Patent ID: 12225622

DETAILED DESCRIPTION

References in the specification to “one embodiment,” “an embodiment,” “an example embodiment,” and the like indicate that the embodiment described may include a particular feature, structure, or characteristic, but it is not necessary that every embodiment includes the particular feature, structure, or characteristic. Moreover, such phrases are not necessarily referring to the same embodiment. Further, when a particular feature, structure, or characteristic is described in connection with an embodiment, it is submitted that it is within the knowledge of one skilled in the art to affect such feature, structure, or characteristic in connection with other embodiments whether or not explicitly described.

It shall be understood that although the terms “first” and “second” etc. may be used herein to describe various elements, these elements should not be limited by these terms. These terms are only used to distinguish one element from another. For example, a first element could be termed a second element, and similarly, a second element could be termed a first element, without departing from the scope of example embodiments. As used herein, the term “and/or” includes any and all combinations of one or more of the associated listed terms. The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be liming of example embodiments. As used herein, the singular forms “a”, “an” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms “comprises”, “comprising”, “has”, “having”, “includes” and/or “including”, when used herein, specify the presence of stated features, elements, and/or components etc., but do not preclude the presence or addition of one or more other features, elements, components and/or combinations thereof.

In the following description and claims, unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skills in the art to which this disclosure belongs.

As discussed above, an AMF node can forward trace requirement data for a UE as received from a UDM node to an AUSF node, e.g., in a UE Authentication Request. As shown in Table 1 above, the UE Authentication Request also includes a subscriber identifier, e.g., SUPI or SUCI. However, the AUSF would not be able to trace an equipment identifier of the UE if it is not aware of the equipment identifier of the UE.

FIG.1is a flowchart illustrating a method100for tracing a UE according to an embodiment of the present disclosure. The method100can be performed at in an authentication node, e.g., an AUSF node.

At block110, a tracing activation instruction to activate tracing the UE based on an equipment identifier of the UE is received. The tracing activation instruction can be received from a management system of an operator, e.g., an Operation, Administration and Maintenance (OAM) system. The equipment identifier can be a PEI of the UE.

At block120, trace requirement data associated with the UE is obtained.

At block130, a first signaling message containing the equipment identifier (e.g., PEI) of the UE is received from a network node. In an example, the network node can be an AMF node and the first signaling message can be a UE Authentication Request. In particular, the UE Authentication Request can be transmitted from a SEcurity Anchor Function (SEAF) in the AMF node. For example, AuthenticationInfo defined in Table 1 can be extended to include a PEI, as shown in Table 2 below:

TABLE 2Definition of type AuthenticationInfoAttribute nameData typePCardinalityDescriptionsupiOrSuciSupiOrSuciM1Contains the SUPI or SUCI of the UE.servingNetworkNameServingNetworkNameM1Contains the Serving Network Name.resynchronizationInfoResynchronizationInfoO0 . . . 1Contains RAND and AUTS; see3GPP TS 33.501 subclause 9.4.PeiPeiO0 . . . 1Permanent Equipment IdentifiertraceDataTraceDataO0 . . . 1Contains TraceData provided by theUDM to the AMF

It can be appreciated that the authentication node may obtain the equipment identifier (e.g., PEI) of the UE from any other appropriate network node in any other appropriate signaling message, such that it can trace the equipment identifier of the UE accordingly.

For example, in the block120, the trace requirement data may be obtained from the tracing activation instruction received in the block110. Alternatively or additionally, the trace requirement data may be obtained from the first signaling message received in the block130. As discussed above, the UE Authentication Request transmitted from the AMF node to the AUSF node may carry the trace requirement data (i.e., “traceData” as shown in Table 1), which can be retrieved by the AMF node from subscription data for the UE from a UDM node. The data structure of “traceData” as shown in Table 1 can also be used when the trace requirement data is carried in the tracing activation instruction. For example, the trace requirement data may have a data structure defined in Table 3 below:

TABLE 3Definition of traceDataAttribute nameData typePCardinalityDescriptiontraceRefstringM1Trace Reference (see 3GPP TS 32.422 [19]).It shall be encoded as the concatenation of MCC,MNC and Trace ID as follows:<MCC><MNC>-<Trace ID>The Trace ID shall be encoded as a 3 octet string inhexadecimal representation. Each character in theTrace ID string shall take a value of “0” to “9” or “A”to “F” and shall represent 4 bits. The most significantcharacter representing the 4 most significant bits ofthe Trace ID shall appear first in the string, and thecharacter representing the 4 least significant bit ofthe Trace ID shall appear last in the string.Pattern: ‘{circumflex over ( )}[0-9]{3}[0-9]{2,3}-[A-Fa-f0-9]{6}$’traceDepthTraceDepthM1Trace Depth (see 3GPP TS 32.422 [19]).neTypeListstringM1List of NE Types (see 3GPP TS 32.422 [19]).It shall be encoded as an octet string in hexadecimalrepresentation. Each character in the string shalltake a value of “0” to “9” or “A” to “F” and shallrepresent 4 bits. The most significant characterrepresenting the 4 most significant bits shall appearfirst in the string, and the character representing the4 least significant bit shall appear last in the string.Octets shall be coded according to3GPP TS 32.422 [19].Pattern: ‘{circumflex over ( )}[A-Fa-f0-9]+$’eventListstringM1Triggering events (see 3GPP TS 32.422 [19]).It shall be encoded as an octet string in hexadecimalrepresentation. Each character in the string shalltake a value of “0” to “9” or “A” to “F” and shallrepresent 4 bits. The most significant characterrepresenting the 4 most significant bits shall appearfirst in the string, and the character representing the4 least significant bit shall appear last in the string.Octets shall be coded according to3GPP TS 32.422 [19].Pattern: ‘{circumflex over ( )}[A-Fa-f0-9]+$’collectionEntityIpv4AddrIpv4AddrC0 . . . 1IPv4 Address of the Trace Collection Entity (see3GPP TS 32.422 [x).At least one of the collectionEntitylpv4Addr orcollectionEntityIpv6Addr attributes shall be present.collectionEntityIpv6AddrIpv6AddrC0 . . . 1IPv6 Address of the Trace Collection Entity (see3GPP TS 32.422 [x).At least one of the collectionEntityIpv4Addr orcollectionEntityIpv6Addr attributes shall be present.interfaceListstringO0 . . . 1List of Interfaces (see 3GPP TS 32.422 [19]).It shall be encoded as an octet string in hexadecimalrepresentation. Each character in the string shalltake a value of “0” to “9” or “A” to “F” and shallrepresent 4 bits. The most significant characterrepresenting the 4 most significant bits shall appearfirst in the string, and the character representing the4 least significant bit shall appear last in the string.Octets shall be coded according to3GPP TS 32.422 [19].If this attribute is not present, all the interfacesapplicable to the list of NE types indicated in theneTypeList attribute should be traced.Pattern: ‘{circumflex over ( )}[A-Fa-f0-9+]$’

For further details of Table 3, reference can be made to Table 5.6.4.1-1 in 3GPP TS 29.571 V15.3.0, which is incorporated herein by reference in its entirety.

At block140, a trace record related to the UE is generated based on the trace requirement data in response to receiving the first signaling message, or in other words, in response to determining that the equipment identifier contained in the first signaling message is same as the equipment identifier contained in the tracing activation instruction.

In an example, the trace requirement data may indicate, among others, one or more triggering events, and/or one or more interfaces associated with the authentication node. That is, the trace requirement data may indicate that the authentication node is to record information related to one or more signaling messages associated with each triggering event over each interface required by the trace requirement data. For example, the one or more triggering events may include a triggering event associated with UE authentication (for Nausf_UEAuthentication service), a triggering event associated with SoR Protection (for Nausf_SoRProtection service), and/or a triggering event associated with UPU Protection (for Nausf_UPUProtection service). The one or more interfaces may include an interface between the authentication node and the AMF node (the interface between the AUSF node and the AMF node is known as N12), and/or an interface between the authentication node and a UDM node (the interface between the AUSF node and the UDM node is known as N13).

In the block140, a trace record related to one or more signaling messages associated with one of the one or more triggering events and transmitted or received over one of the one or more interfaces can be generated. For example, when the trace requirement data indicates the triggering event associated with UE authentication and the interface N12, the authentication node can generate a trace record containing information related to the UE Authentication Request and subsequent signaling messages for UE Authentication over N12. For instance, when the trace requirement data further indicates a trace depth of “maximum”, the trace record may include the raw messages of the UE Authentication Request and the subsequent signaling messages. As another example, when the trace requirement data indicates the triggering event associated with UE authentication and the interfaces N12 and N13, the authentication node can generate a trace record containing information related to each signaling message for UE Authentication over N12 and N13.

In an example, the first signaling message (e.g., UE Authentication Request) may further contain a subscriber identifier, e.g., a SUPI or SUCI. The authentication node may store the equipment identifier in association with the subscriber identifier. Then, when receiving a signaling message that is associated with one of the one or more triggering events indicated in the trace requirement data and is transmitted or received over one of the one or more interfaces indicated in the trace requirement data, and determining that the signaling message contains a subscriber identifier that is same as the subscriber identifier associated with the equipment identifier, the authentication node can generate a trace record related to the signaling message. That is, even if the signaling message does not contain any equipment identifier, information related to the signaling message can be recorded for the purpose of equipment tracing as long as it contains the subscriber identifier that has been associated with the equipment identifier to be traced, e.g., in the UE authentication process, at the authentication node.

In an example, when the tracing activation instruction further contains an indication of a report period, the authentication node can report the trace record to a trace collection entity indicated in the trace requirement data at the report period. Alternatively, the authentication node can report the trace record to a trace collection entity indicated in the trace requirement data in response to receiving, e.g., from an OAM system, a tracing deactivation instruction to deactivate the tracing of the UE.

FIG.2is a flowchart illustrating a method200for facilitating tracing of a UE at an authentication node according to an embodiment of the present disclosure. The method200can be performed at a network node, e.g., an AMF node, or particularly SEAF in the AMF node, and the authentication node can be an AUSF node.

At block210, a UE Authentication Request containing an equipment identifier of the UE is transmit to the authentication node. For example, the equipment identifier can be a PEI. The UE Authentication Request may correspond to the first signaling message received by the authentication node in the block130ofFIG.1. As a result, the authentication node is provided with the equipment identifier of the UE and thus enabled to trace the UE based on its equipment identifier.

As described above in connection withFIG.1, the UE Authentication Request may further include trace requirement data for tracing of the UE. The trace requirement data can be retrieved from subscription data for the UE from a UDM node.

In the following, the above methods100and200will be further explained with reference to a sequence diagram ofFIG.3, which shows a UE tracing procedure according to an embodiment of the present disclosure

As shown inFIG.3, at3.1, an AUSF node receives from an OAM system a Trace Session Activation containing a PEI of a UE, for activating tracing of the UE based on the PEI at the AUSF node. The Trace Session Activation may include trace requirement data and optionally a report period. Next, a UE authentication process will be performed. While in this example the UE authentication process is based on 5G-AKA, an EAP-based authentication process can be used as an alternative. At3.2, an AMF node receives a registration request from a UE. At3.3, the AMF node (or particularly SEAF in the AMF node) sends a UE Authentication Request to the AUSF node. The UE Authentication Request contains a PEI of the UE, a SUPI or SUCI, and optionally trace requirement data. In this example, it is assumed that the trace requirement data received by the AUSF node at3.1or3.3may indicate:traceRef: 123-456-ID1,traceDepth: Maximum,neTypeList: AUSF,eventList: UE Authentication,collectionEntityIpv4Addr: 192.168.1.1,interfaceList: N12, N13.

When the PEI in the UE Authentication Request received at3.3is same as the PEI in the Trace Session Activation, the AUSF node determines that the UE Authentication Request is for the UE to be traced. Moreover, as the UE Authentication Request is associated with the triggering event of UE Authentication and is received over N12, the AUSF node generates a trace record to record information related to the UE Authentication Request. Here, as the trace depth is set to “Maximum”, the raw message of the UE Authentication Request is recorded. At3.4, the AUSF node sends an Authentication Vector Request to a UDM node. As the Authentication Vector Request is also associated with the triggering event of UE Authentication and is transmitted over N13, the AUSF node records information related to the Authentication Vector Request in the trace record. Then, the UE authentication process continues as the UDM node sends a Response to Authentication Vector Request to the AUSF node over N13 at3.5; the AUSF node sends a Response to UE Authentication Request over N12 at3.6; the AMF node sends authentication data to the UE at3.7and receives an Authentication Confirmation at3.8; the AMF node sends a UE Authentication Confirmation to the AUSF over N12 at3.9; the AUSF node sends an Authentication Result Confirmation to the UDM node over N13 at3.10; the AUSF node receives from the UDM node an acknowledgement over N13 at3.11and sends an acknowledgement to the AMF node over N12 at3.12. During this process, the AUSF node records information related to each signaling message transmitted or received over N12 or N13, including the signaling messages transmitted or received at3.5,3.6,3.9,3.10,3.11and3.12, in the trace record. At3.13, the AUSF node receives from the OAM system a Trace Session Deactivation to deactivate the tracing of the UE. At3.14, the AUSF node reports the trace record to a trace collection entity indicated in the trace requirement data. Instead of reporting the trace record in response to the Trace Session Deactivation, the AUSF node may report the trace record periodically in accordance with the period indicated in the Trace Session Activation received at3.1.

Correspondingly to the method100as described above, an authentication node is provided.FIG.4is a block diagram of an authentication node400according to an embodiment of the present disclosure.

As shown inFIG.4, the authentication node400includes a receiving unit410configured to receive a tracing activation instruction to activate tracing of the UE based on an equipment identifier of the UE. The authentication node400further includes an obtaining unit420configured to obtain trace requirement data associated with the UE. The receiving unit410is further configured to receive from a network node a first signaling message containing the equipment identifier of the UE. The authentication node400further includes a generating unit430configured to generate a trace record related to the UE based on the trace requirement data in response to receiving the first signaling message.

In an embodiment, the trace requirement data may be obtained from the tracing activation instruction.

In an embodiment, the trace requirement data may be obtained from the first signaling message.

In an embodiment, the network node may be an AMF node and the first signaling message may be a UE Authentication Request.

In an embodiment, the trace requirement data may indicate: one or more triggering events, and/or one or more interfaces associated with the authentication node.

In an embodiment, the generating unit430can be configured to generate a trace record related to one or more signaling messages associated with one of the one or more triggering events and transmitted or received over one of the one or more interfaces.

In an embodiment, the first signaling message may further contain a subscriber identifier. The authentication node400may further include a storage unit configured to store the equipment identifier in association with the subscriber identifier. The generating unit430can be configured to generate a trace record related to a signaling message associated with one of the one or more triggering events and transmitted or received over one of the one or more interfaces, in response to determining that the signaling message contains a subscriber identifier that is same as the subscriber identifier associated with the equipment identifier.

In an embodiment, the subscriber identifier may include a SUPI or SUCI.

In an embodiment, the one or more triggering events may include a triggering event associated with UE authentication, a triggering event associated with Steering of Roaming (SoR) Protection, and/or a triggering event associated with UE Parameter Update (UPU) Protection, and/or the one or more interfaces may include an interface between the authentication node and the AMF node, and/or an interface between the authentication node and a UDM node.

In an embodiment, the tracing activation instruction may further contain an indication of a report period. The authentication node400may further include a reporting unit configured to report the trace record to a trace collection entity indicated in the trace requirement data at the report period.

In an embodiment, the receiving unit410may further be configured to receive a tracing deactivation instruction to deactivate the tracing of the UE. The authentication node400may further include a reporting unit configured to report the trace record to a trace collection entity indicated in the trace requirement data in response to receiving the tracing deactivation instruction.

In an embodiment, the equipment identifier may be a PEI.

In an embodiment, the authentication node may be an AUSF node.

The receiving unit410, the obtaining unit420and the generating unit430can be implemented as a pure hardware solution or as a combination of software and hardware, e.g., by one or more of: a processor or a micro-processor and adequate software and memory for storing of the software, a Programmable Logic Device (PLD) or other electronic component(s) or processing circuitry configured to perform the actions described above, and illustrated, e.g., inFIG.1.

FIG.5is a block diagram of an authentication node500according to another embodiment of the present disclosure.

The authentication node500includes a communication interface510, a processor520and a memory530. The memory530contains instructions executable by the processor520whereby the authentication node500is operative to perform the actions, e.g., of the procedure described earlier in conjunction withFIG.1. Particularly, the memory530contains instructions executable by the processor520whereby the authentication node500is operative to: receive a tracing activation instruction to activate tracing of the UE based on an equipment identifier of the UE; obtain trace requirement data associated with the UE; receive from a network node a first signaling message containing the equipment identifier of the UE; and generate a trace record related to the UE based on the trace requirement data in response to receiving the first signaling message.

In an embodiment, the trace requirement data may be obtained from the tracing activation instruction.

In an embodiment, the trace requirement data may be obtained from the first signaling message.

In an embodiment, the network node may be an AMF node and the first signaling message may be a UE Authentication Request.

In an embodiment, the trace requirement data may indicate: one or more triggering events, and/or one or more interfaces associated with the authentication node.

In an embodiment, the operation of generating may include: generating a trace record related to one or more signaling messages associated with one of the one or more triggering events and transmitted or received over one of the one or more interfaces.

In an embodiment, the first signaling message may further contain a subscriber identifier. The memory530may further contain instructions executable by the processor520whereby the authentication node500is operative to: store the equipment identifier in association with the subscriber identifier. The operation of generating may include: generating a trace record related to a signaling message associated with one of the one or more triggering events and transmitted or received over one of the one or more interfaces, in response to determining that the signaling message contains a subscriber identifier that is same as the subscriber identifier associated with the equipment identifier.

In an embodiment, the subscriber identifier may include a SUPI or SUCI.

In an embodiment, the one or more triggering events may include a triggering event associated with UE authentication, a triggering event associated with Steering of Roaming (SoR) Protection, and/or a triggering event associated with UE Parameter Update (UPU) Protection, and/or the one or more interfaces may include an interface between the authentication node and the AMF node, and/or an interface between the authentication node and a UDM node.

In an embodiment, the tracing activation instruction may further contain an indication of a report period. The memory530may further contain instructions executable by the processor520whereby the authentication node500is operative to: report the trace record to a trace collection entity indicated in the trace requirement data at the report period.

In an embodiment, the memory530may further contain instructions executable by the processor520whereby the authentication node500is operative to: receive a tracing deactivation instruction to deactivate the tracing of the UE; and report the trace record to a trace collection entity indicated in the trace requirement data in response to receiving the tracing deactivation instruction.

In an embodiment, the equipment identifier may be a PEI.

In an embodiment, the authentication node may be an AUSF node.

Correspondingly to the method200as described above, a network node is provided.FIG.6is a block diagram of a network node600according to an embodiment of the present disclosure.

As shown inFIG.6, the network node600includes a transmitting unit610configured to transmit to the authentication node a UE Authentication Request containing an equipment identifier of the UE.

In an embodiment, the UE Authentication Request may further include trace requirement data.

In an embodiment, the network node may be an AMF node, the authentication node may be an AUSF node, and the equipment identifier may be a PEI.

The transmitting unit610can be implemented as a pure hardware solution or as a combination of software and hardware, e.g., by one or more of: a processor or a micro-processor and adequate software and memory for storing of the software, a Programmable Logic Device (PLD) or other electronic component(s) or processing circuitry configured to perform the actions described above, and illustrated, e.g., inFIG.2.

FIG.7is a block diagram of a network node700according to another embodiment of the present disclosure.

The network node700includes a communication interface710, a processor720and a memory730. The memory730contains instructions executable by the processor720whereby the network node700is operative to perform the actions, e.g., of the procedure described earlier in conjunction withFIG.2. Particularly, the memory730contains instructions executable by the processor720whereby the network node700is operative to: transmit to the authentication node a UE Authentication Request containing an equipment identifier of the UE.

In an embodiment, the UE Authentication Request may further include trace requirement data.

In an embodiment, the network node may be an AMF node, the authentication node may be an AUSF node, and the equipment identifier may be a PEI.

The present disclosure also provides at least one computer program product in the form of a non-volatile or volatile memory, e.g., a non-transitory computer readable storage medium, an Electrically Erasable Programmable Read-Only Memory (EEPROM), a flash memory and a hard drive. The computer program product includes a computer program. The computer program includes: code/computer readable instructions, which when executed by the processor520causes the authentication node500to perform the actions, e.g., of the procedure described earlier in conjunction withFIG.1; or code/computer readable instructions, which when executed by the processor720causes the network node700to perform the actions, e.g., of the procedure described earlier in conjunction withFIG.2.

The computer program product may be configured as a computer program code structured in computer program modules. The computer program modules could essentially perform the actions of the flow illustrated inFIG.1or2.

The processor may be a single CPU (Central processing unit), but could also comprise two or more processing units. For example, the processor may include general purpose microprocessors; instruction set processors and/or related chips sets and/or special purpose microprocessors such as Application Specific Integrated Circuit (ASICs). The processor may also comprise board memory for caching purposes. The computer program may be carried by a computer program product connected to the processor. The computer program product may comprise a non-transitory computer readable storage medium on which the computer program is stored. For example, the computer program product may be a flash memory, a Random-access memory (RAM), a Read-Only Memory (ROM), or an EEPROM, and the computer program modules described above could in alternative embodiments be distributed on different computer program products in the form of memories.

The disclosure has been described above with reference to embodiments thereof. It should be understood that various modifications, alternations and additions can be made by those skilled in the art without departing from the spirits and scope of the disclosure. Therefore, the scope of the disclosure is not limited to the above particular embodiments but only defined by the claims as attached.