HPLNM <NUM>.

At <NUM>, if the security check is passed and the serving PLMN is in the preferred PLMN list then, the UE <NUM> sends the authentication accept message to the VPLMN <NUM>.

Consider an example, the UE <NUM> sends the register request to the AMF <NUM>. The AMF <NUM> sends a request to the AUSF <NUM> of the HPLMN <NUM> to perform the primary authentication. The AUSF <NUM> sends a request to the UDM <NUM>/ARPF to provide the AV to carry out the authentication. Based on the HPLMN policy, the UDM <NUM>/ARPF decides to add the preferred PLMN and RAT list along with the AV(s). The UDM <NUM>/ARPF provides the AV(s) with the PLMN and RAT list.

In an embodiment, when the AUSF <NUM> receives the PLMN and RAT list, the AUSF <NUM> derives the security keys KH-int and/or KH-enc to protect the PLMN and RAT list. The KH-int and/or KH-enc is derived using at least one of the following parameters: KAUSF, algorithm type distinguishers, algorithm identity, Home Network Identity (MNC+MCC) and other possible parameters.

In an embodiment, a derivation of an initial key is illustrated in the <FIG>. A derivation of an encrypted key is illustrated in the <FIG>. As shown in the Table-<NUM>, the new Algorithm type distinguisher is defined for the HPLMN Integrity protection (for example, N-Home-int-alg) and/or for encryption (for example, N-Home-enc-alg). In another embodiment, the existing NAS Algorithm type distinguisher is reused for HPLMN Integrity protection (for example, N-NAS-int-alg) and/or for encryption (for example, N-NAS-enc-alg).

In another embodiment, the algorithm(s) to be used for protection (Integrity Protection and/or encryption) of the PLMN and RAT list, whether encryption/decryption to be applied (with respect to the VPLMN <NUM>) are pre-configured in the UE <NUM> (for example, in an Universal Integrated Circuit Card (UICC)) provided by the HPLMN <NUM> and/or as part of NAS configuration) by the HPLMN <NUM>.

In another embodiment, the algorithm(s) to be used by the UE <NUM> for verification of the integrity and/or decryption of the preferred PLMN and RAT list is included along with the preferred PLMN and RAT list and may also the indication whether the PLMN and RAT list is encrypted is sent along with the message. The algorithm identifier values are as follows:.

Further, the AUSF <NUM> sends the <NUM>-AIA message over N12 to the SEAF <NUM>. In the <NUM>-AIA message, the AUSF <NUM> includes the integrity protected preferred PLMN and RAT list (includes the Message Authentication Code for Integrity (MAC-I)) to the AMF <NUM>/SEAF <NUM>, using the HPLMN key (derives further key using the key KAUSF and also encrypts the list, if supported). Based on the HPLMN policy, the HPLMN <NUM> includes the protected preferred PLMN and RAT list in the <NUM>-AIA message and for the VPLMN <NUM> to provide PLMN and RAT list from the HPLMN <NUM> in the authentication request. When the AUSF <NUM> receives the PLMN list from the UDM <NUM>, the AUSF <NUM> protects the PLMN list before sending the PLMN list to the UE <NUM> via the AMF <NUM>/SEAF <NUM>.

In an embodiment, the input parameters to the integrity algorithm (NIA) are PLMN and RAT list, Integrity protection key (for example, KH-int) derived from Key KAUSF, RAND (one of the parameter in the AV) and other possible parameters (for example, length of the list LENGTH, NONCE, like so). RAND and/or NONCE is used to derive cryptographic separate MAC-I for each derivation corresponding to the AV. Based on these input parameters, the AUSF <NUM> computes a message authentication code (MAC-I) using the integrity algorithm NIA. In another embodiment, instead of NIA, Key Derivation Function (KDF) is used for MAC-I generation. The message authentication code is then appended to the message when sent. The UE <NUM> computes the expected message authentication code (XMAC-I) on the message received in the same way as the AUSF <NUM> computed its message authentication code on the message sent and verifies the data integrity of the message by comparing it to the received message authentication code. The derivation of MAC-I/XMAC-I on the PLMN and RAT list is illustrated in the <FIG>.

In an embodiment, a counter COUNT is used as one of the input parameter to the integrity algorithm and the COUNT is included along with the MAC-I, so that the receiver of the UE <NUM> can use the COUNT value for XMAC-I calculation.

As shown in the <FIG>, the input parameters to the ciphering algorithm (NEA) encryption key (for example, KH-enc) derived from Key KAUSF, RAND (one of the parameter in the AV) and other possible parameters (for example, length of the list LENGTH, NONCE, like so). RAND and/or NONCE is used to derive cryptographic separate Key Streams for each derivation corresponding to the AV. The ciphering of network steering information is illustrated in the <FIG>.

In an embodiment, a counter COUNT is used as one of the input parameter to the algorithm and COUNT is included along with the message, so that the receiver will use the COUNT value for decryption.

In an embodiment, if multiple AVs are received from the UDM <NUM>, then the AUSF <NUM> generates the MAC-I for each AV (using corresponding KAUSF, RAND like so) and provides multiple AVs and corresponding protected PLMN and RAT List to the SEAF <NUM>/AMF <NUM>.

In an embodiment, the AUSF <NUM> generates a new KAUSF Key Set Identifier (for example, ngKSlausf) to identify the KAUSF. Subscription Permanent Identifier (SUPI) along with the KAUSF Key Set Identifier, uniquely identifies the KAUSF of the UE <NUM>. The AUSF <NUM> provides the KAUSF Key Set Identifier along with the AV to the UE <NUM> via the AMF <NUM>/SEAF <NUM>. The AMF210/SEAF <NUM> may store KAUSF Key Set Identifier along with ngKSI.

In an embodiment, the sequence number of the AV and/or RAND of the AV and the SUPI uniquely identifies the KAUSF of the UE <NUM>.

The AMF <NUM>/SEAF <NUM> sends the received protected PLMN list(s) transparently to the UE <NUM> in the NAS message (i.e., authentication request message). In an embodiment, the AMF <NUM>/SEAF <NUM> selects the AV, if the AMF <NUM>/SEAF <NUM> receives multiple AVs, and sends the corresponding protected PLMN list(s) transparently to the UE <NUM> in the NAS message.

Based on the configuration (in an example in the USIM) in the UE <NUM>, the UE <NUM> expects the protected PLMN and RAT list in the authentication request message. If the configuration indicates mandatory check for the preferred PLMN and RAT list, then the UE <NUM> verifies the integrity of the received PLMN and RAT list, by deriving the key in the same way as the AUSF <NUM>.

In an embodiment, the UE <NUM> performs the PLMN selection, if the protected PLMN and RAT list is missing or verification fails. In another embodiment, the UE <NUM> performs the PLMN selection, if the protected PLMN and RAT list verification of integrity is successful, but the serving PLMN is not the preferred PLMN/RAT in the received list.

In another embodiment, the UE <NUM> shall return authentication response message to the SEAF <NUM> over the NAS message, if the protected list verification of integrity is successful and the serving PLMN is in the preferred PLMN/RAT in the received list or no preferred PLMN available in that particular area.

<FIG> is a sequence flow diagram illustrating step by step procedures for providing the list of preferred PLMN list during the registration accept procedure in the wireless communication network, according to embodiments as disclosed herein.

At <NUM>, the UE <NUM> sends the register request message to the AMF <NUM>. At <NUM>, the AMF <NUM> registers with the UDM <NUM> by initiating Nudm_UECM_Registration procedure. Between step <NUM> and step <NUM>, other procedure may be performed, for example authentication procedure or registration procedure.

At <NUM>, based on the HPLMN policy, the UDM <NUM> decides to add the preferred PLMN list. At <NUM>, the UDM <NUM> requests the AUSF <NUM> to apply protection for the PLMN/RAT list.

At <NUM> and At <NUM>, the AUSF <NUM> protects the preferred PLMN list using the at least one security parameter. At <NUM>, the AUSF <NUM> sends the <NUM>-AIA message over the N12 to the SEAF <NUM>. In the <NUM>-AIA message, the AUSF <NUM> includes the integrity protected preferred PLMN list using the at least one security parameter.

At <NUM>, the AMF <NUM>/SEAF <NUM> sends the received protected PLMN list(s) transparently to the UE <NUM> over the NAS message (i.e., attach request message). In an embodiment, the AMF <NUM>/SEAF <NUM> selects the AV, if receives multiple AVs, and sends the corresponding protected PLMN list(s) transparently to UE <NUM> over the NAS message.

At <NUM>, based on the configuration of the USIM in the UE <NUM>, the UE <NUM> expects the protected PLMN and RAT list in the attach request message. If the configuration indicates mandatory check for preferred PLMN list, then the UE <NUM> verifies the integrity of the received PLMN list by deriving the key in the same way as the AUSF <NUM>.

At 10a, if the security check fails, the UE <NUM> sends the registration reject message to the VPLMN <NUM>. At 10b, the UE <NUM> performs the PLMN selection, if the protected PLMN and RAT list is missing or verification fails.

At 11a, if the security check is passed and serving PLMN is not the Preferred PLMN then, the UE <NUM> sends the registration reject message to the VPLMN <NUM>. At 11b, the UE <NUM> performs the PLMN selection considering the PLMN list provided by HPLNM <NUM>.

At <NUM>, if the security check is passed and the serving PLMN is in the preferred PLMN list, the UE <NUM> sends the registration accept message to the VPLMN <NUM>.

The procedure names and message names in the disclosure are used for illustrative propose only and is application for any message/procedure between the following interfaces/reference ponts: N2, N12, N8, N1, N13, Namf, Nudm, and Nausf.

Consider an example, the UE <NUM> sends the register request to the AMF <NUM> and the AMF <NUM> registers with the UDM <NUM> by initiating the Nudm_UECM_Registration procedure. Between step <NUM> and step <NUM>, other procedure may be performed, for example authentication procedure or registration procedure.

Based on the HPLMN policy, the UDM <NUM>/ARPF decides to provide the preferred PLMN and RAT list to the UE <NUM>. The UDM <NUM>/ARPF requests the AUSF <NUM> to apply protection for the PLMN/RAT list.

In an embodiment, the UDM <NUM> may provide the sequence number of the AV and/or ngKSI and/or RAND of the AV and/or KAUSF Key Set Identifier along with the SUPI, so that the AUSF <NUM> identifies the appropriate KAUSF.

When the AUSF <NUM> receives the PLMN and RAT list, the AUSF <NUM> derives the security keys KH-int and/or KH-enc to protect the PLMN and RAT list.

In an embodiment, the AUSF <NUM> utilizes the latest KAUSF of the SUPI to protect the PLMN and RAT list. In another embodiment, the AUSF <NUM> identifies the appropriate KAUSF of the SUPI, using the SUPI, Sequence Number of the AV and/or ngKSI and/or RAND of the AV and/or KAUSF Key Set Identifier along with SUPI provided by the UDM <NUM>.

The KH-int and/or KH-enc are derived using at least one of the following parameters (e.g., KAUSF, Algorithm type distinguishers, Algorithm identity, Home Network Identity (MNC+MCC) and other possible parameters). The derivation of the Key KH-int is illustrated as shown in the <FIG> and the derivation of the Key KH-enc is illustrated as shown in the <FIG>.

In an embodiment, the new algorithm type distinguisher is defined for the HPLMN Integrity protection (for example, N-Home-int-alg) and/or for encryption (for example, N-Home-enc-alg). In another embodiment, the existing NAS Algorithm type distinguisher is reused for HPLMN Integrity protection (for example, N-NAS-int-alg) and/or for encryption (for example, N-NAS-enc-alg). The Table <NUM> depicts the algorithm distinguisher along with the value. In another embodiment, the existing KDF is used instead of integrity protection algorithm.

In another embodiment, the algorithm(s) to be used for protection (Integrity Protection and/or encryption) of the PLMN and RAT list is pre-configured in the UE <NUM> (for example, in the UICC provided by the HPLMN <NUM> and/or as part of NAS configuration) by the HPLMN <NUM>. In another embodiment, the algorithm(s) to be used by the UE <NUM> for verification of the integrity and decryption of the preferred PLMN and RAT list is included along with the preferred PLMN and RAT list. The algorithm identifier values are as follows depicted in the Table <NUM> and Table <NUM>.

Further, the AUSF <NUM> sends the integrity protected preferred PLMN and RAT list (includes the MAC-I) to the UDM <NUM>/ARPF, using the HPLMN key KAUSF (may derives further key using the key KAUSF and also encrypts the list, if supported).

In an embodiment, the input parameters to the integrity algorithm are PLMN and RAT list, Integrity protection key (for example, may derive further key KH-int) Key KAUSF, RAND (one of the parameter in the AV) and other possible parameters (for example, length of the list LENGTH, NONCE, like so). The RAND and/or NONCE are used to derive cryptographic separate MAC for each derivation corresponding to the AV. Based on the input parameters, the AUSF <NUM> computes the message authentication code (MAC-I) using the integrity algorithm NIA. The message authentication code is then appended to the message when sent. The UE <NUM> computes the expected message authentication code (XMAC-I) on the message received in the same way as the AUSF computed its message authentication code on the message sent and verifies the data integrity of the message by comparing it to the received message authentication code. The derivation of MAC-I/XMAC-I on the PLMN and RAT list is illustrated in the <FIG>.

In an embodiment, the counter COUNT is used as one of the input parameter to the integrity algorithm and the COUNT is included along with the MAC-I, so that the receiver can use the COUNT value for XMAC-I calculation.

In an embodiment, the input parameters to the ciphering algorithm (NEA) encryption key (for example, KH-enc) derived from the Key KAUSF, RAND (one of the parameter in the AV) and other possible parameters (for example, length of the list LENGTH, NONCE, like so). The RAND and/or NONCE are used to derive cryptographic separate key streams for each derivation corresponding to the AV. The ciphering of network steering information is illustrated in the <FIG>.

In an embodiment, the counter COUNT is used as one of the input parameter to the algorithm and the COUNT is included along with the message, so that the receiver will use the COUNT value for decryption.

In an embodiment, if multiple AVs are received from the UDM <NUM>, then the AUSF <NUM> generates the MAC-I for each AV (using corresponding KAUSF, RAND, or the like) and provides multiple AVs and corresponding protected PLMN and RAT List to the SEAF <NUM>.

In an embodiment, the UDM <NUM> instead of requesting the AUSF <NUM> to apply security (as in Step <NUM> to Step <NUM>), the UDM <NUM> request the AUSF <NUM> to provide the security keys, so that the UDM <NUM> applies protection on the PLMN list. If the UDM <NUM> request for keys (with details to select appropriate KAUSF), then the AUSF <NUM> derives appropriate keys and provides the key to the UDM <NUM>. In embodiment, the UDM <NUM> may skip the Step-<NUM> to Step-<NUM>, as it may have the required AV to derive the keys for protection and protects the PLMN list.

Further, the UDM <NUM> then sends the protected PLMN list to the AMF <NUM>/SEAF <NUM> are part of the Nudm_UECM_Registration procedure. Further, AMF <NUM>/SEAF <NUM> sends the received protected PLMN list(s) transparently to the UE <NUM> over the NAS message (registration accept message). In an embodiment, the AMF <NUM>/SEAF <NUM> selects the AV, if receives multiple AVs, and sends the corresponding protected PLMN list(s) transparently to the UE <NUM> over the NAS message.

At <NUM>, based on the configuration in the UE <NUM>, the UE <NUM> expects the protected PLMN and RAT list in the registration accept message. If the configuration indicates mandatory check for preferred PLMN and RAT list, then the UE <NUM> verifies the integrity of the received PLMN and RAT list, by deriving the key in the same way as the AUSF <NUM>.

Further, the UE <NUM> performs the PLMN selection, if the protected PLMN and RAT list is missing or verification fails. Further, the UE <NUM> performs the PLMN selection, if the protected PLMN and RAT list verification of integrity is successful, but the serving PLMN is not the preferred PLMN/RAT in the received list.

Further, the UE <NUM> sends the registration complete message to the SEAF <NUM> over a NAS message, if the protected list verification of integrity is successful and the serving PLMN is in the preferred PLMN/RAT in the received list or no preferred PLMN available in that particular area.

In an embodiment, the UE <NUM> may responds with a message to the UDM <NUM>/AUSF <NUM> (via AMF <NUM>/SEAF <NUM>) carrying a protected acknowledgement IE. The protection mechanism is same as the above mentioned procedure, but the UE <NUM> performs the MAC-I calculation on the response message (may carry the preferred PLMN/access technology combinations) and the UDM <NUM>/AUSF <NUM> performs the XMAC-I calculation on the received message and checks whether the MAC-I is same as XMAC-I. Similarly, the UE <NUM> may perform encryption and the AUSF <NUM>/UDM <NUM> decryption.

In an embodiment, if the check is successful in step <NUM>, then the UE <NUM> shall insert the received preferred PLMN list into top of the OPLMN list. If the UE determines that there is a higher priority PLMN than currently camped VPLMN, then the UE shall respond with authentication reject message or authentication failure message indicating the AMF <NUM> to release the current N1 NAS signaling connection, after the releases of the N1 NAS signaling connection, the UE <NUM> shall attempt to obtain service on a higher priority PLMN as specified in 3GPP TS <NUM> by acting as if timer T that controls periodic attempts (see 3GPP TS <NUM>) has expired, otherwise the UE <NUM> shall respond with authentication response message as described in 3GPP TS <NUM>. The mechanism in which UE <NUM> determines there is a higher priority PLMN than currently camped VPLMN in step <NUM> is UE implementation dependent.

If check is not successful in step <NUM> then the UE <NUM> shall perform PLMN selection as described in 3GPP TS <NUM>.

During the first registration procedure over a VPLMN, which is not part of "Operator Controlled PLMN Selector with Access Technology" list stored in the ME, if the authentication procedures is not executed by the VPLMN <NUM> and the UE <NUM> enters into 5GMM-IDLE mode after successfully executing the registration procedure, then the UE <NUM> shall initiate a Service Request procedure by setting ngKSI value to <NUM>.

<FIG> is example sequence flow diagram illustrating step by step procedures for providing the list of preferred PLMN list during the registration procedure (in the form of registration accept message) in the wireless communication network, according to embodiments as disclosed herein. At <NUM>, the UE <NUM> initiates registration by sending the registration request message to the AMF <NUM>. At <NUM> and at <NUM>, the AMF <NUM> executes the registration procedure and as part of the registration procedure, the AMF <NUM> executes primary authentication of the UE <NUM> and then initiates the NAS Security Mode Command(SMC) procedure, after the authentication is successful.

At <NUM>, the AMF <NUM> invokes Nudm_SDM_Get service operation message to the UDM <NUM> to get amongst other information the access and mobility subscription data for the UE <NUM> as defined in the 3GPP standard.

At <NUM>, the UDM <NUM> decides to send the steering information. If the HPLMN <NUM> has configured that their subscribed UE's <NUM> to mandatorily expect to receive the steering of roaming information during the initial registration procedure, then the UDM <NUM> shall send the steering of roaming information, otherwise depending on local or operator policy, the UDM <NUM> decides to send the steering of roaming information to the UE <NUM> via the VPLMN <NUM> later if required.

At <NUM> and At <NUM>, the UDM <NUM> shall invoke the Steering of Roaming (SoR) Protection service operation with the AUSF <NUM> to get Message Authentication Code - Integrity and related security parameters (SoR-MAC-IAUSF and counter value). If the HPLMN <NUM> decided that the UE <NUM> is to acknowledge the successful security check of the received steering information list, then the UDM <NUM> indicates (set the indicator) in the SoR Protection service operation request message that it also needs the expected SoR-XMAC-IUE for verification of the acknowledge from the UE <NUM>.

In case, the steering information list is not available or the HPLMN <NUM> determines that no steering of the UE <NUM> is required, the steering information list shall be set to null value (0x00) and Message Authentication Code - Integrity is calculated on the null value. The inclusion of steering information and the acknowledge indication in the calculation of SoR-MAC-IAUSF allows the UE <NUM> to verify that the steering information list received is not tampered with or removed by the VPLMN <NUM> and whether if the UDM <NUM> requested an acknowledgement. The inclusion of the UDM requested an acknowledgement indication (0x01) in the calculation of the expected SoR-XMAC-IUE allows the UDM <NUM> to verify that the UE <NUM> received the steering information list successfully. The UDM <NUM> provides the SUPI, the SoR Information List or null value and Acknowledge indication (whether SoR-XMAC-IUE is needed or not) to the AUSF <NUM>, to obtain the SoR protection service. On receiving the service request from the UDM <NUM>, the AUSF <NUM> calculates the MAC-I(s). The SoR-MAC-IAUSF is calculated using the key KAUSF, SoR Information List or null value, counter value, Acknowledge indication and other possible parameters as input to the security function KDF. If requested by the UDM <NUM> for verification of acknowledge from the UE <NUM>, the AUSF <NUM> calculates the SoR-XMAC-IUE. The SoR-XMAC-IUE is calculated using the key KAUSF, counter value, Acknowledge indication (0x01) and other possible parameters as input to the KDF. The counter value is incremented by the AUSF <NUM> for every new computation of the SoR-MAC-IAUSF. The counter is used as freshness input into SoR-MAC-IAUSF and SoR-MAC-IUE derivations, to mitigate the replay attack.

Further, the AUSF <NUM> shall send the value of the counter along with the SoR-MAC-IAUSF. The UE <NUM> checks the value of the counter and only accept counter value that is greater than stored value. The UE <NUM> shall use the stored counter value received from the HPLMN <NUM>, when deriving the SoR-MAC-IUE for the SoR acknowledgement. The AUSF <NUM> and the UE <NUM>, initializes the counter value to zero (0x00), when the KAUSF is derived and maintains the counter value for lifetime of the KAUSF. The AUSF <NUM>, monotonically increment the counter value for each additional calculated SoR-MAC-IAUSF. The AUSF <NUM> includes the SoR-MAC-IAUSF, counter value and optionally the SoR-MAC-IUE (if requested by the UDM <NUM>) within the service response message to the UDM <NUM>.

At <NUM>, the UDM <NUM> responds to the Nudm_SDM_Get service operation to the AMF <NUM>, which includes the steering information list, the SoR-MAC-IAUSF, and the counter value within the access and mobility subscription data and the indication that the UDM <NUM> requests an acknowledgement from the UE <NUM> (if needed). If the UDM <NUM> requests an acknowledgement and received the SoR-XMAC-IUE from the AUSF <NUM>, then it temporarily stores the expected SoR-XMAC-IUE.

At <NUM>, the AMF <NUM> shall include the steering information list, the SoR-MAC-IAUSF, the counter value and the indication that the UDM <NUM> requests an acknowledgement from the UE <NUM> (if included by the UDM <NUM>) to the UE <NUM> in the registration accept message.

At <NUM>, on receiving the registration accept message, if the UE's USIM is configured with the indication that the UE <NUM> shall expect to receive the steering of roaming information in the registration accept which is in response to the initial registration request, then the UE <NUM> shall verify, if the steering of roaming information is received in the initial registration accept message, if steering of roaming information is not available then it is considered as security check fails. If the steering of roaming information is received in the registration accept message then the UE <NUM> calculates the SoR-MAC-IAUSF (can be termed as expected MAC-I and also "SoR-XMAC-IAUSF") in the same way as the AUSF <NUM> on the received steering of roaming information, the counter value and the acknowledge indication and verifies whether it matches the SoR-MAC-IAUSF value received in the registration accept message. If either the steering of roaming information is not received, even though UE's USIM is configured with the indication that steering of roaming information shall mandatorily be received in the initial registration accept message or steering of roaming information received but SoR-MAC-IAUSF (SoR-XMAC-IAUSF) calculated by UE and the SoR-MAC-IAUSF received in the registration accept message do not match (security check fails), then the UE <NUM> shall perform the PLMN selection procedure to select some other PLMN by making the currently camped VPLMN as lower priority PLMN and also mark that there was an SoR failure on the current VPLMN. The UE <NUM> is expected to perform PLMN selection, following general principles when the UE <NUM> is allowed to do PLMN selection i.e. only if the UE <NUM> is not in Manual mode of operation and current PLMN is not part of "User Controlled PLMN Selector with Access Technology". In order to avoid errors in the received steering of roaming information if the security check fails (either the UE <NUM> is configured in the USIM that the UE <NUM> is expected to receive the steering of roaming information but did not receive the steering of information in the initial registration accept message or the SoR-MAC-IAUSF (SoR-XMAC-IAUSF: expected MAC-I) calculated by the UE <NUM> and the SoR-MAC-IAUSF received in the registration accept message do not match) as described above from all the available PLMNs(i.e. all the available PLMNs are part of list where registration was aborted due to SoR verification failure as described above) in that area, then the UE <NUM> shall neglect the verification failure and continue with the registration procedure to get normal services. If the security check is successful (SoR-MAC-IAUSF (SoR-XMAC-IAUSF) calculated by the UE <NUM> and the SoR-MAC-IAUSF received in the registration accept message are the same) and acknowledgement is not requested in the steering of roaming information, the UE <NUM> determines based on available PLMN list of the area that there is a higher priority PLMN than currently camped chosen VPLMN then the UE <NUM> can release the NAS signaling connection locally and perform PLMN selection to acquire services of higher priority PLMN available as per steering of roaming information received in the registration accept message. If acknowledgement is requested in the steering of roaming information, the UE <NUM> determines based on available PLMN list of the area that there is a higher priority PLMN than currently camped chosen VPLMN then the UE <NUM> perform the PLMN selection to acquire services of higher priority PLMN available as per steering of roaming information received in the registration accept message after sending registration complete message or the UE <NUM> shall wait for release of the NAS signaling connection till implementation dependent timer, if the timer expires release the NAS signaling connection locally before performing PLMN selection. In this case the UE <NUM> shall take care that it does not initiate PDU session establishment.

At <NUM>, if the UDM <NUM> has requested an acknowledgement from the UE <NUM> and the UE <NUM> verified (security check is successful) that the steering of roaming information list has been provided by the HPLMN <NUM> in step <NUM>, then the UE <NUM> shall send the registration complete message to the serving AMF <NUM>. The UE <NUM> shall generate the SoR-MAC-IUE and includes the generated SoR-MAC-IUE in a transparent container in the registration complete message. The SoR-MAC-IUE is calculated by the UE <NUM> in the same way as the AUSF <NUM> using the key KAUSF, counter value, Acknowledge indication (0x01) and other possible parameters as input to the KDF.

At <NUM>, the AMF <NUM> sends a Nudm_SDM_lnfo request message to the UDM <NUM>. If the transparent container with the SoR-MAC-IUE is received in the registration complete message, the AMF <NUM> shall include the transparent container in the Nudm_SDM_lnfo request message.

At <NUM>, if the HPLMN <NUM> indicated that the UE <NUM> is to acknowledge the successful security check of the received steering information list in step <NUM>, then the UDM <NUM> shall compare the received SoR-MAC-IUE with the expected SoR-XMAC-IUE that the UDM stored temporarily in step <NUM>. It is possible for the HPLMN <NUM> to encrypt the List using the HPLMN specific key and other possible parameter and provide it to the UE <NUM> at <NUM> and the UE <NUM> to decrypt the list at <NUM>, in addition to the integrity protection.

<FIG> is a sequence flow diagram illustrating step by step procedures for providing the list of preferred PLMN list during an Extensible Authentication Protocol (EAP) based primary authentication in the wireless communication network, according to embodiments as disclosed herein.

At <NUM>, the UE <NUM> sends the register request to the AMF <NUM>. At <NUM>, The AMF <NUM> sends the request to the AUSF <NUM> to perform the primary authentication.

At <NUM>, the AUSF <NUM> sends a request to the UDM <NUM>/ARPF to provide the AV to carry out the authentication. At <NUM>, based on the HPLMN policy, the UDM <NUM>/ARPF decides to add the preferred PLMN and RAT list along with the AV(s). At <NUM>, the UDM <NUM>/ARPF provides the AV(s) with the PLMN and RAT list.

At <NUM>, in an embodiment, when the AUSF <NUM> receives the PLMN and RAT list, the AUSF <NUM> derives the security keys (e.g., KH-int and/or KH-enc) to protect the PLMN and RAT list. The KH-int and/or KH-enc is derived using at least one of the following parameters: KAUSF, Algorithm type distinguishers, Algorithm identity, Home Network Identity (MNC+MCC) and other possible parameters. The derivation of the initial key (i.e., KH-int) is illustrated in the <FIG> and the derivation of the encrypted key (KH-ent) is illustrated in the <FIG>.

In an embodiment, the new algorithm type distinguisher is defined for the HPLMN Integrity protection (for example, N-Home-int-alg) and/or for encryption (for example, N-Home-enc-alg). In another embodiment, the existing NAS Algorithm type distinguisher is reused for the HPLMN Integrity protection (for example, N-NAS-int-alg) and/or for encryption (for example, N-NAS-enc-alg).

In an embodiment, the algorithm(s) to be used for protection (Integrity Protection and/or encryption) of the PLMN and RAT list is pre-configured in the UE <NUM> (in an example, in the UICC provided by the HPLMN <NUM> and/or as part of NAS configuration) by the HPLMN <NUM>. In another embodiment, the algorithm(s) to be used by the UE <NUM> for verification of the integrity and decryption of the preferred PLMN and RAT list is included along with the preferred PLMN and RAT list. The algorithm identifier values are provided in the Table <NUM>- Table <NUM>. The derivation of MAC-I/XMAC-I on the PLMN and RAT list is illustrated in the <FIG>.

At <NUM>, the AUSF <NUM> sends the <NUM>-AIA message over the N12 to the SEAF <NUM>. In the <NUM>-AIA message, the AUSF <NUM> includes the integrity protected preferred PLMN and RAT list (includes the MAC-I) to the AMF <NUM>/SEAF <NUM>, using the HPLMN key the KAUSF (may derives further key using the key KAUSF and also encrypts the list, if supported). Based on the HPLMN policy, the HPLMN <NUM> includes the protected preferred PLMN and RAT list in the <NUM>-AIA message and for the VPLMN to provide PLMN and RAT list from the HPLMN <NUM> in the authentication request. When the AUSF <NUM> receives the PLMN list from the UDM <NUM>, the AUSF <NUM> protects the PLMN list before sending the PLMN list to the UE <NUM> via the AMF <NUM>/SEAF <NUM>.

In an embodiment, the input parameters to the integrity algorithm (NIA) are PLMN and RAT list, Integrity protection key (for example, KH-int) derived from key, KAUSF, RAND (one of the parameter in the AV) and other possible parameters (for example, length of the list LENGTH, NONCE, like so). The RAND and/or NONCE are used to derive cryptographic separate MAC for each derivation corresponding to the AV. Based on these input parameters, the AUSF <NUM> computes a message authentication code (MAC-I) using the integrity algorithm NIA. The message authentication code is then appended to the message when sent. The UE <NUM> computes the expected message authentication code on the message received in the same way as the AUSF <NUM> computed its message authentication code on the message sent and verifies the data integrity of the message by comparing it to the received message authentication code.

In another embodiment, the input parameters to the integrity algorithm (NIA) are PLMN and RAT list, Integrity protection key using the authentication Key K_aut (derived from the Transient EAP Key (TEK)) and other possible parameters (for example, length of the list LENGTH, NONCE, like so). The RAND and/or NONCE are used to derive cryptographic separate MAC-I for each derivation corresponding to the AV.

In an embodiment, the input parameters to the ciphering algorithm (NEA) encryption key (for example, KH-enc) derived from Key KAUSF, RAND (one of the parameter in the AV) and other possible parameters (for example, length of the list LENGTH, NONCE, like so). The RAND and/or NONCE are used to derive cryptographic separate Key Streams for each derivation corresponding to the AV. The ciphering of the network steering information is illustrated as shown in the <FIG>.

In an embodiment, the counter COUNT is used as one of the input parameter to the algorithm and COUNT is included along with the message, so that the receiver will use the COUNT value for decryption.

In an embodiment, the input parameters to the ciphering algorithm (NEA) are encryption key using the encryption key K_encr (derived from the Transient EAP Key (TEK)) and other possible parameters (for example, length of the list LENGTH, NONCE, or the like).

In another embodiment, the AUSF <NUM> generates a new KAUSF Key Set Identifier (for example, ngKSlausf) to identify the KAUSF. Subscription Permanent Identifier (SUPI) along with the KAUSF Key Set Identifier uniquely identifies the KAUSF of the UE <NUM>. The AUSF <NUM> provides the KAUSF Key Set Identifier along with the AV to the UE <NUM> via the AMF <NUM>/SEAF <NUM>. The AMF <NUM>/SEAF <NUM> may store KAUSF Key Set Identifier along with ngKSI.

In an embodiment, the sequence Number of the AV and/or RAND of the AV and the SUPI uniquely identifies the KAUSF of the UE <NUM>.

In another embodiment, the protected PLMN and RAT list are provided to the UE <NUM> using the EAP(Extensible Authentication Protocol)-Request/AKA(Authentication and Key Agreement)-Notification mechanism.

In an embodiment, the protected PLMN and RAT list along with the security parameters (for example, MAC-I, like so) are provided (encoded) in a vendor specific (for example, 3GPP) Type, Length, Value format.

At <NUM>, the AMF <NUM>/ the SEAF <NUM> sends the received protected PLMN list(s) transparently to the UE <NUM> over the NAS message (i.e., authentication request message). In an embodiment, the AMF <NUM>/SEAF <NUM> selects the AV, if receives multiple AVs, and sends the corresponding protected PLMN list(s) transparently to the UE <NUM> in the NAS message.

At <NUM>, based on the configuration of the UE <NUM>, the UE <NUM> expects the protected PLMN and RAT list in the authentication request message. If the configuration indicates mandatory check for preferred PLMN and RAT list, then the UE <NUM> verifies the integrity of the received PLMN and RAT list, by deriving the key in the same way as the AUSF.

At 10a, the UE <NUM> sends the authentication reject message to the VPLMN <NUM>, if the security check is failed. At 10b, the UE <NUM> performs the PLMN selection, if the protected PLMN and RAT list is missing or verification fails.

At 11a, in another embodiment, the UE <NUM> sends the authentication reject message to the VPLMN <NUM>, if the protected PLMN and RAT list verification of integrity is successful, but the serving PLMN is not the preferred PLMN/RAT in the received list. At 11b, the UE <NUM> performs the PLMN selection considering the PLMN list is provided by the HPLMN <NUM>.

At <NUM>, In an embodiment, the UE <NUM> sends the authentication response message to the SEAF <NUM> over the NAS message, if the protected list verification of integrity is successful and the serving PLMN is in the preferred PLMN/RAT in the received list or no preferred PLMN available in that particular area.

<FIG> is a sequence flow diagram illustrating step by step procedures for providing the list of preferred PLMN list when the UE <NUM> is already registered with the VPLMN <NUM>, according to embodiments as disclosed herein. Consider, when the UE <NUM> is already registered with the VPLMN <NUM> and the HPLMN <NUM> wants to update the preferred PLMN/access technology combinations to the UE <NUM>.

At <NUM>, the UDM <NUM> of the HPLMN <NUM> decides to update preferred PLMN/access technology combinations in the UE <NUM>. At <NUM>, The UDM <NUM> sends the Nudm_SubData_UpdateNotif message to the AUSF <NUM> which includes preferred PLMN/access technology combinations.

At <NUM>, the AUSF <NUM> sends Nausf_Initiate_Auth request message to the AMF <NUM> with parameters same as the <NUM>-AIR message. The preferred PLMN/access technology combinations are protected using the latest AV received from the UDM <NUM>/ARPF and which will be included in the Nausf_Initiate_Auth request message.

At <NUM>, the AMF <NUM> sends the authentication request message transparently carrying the protected preferred PLMN/access technology combinations along with other existing parameters of authentication request message.

At <NUM>, the UE <NUM> performs integrity check (and/or decryption) on the received protected preferred PLMN/access technology combinations. If check is not successful then, the UE <NUM> proceeds with PLMN selection procedure. If check is successful in step <NUM> then the UE <NUM> responds with authentication response message carrying the protected acknowledgement IE.

At <NUM>, the AMF <NUM> sends the Nausf Initiate_Auth_Resp message to the AUSF <NUM>. This message carries protected acknowledgement IE. The AUSF <NUM> performs a security check of acknowledgement IE.

At <NUM>, The AMF <NUM> sends Nudm_SubData_UpdateNotif_Resp to the UDM <NUM> which indicates if protected acknowledgement IE has passed or failed the security check. In general, the AUSF <NUM> and the UDM <NUM> will determine whether the AUSF <NUM> and the UDM <NUM> sent preferred PLMN/access technology combinations was updated to the UE <NUM> successfully or not. Otherwise HPLMN <NUM> may re-try the procedure.

In an embodiment, when the UE <NUM> receives preferred PLMN/access technology combination and passes the integrity protection (or ciphering) check. Then, the UE <NUM> shall proceed with registration procedure (so that VPLMN <NUM> can continue with the registration procedure) message in any of the following cases:.

In an embodiment, when the UE <NUM> receives preferred PLMN/access technology combination and passes the integrity protection (or ciphering) check. Then, the UE <NUM> shall not proceed with registration procedure message instead UE <NUM> shall indicate AMF <NUM> (with reject cause or new IE) over the NAS message (e.g., authentication response message or authentication reject message or authentication failure message) to release the existing NAS N1 signaling connection or the UE <NUM> can do a local release of the NAS N1 signaling connection, in any of the following cases:
The UE <NUM> does not have the available PLMN list (i.e. the list of available PLMN's in the area). The UE <NUM> have the available PLMN list (i.e. the UE <NUM> had searched for available PLMN's in the area) and there is the VPLMN <NUM> which is more preferred than current VPLMN <NUM> after comparing available PLMN list to the latest received preferred PLMN/access technology combination.

In an embodiment, after receiving or locally releasing the NAS signaling connection, the UE <NUM> shall perform PLMN selection as if timer T (refer 3GPP TS <NUM>) has expired.

In yet another embodiment, for any time update of preferred PLMN/access technology combination, the HPLMN <NUM> can initiate detach message (or any NAS message) which will force the VPLMN <NUM> to delete the available Authentication Vectors and indicate to the UE <NUM> to initiate the NAS message (initial registration request procedure) by setting the KSI to a value which will force the VPLMN <NUM> to initiate the authentication procedure. Now, the VPLMN <NUM> will contact the HPLMN <NUM> to get the fresh Authentication Vectors (AVs) in the process, and the UE <NUM> will also receive preferred PLMN/access technology combination as part of NAS message(registration accept).

In yet another embodiment, if the UE <NUM> moves on a VPLMN <NUM> which is not part of preferred PLMN/access technology combination (OPLMN list of the UE <NUM>) and the UE <NUM> registers with such VPLMN <NUM> without executing the authentication procedure (or if the preferred PLMN/access technology combination is not received) and the UE <NUM> moves to an IDLE mode, then the UE <NUM> shall set the ngKSI (or an indication) in the NAS message (e.g., Initial direct transfer NAS messages or the like) which will force the VPLMN <NUM> to reinitiate authentication procedure and get fresh authentication vectors from the HPLMN <NUM>.

In yet another embodiment, if the UE <NUM> moves on the VPLMN <NUM> which is not part of preferred PLMN/access technology combination (OPLMN list of the UE <NUM>) and the UE <NUM> registers with such VPLMN <NUM> without executing the authentication procedure (or if the preferred PLMN/access technology combination is not received) and the UE <NUM> moves to an IDLE mode, then the UE <NUM> shall re-initiate the NAS message (e.g., Initial Registration procedure or the like) which will force the VPLMN <NUM> to get the preferred PLMN list from the HPLMN <NUM> and mandatorily provide the preferred PLMN list to the UE <NUM>.

In an embodiment, the IE of preferred PLMN/access technology combination can be made mandatory in the NAS message (for example, during initial registration accept message) (optionally through the UE configuration like USIM or MO Object etc). Now even if the HPLMN <NUM> doesn't want to update the UE <NUM> with fresh preferred PLMN/access technology combination, the HPLMN <NUM> shall send the IE to indicate size of PLMN/access technology combination is zero (or a value to indicate there is no new list is available). This IE has to be protected. This guarantees to the UE <NUM> that the VPLMN <NUM> has not removed or modified the preferred PLMN/access technology combination information and indicates to use the stored OPLMN list in the UE <NUM>.

In an embodiment, the preferred PLMN list or PLMN list is a list of PLMN's on which the UE <NUM> is preferred to be roamed by the HPLMN <NUM> in the current physical location of the UE <NUM>. This list can be in the form of operator preferred PLMN list etc. The term preferred PLMN list and PLMN list are used interchangeably and means the same.

In another embodiment, for all the procedures discussed in the disclosure, if the UE <NUM> detects that the PLMN list received is distorted then, the UE <NUM> shall perform PLMN selection and select some other PLMN on which the UE <NUM> shall perform its registration procedure or preferred PLMN list fetch procedure.

In an embodiment, the UE <NUM> detects that received PLMN list is distorted from the VPLMN <NUM> can be after executing some retries to avoid any abnormal situation. Otherwise, when the UE <NUM> detects the received PLMN list fails to get decrypted (or fails in Integrity check) it can indicate to the VPLMN <NUM> so that the VPLMN <NUM> can freshly execute the procedure and get the preferred PLMN list again from the HPLMN <NUM>. If the process fails again or after multiple retries, the UE <NUM> shall perform PLMN selection to select some other PLMN.

In an embodiment, the preferred PLMN list fetch procedure is a synonym to any NAS procedure which will be executed to indicate to the VPLMN <NUM> that the UE <NUM> wants to obtain the protected preferred PLMN list in current UE location from the HPLMN <NUM>.

<FIG> illustrates a sequence of operations for a data path solution (DPS), according to an embodiment as disclosed herein. The UE <NUM> which is registered with the roaming PLMN can send the list of available PLMN (optional) and available preferred PLMN list (optional) to the home PLMN using the HTTP over the data channel and this can be achieved by sending the data using a network customized application or the URL. The HPLMN <NUM> can then respond to the HTTP request from the UE <NUM> with the list of the preferred PLMNs and the UE <NUM> can consider the OPLMN list changed and act as per 3GPP section (i.e., <NUM>). The security of the HTTP packet can be enhanced using HTTPs over IPSec etc. and if the HTTP request fails (Due to DNS failure or HTTP failure etc), the UE <NUM> can decide to move to a different PLMN after x tries where 'x' is configurable by customer. The UE <NUM> registers with a Roaming PLMN successfully and establishes a PS context. Further, the UE <NUM> can send periodically (say once in 24hrs) in the roaming area. The UE <NUM> registers with PLMN not part of preferred PLMN list currently configured in the SIM card and triggers the request from the operator asking electronic device to initiate the HTTP request.

<FIG> is a block diagram of the UE <NUM>, according to an embodiment as disclosed herein. In an embodiment, the UE <NUM> includes a preferred PLMN list determiner <NUM>, a communicator <NUM>, a memory <NUM> and a processor <NUM>. The processor <NUM> is communicated with the preferred PLMN list determiner <NUM>, the communicator <NUM>, and the memory <NUM>.

In an embodiment, the preferred PLMN list determiner <NUM> is configured to send the initial register request message to the VPLMN <NUM>. Further, the preferred PLMN list determiner <NUM> is configured to receive the response message from the VPLMN <NUM> in response to the initial register request message. The initial register request message mandates the VPLMN <NUM> to send the preferred PLMN list in the response message. Further, the preferred PLMN list determiner <NUM> is configured to verify whether the response message includes the preferred PLMN list provided by the HPLMN <NUM>, the VPLMN <NUM> mandatorily sent the preferred PLMN list transparently and the security check is successful on the received preferred PLMN list using the at least one HPLMN specific security key. Further, the preferred PLMN list determiner <NUM> is configured to send the reject message to the VPLMN <NUM> for a NAS signaling connection release and perform the PLMN selection procedure when the security check is failed, or perform a local NAS signaling connection release and perform the PLMN selection procedure when the verification is failed or send the accept message to the VPLMN <NUM> when the verification is successful.

In another embodiment, the preferred PLMN list determiner <NUM> is configured to pre-configure the HTTP link to contact the home network. Further, the preferred PLMN list determiner <NUM> is configured to identify that the UE <NUM> is in a non-HPLMN network. Further, the preferred PLMN list determiner <NUM> is configured to trigger a HTTPS request using a stored HTTP link address. Further, the preferred PLMN list determiner <NUM> is configured to receive the HTTPS response message carrying the preferred PLMN list.

Further, the processor <NUM> is configured to execute instructions stored in the memory <NUM> and to perform various processes. The communicator <NUM> is configured for communicating internally between internal hardware components and with external devices via one or more networks. The communicator <NUM> is configured for communicating with the preferred PLMN list determiner <NUM> to manage the anti-steering of roaming in the wireless communication network.

The memory <NUM> also stores instructions to be executed by the processor <NUM>. The memory <NUM> may include non-volatile storage elements. Examples of such non-volatile storage elements may include magnetic hard discs, optical discs, floppy discs, flash memories, or forms of electrically programmable memories (EPROM) or electrically erasable and programmable (EEPROM) memories. In addition, the memory <NUM> may, in some examples, be considered a non-transitory storage medium. The term "non-transitory" may indicate that the storage medium is not embodied in a carrier wave or a propagated signal. However, the term "non-transitory" should not be interpreted that the memory <NUM> is non-movable. In some examples, the memory <NUM> can be configured to store larger amounts of information than the memory. In certain examples, a non-transitory storage medium may store data that can, over time, change (e.g., in Random Access Memory (RAM) or cache).

Although the <FIG> shows various hardware components of the UE <NUM> but it is to be understood that other embodiments are not limited thereon. In other embodiments, the UE <NUM> may include less or more number of components. Further, the labels or names of the components are used only for illustrative purpose and does not limit the scope of the invention. One or more components can be combined together to perform same or substantially similar function to manage the anti-steering of roaming in the wireless communication network.

<FIG> is a flow diagram <NUM> illustrating various operations performed, by the UE <NUM>, for managing anti-steering of roaming in the wireless communication network, according to an embodiment as disclosed herein. The operations (<NUM>-<NUM>) are performed by the preferred PLMN list determiner <NUM>.

At <NUM>, the method includes sending the initial register request message to the VPLMN <NUM>. At <NUM>, the method includes receiving the response message from the VPLMN <NUM>. At <NUM>, the method includes verifying whether the response message includes the preferred PLMN list provided by the HPLMN <NUM>, and the VPLMN <NUM> mandatorily sent the preferred PLMN list transparently to the UE, and a security check is successful on the received preferred PLMN list using at least one HPLMN specific security key. At <NUM>, the method includes sending the reject message to the VPLMN <NUM> for the NAS signaling connection release and performing the PLMN selection procedure, when the verification is failed. At <NUM>, the method includes performing the local NAS signaling connection release and performing the PLMN selection procedure when the verification is failed. At <NUM>, the method includes sending the accept message to the VPLMN <NUM>, when the verification is successful.

The various actions, acts, blocks, steps, or the like in the flow diagram <NUM> may be performed in the order presented, in a different order or simultaneously. Further, in some embodiments, some of the actions, acts, blocks, steps, or the like may be omitted, added, modified, skipped, or the like without departing from the scope of the invention.

<FIG> is a flow diagram <NUM> illustrating various operations performed, by the HPLMN <NUM>, for managing anti-steering of roaming in the wireless communication network, according to an embodiment as disclosed herein. The operations (<NUM>-<NUM>) are performed by the HPLMN <NUM>.

At <NUM>, the method includes obtaining the register request message from the VPLMN <NUM>. At <NUM>, the method includes deriving the at least one HPLMN specific security key based on the at least one security parameter. At <NUM>, the method includes protecting the preferred PLMN list using the at least one security parameter and the HPLMN specific security key. At <NUM>, the method includes sending the protected preferred PLMN list to the VPLMN <NUM>.

Claim 1:
A method performed by a user equipment, UE, in a wireless communication system, the method comprising:
sending a registration request message to an access and mobility management function, AMF, in a visited public land mobile network, VPLMN;
receiving a registration accept message from the AMF in the VPLMN; and
characterized in
selecting a PLMN other than the VPLMN in case that a preferred PLMN list is not received in the registration accept message,
wherein a universal subscriber identity module, USIM, of the UE is configured with an indication that the UE is to receive the preferred PLMN list.