Patent ID: 12256003

MODE FOR THE INVENTION

Exemplary embodiments of the present invention are described in detail with reference to the accompanying drawings. The same reference numbers are used throughout the drawings to refer to the same or like parts; detailed descriptions of well-known functions and structures incorporated herein may be omitted to avoid obscuring the subject matter of the present invention. Further, the following terms are defined in consideration of the functionality in the present invention and may vary according to the intention of a user or an operator, usage, etc. Therefore, the definition should be made on the basis of the overall content of the present specification.

As used herein, the singular forms “a”, “an”, and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise.

As used herein, ordinal terms such as “first,” “second,” etc. are used to describe various components; however, it is obvious that the components should not be defined by these terms. The terms are used only for distinguishing one component from another component. For example, a first component may be referred to as a second component and, likewise, a second component may also be referred to as a first component, without departing from the teaching of the inventive concept. Also, the expression “and/or” is taken as a specific invention of each and any combination of enumerated things.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used herein, singular forms are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be understood that the terms “comprises” and/or “has” when used in this specification, specify the presence of a stated feature, number, step, operation, component, element, or a combination thereof, but they do not preclude the presence or addition of one or more other features, numbers, steps, operations, components, elements, or combinations thereof.

The phrases “associated with” and “associated therewith” as well as derivatives thereof may mean to include, be included within, interconnect with, contain, be contained within, connect to or with, couple to or with, be communicable with, cooperate with, interleave, juxtapose, be proximate to, be bound to or with, have, have a property of, or the like.

When it is described that a part is (functionally or communicably) “connected to” or “coupled to” another part, this may mean to include not only the case of “being directly connected to” but also the case of “being indirectly connected to” by interposing another device being interposed therebetween.

When it is described that a first part transmits data to a second part, this may mean to include not only the case of delivering the data from the first part to the second part directly but also the case of delivering the data from the first part to the second part via another part (e.g., third part). For example, if it is expressed that a terminal transmits data to a core network, this may mean to include a situation where the terminal transmits the data to the core network via a base station or an access point (AP).

Unless otherwise defined herein, all terms including technical or scientific terms used herein have the same meanings as commonly understood by those skilled in the art to which the present invention belongs. It will be further understood that terms, such as those defined in commonly used dictionaries, should be interpreted as having a meaning that is consistent with their meaning in the context of the specification and relevant art and should not be interpreted in an idealized or overly formal sense unless expressly so defined herein.

Before undertaking the detailed description of the present invention below, it may be advantageous to set forth definitions of certain words and phrases used throughout the specification. However, it should be noted that the words and phrases are not limited to the exemplary interpretations herein.

The term “base station” denotes an entity allocating resources to terminals for communications therewith and may be interchangeably referred to as BS, node B (NB), evolved node B (eNB), next generation radio access network (NG RAN), radio access unit, base station controller, and a node on a network.

The term “terminal (or communication terminal)” may denote an entity communicating with a base station or another terminal and may be interchangeably referred to as node, user equipment (UE), next generation UE (NG UE), mobile station (MS), mobile equipment (ME), and device.

The terminal may include at least one of a smart phone, a tablet personal computer (PC), a mobile phone, a video phone, an e-book reader, a desktop PC, a laptop PC, a netbook computer, a Personal Digital Assistant (PDA), a portable Multimedia Player (PMP), an MP3 player, a medical device, a camera, and a wearable device. The terminal may also include at least one of a television (TV), a Digital Video Disk (DVD) player, an audio player, a refrigerator, an air conditioner, a cleaner, an oven, a microwave oven, a washing machine, an air cleaner, a set-top box, a home automation control panel, a security control panel, a media box (for example, Samsung HomeSync™, Apple TV™, or Google TV™), a game console (e.g., Xbox™ and PlayStation™), an electronic dictionary, an electronic key, a camcorder, and an electronic frame. The terminal may also include at least one of a medical device (such as portable medical measuring devices (including a glucometer, a heart rate monitor, a blood pressure monitor, and a body temperature thermometer), a Magnetic Resonance Angiography (MRA) device, a Magnetic Resonance Imaging (MRI) device, a Computed Tomography (CT) device, a camcorder, and a microwave scanner), a navigation device, a Global Navigation Satellite System (GNSS), an Event Data Recorder (EDR), a Flight Data Recorder (FDR), an automotive infotainment device, marine electronic equipment (such as marine navigation system and gyro compass), aviation electronics (avionics), security equipment, an automotive head unit, an industrial or household robot, a drone, an Automated Teller Machine (ATM), a Point Of Sales (POS) terminal, and an Internet-of-Things (IoT) device (such as electric bulb, sensor, sprinkler system, fire alarm system, temperature controller, street lamp, toaster, fitness equipment, hot water tank, heater, and boiler).

The terminal may further include various types of multimedia systems having a communication function.

Although the embodiments of the present invention are directed to the 5G wireless communication system, the present invention is applicable to other communication systems having a similar technical background. It will be also understood by those skilled in the art that the present invention can be applied to other communication systems, with a slight modification, without departing from the spirit and scope of the present invention.

FIG.1is a diagram illustrating a 5G wireless communication system according to an embodiment of the present invention.

InFIG.1, the NG UE101denotes a terminal being served by the 5G wireless communication system, and the NG RAN103denotes a base station performing wireless communication with the UE in the 5G wireless communication system. The common control plane network function (CCNF)105is connected with the NG RAN103to process control messages for management of the NG UE101and manages mobility of the NG UE101. The CCNF105may have a network function set including network functions available in common for the NSIs created based on the network slices110,120, and130among the network control functions (control plane network functions).

For example, the common network functions may include a mobility management network function MM NF, an authentication/authorization NF, an NSI selector NF, and a non-access stratum routing NF (NAS routing NF). Among them, the NSI selector NF may be a network function for selecting the best NSI for providing the service requested by the UE101. The NAS routing NF may be responsible for routing an NAS signal from the UE101to a proper NSI.

The subscriber repository107may receive subscriber information to authenticate the UE101and include subscription information for providing a QoS policy.

The NSIs created for use of the respective network slices110,120, and130may include respective control plane NFs (CP NFs)131ato131nand user plane NFs (UP NFs). The CP NF is responsible for session management to establish, modify, and release a session for a service. The UP NF may manage a service data transmission to the data network140via IP address assignment.

InFIG.1, the UE101may connect to multiple NSIs. That is, there may be multiple reference points.

For example, the NG 1 interface151is an interface established between the UE101and the CP NF and may be similar in role to the interface for NAS signaling in the legacy LTE communication network. The NG 2 interface152is an interface established between the RAN103and the CP NF and may be similar in role to the interface for S1-MME signaling in the legacy LTE communication network. The NG 3 interface153is an interface established between the RAN103and the UP NF and may be similar in role to the S1-U bearer interface in the legacy LTE communication network.

In this case, the signaling over the NG 1 interface151and the NG 2 interface152may access the Per NSI CP NFs via the CCNF105, and the NG 3 interface153may provide direct connections from the RAN103to per-NSI UP NFs.

In the following description, a device responsible for the CCNF is referred to as a common control function provision device (CCNF unit), a device responsible for NSI function as a network slice instance management device (NSI), a device responsible for CP NF as a network session management device (CP NF unit), and a device responsible for UP NF as a network data management device (UP NF unit), for convenience of explanation.

Here, the term “device” may be a unit of software, hardware, firmware, or any combination thereof; for example, the term “module” may be interchangeably used with the terms “unit”, “logic”, “logical block”, “component”, or “circuit”. At least part of the device may be implemented in the form of a program module with commands stored in a computer-readable storage medium. The device may also include an Application-Specific Integrated Circuit (ASIC) chip, Field-Programmable Gate Arrays (FPGAs), and a Programmable-Logic Device known or to be developed for certain operations.

It may be possible to integrate at least two devices into one device. In this case, the integrated devices may be implemented as hardware, software, or firmware modules as parts of one device. For example, the NSI management device (NSI unit) may include the network session management device (CP NF unit) and the network data management device (UP NF unit) implemented as software modules as parts of the NSI management device (NSI unit).

FIG.2is a block diagram illustrating a configuration of a terminal that requests to a third party server for authentication according to an embodiment of the present invention.

InFIG.2, a third party application201associated with the third party server may be installed on the NG UE200. The third party application201associated with the third party server may be installed for use of a network slice tenanted by a third party service provider operating the third party server.

The third party application201may be provided by the third party service provider or an application provider cooperating with one or more third party service providers. For example, if the third party server being operated by the third part service provider is a social network server (SNS) server, the application may be an application associated with the SNS server.

The third party application201may be installed on the UE200along with a tenant identifier (ID) for use in identifying the third party service provider providing the application and a slice type specifying service requirements. The slice type may include information on the usage or type of data, which indicates whether the data are multimedia data or IoT data by way of example.

In this case, if the third party application201is installed on the UE200along with the tenant ID and slice type, this means that the tenant ID and slice type are stored in the UE200in association with or in binding with the application upon detection of a predetermined event during, right after, or since the installation of the third party application201.

If the third party application201is installed, the tenant ID and slice type may be sent to a communication processor (CP)205via an application processor (AP)203, the tenant ID and slice type being transmitted to a communication network via control signaling.

In this case, the third party service provider may have per-operator tenant IDs and slice types, which are determined based on the public land mobile network identifiers (PLMN IDs) of the operators subscribed to by the UE and sent to the CP205.

In the case where the third party application201is installed or executed on the UE200or generates an event triggering a third party service (e.g., event occurring when the user selects a wireless communication connection UI), the CP may transmit a service request message including the tenant ID and slice type to a CCNF unit.

Next, if the CCNF unit selects an NSI unit based on the tenant ID and slice type, the UE200may transmit traffic of the third party application200to the third party server through a data session established by the NSI unit.

As described above, the UE is capable of using the network slice tenanted by the third party service provider only with the operation of installing the application associated with the third party server. That is, the user only needs to install the application for the traffic of the installed application to be transmitted to the third party server through the network slice.

According to various embodiments, the tenant ID and slice type may be acquired from the third party server. For example, in the case where the application associated with the third party server is installed, the UE may request to the third party server for the tenant ID and slice type. If the third party server transmits the tenant ID and slice type in response to the request from the UE, the UE may use the network slice tenanted by the third party service provider based on the received tenant ID and the slice type.

FIG.3is a signal flow diagram illustrating a procedure for a UE to request to a third party server for authentication for use of a network slice according to an embodiment of the present invention.

InFIG.3, the wireless communication system may include a UE301, a RAN302, a CCNF unit (serving CCNF unit or CCNF serving unit)303, an NSI unit (core NSI tenanted by 3rdparty)304, a CP NF unit (Slice CP NF unit), an UP NF unit (Slice UP NF unit), and a third party server307. Here, the third party server307is a third party service-related server for providing the third party service or performing user authentication for providing the third party service.

In this case, the UE301may be in the state of being previously attached to the communication operator network. The UE301may also be in the state of being authenticated by the communication operation and assigned a UE ID. The UE301may also be in the state of having an application associated with the third party server307installed and the tenant ID and slice type along with the application.

At steps311and312, the UE301may transmit a new service request message to the communication network301. For example, if the application associated with the third party server is installed or executed or generates an event triggering a third party service, the UE301may transmit the new service request message. As described above, the new service request message may include the tenant ID, the slice type, and a previously assigned UE ID because the third party application, tenant ID, and slice type are associated with each other.

In detail, the UE301transmits the new service request message to the RAN302at step311, and the RAN relays the new service request message to the CCNF unit303at step312.

At step313, the CCNF unit303may select an NSI unit305suitable for the received tenant ID and slice type by means of an NSI selector NF.

At step314, the CCNF unit303may relay the new service request message to the NSI unit304.

The NSI unit304may establish a limited data session for authentication between the UE301and the third party server307to transmit traffic for authentication based on the new service request message. The limited data session may be a data session with a limited bandwidth and HTTP redirection.

That is, the UE301may need to pass an authentication process of the third party service provider in addition to the authentication process of the communication operator in order to use the NSI unit304leased by the third party service provider. Alternatively, if the third party service provider has not leased the NSI unit304, the authentication process may not be performed.

In detail, the CP NF unit305of the NSI unit304may send a session creation request message to the UP NF unit306at step315. The session creation request message may include a UE ID, a data session identifier (packet data unit (PDU) session ID), and a policy and charging control (PCC) rule predefined properly for the limited session.

Here, the PCC rule may include limited bandwidth and HTTP redirection information. For use in authentication of the UE301, the data session may need to be established as a limited packet data unit session. For this purpose, the data session is limited in traffic bandwidth to a predetermined bandwidth (e.g., 64 kbps), and the HTTP redirection is configured such that all traffic is oriented to the third party server. That is, the UE301may only be authenticated only through the data session (PDU session).

At step316, the UP NF unit306may send a session creation response message to the CP NF unit305in reply to the session creation request message. The session creation response message may include the UE ID and UE Internet protocol (IP) address.

At step317, the CP NF unit305may transmit to the UE301a new service response message including information related to the limited data session in reply to the new service request message transmitted at step314so as to establish the limited session for authentication between the UE301and the third party server307. Transmitting the new service response message to the UE301may include transmitting the new service response message to the UE301via the RAN302.

For example, the information related to the limited data session may include a UE ID, a UE IP address, a tenant ID, a slice type, a data session identifier, and a predetermined QoS profile.

As a consequence, the limited data session may be established between the UE301and the third party server307at step318.

If the session is established, the UE301(third party application301-1installed on the UE301) may connect to the third party server307for user authentication. In this case, the user authentication may be performed in compliance with a predefined authentication scheme. For example, examples of the authentication scheme may include a credential authentication scheme, a public key/private key pair authentication scheme, a certificate authentication scheme, a private information authentication scheme, and an ID/password authentication scheme. That is, the third party server307may directly perform authentication on the UE based on a legacy authentication scheme.

In detail, if the limited data session is established, the third party application301-1may transmit, at step319, a third party service request message as an authentication request message for authentication of the UE301to the third party server307through the limited data session. The third party service request message may include an identifier of the user of the UE301, a password, and a network identifier (PLMN ID). User authentication may be performed between the UE301and the third party server307at step320based on the third party service request message.

If the user authentication succeeds, the third party server307may transmit a service response message as an authentication response message to the third party application301-1at step321. The service response message may include a token containing a PCC rule as an update rule to be applied to the UE301and a temporary identifier.

At step322, the third party server307may transmit to the CP NF unit305a service authentication server result message including the token transmitted to the UE301.

At step323, the UE301may transmit a service authentication application result method including the token to the CP NF unit305.

The CP NF unit305may identify the right of the UE301for use of the NSI unit304based on the service authentication server result message received form the third party server307and the service authentication application result message received from the UE301and update the temporarily-established limited data session based on the PCC rule included in the token provided by the third party server.

In detail, if the CP NF unit305sends, at step324, a message including the PCC rule for updating the data session, a data session identifier, and a UE identifier to the UP NF unit306, and the UP NF unit306may update the previously established data session based on the PCC rule.

As a consequence, the updated data session is assigned between the UE301and the third party server307at step325.

For example, if the traffic bandwidth available for the user of the UE301in the communication operator network during the previously established data session is 50 Mbps, it may be updated to 100 Mbps in the data session updated based on the new PCC rule.

Both the third party application301-1and the CP NF unit305may store the token received from the third party server307.

The token may include a timer. The UE301may use the previously authenticated NSI unit304until the timer expires. In this case, any additional authentication process between the UE301and the third party server307may be omitted.

Because the PCC rule is stored in the CP NF unit305, a new data session may be established to be appropriate for use of the third party service based on the PCC rule.

FIG.4is a block diagram illustrating a configuration of a UE in a wireless communication system according to an embodiment of the present invention.

As shown in the drawing, the UE includes a radio frequency (RF) processor410, a baseband processor420, a storage unit440, and a controller450.

The RF processor410has a function for transmitting/receiving a signal over a radio channel such as band conversion and amplification of the signal. That is, the RF processing unit410up-converts a baseband signal from the baseband processor420to an RF band signal and transmits the RF signal via an antenna and down-converts the RF signal received via the antenna to a baseband signal. For example, the RF processor410may include a transmission filter, a reception filter, an amplifier, a mixer, an oscillator, a digital-to-analog converter (DAC), and an analog-to-digital converter (ADC). Although one antenna is depicted in the drawing, the UE may be provided with a plurality of antennas. The RF processor410may also include a plurality of RF chains. The RF processor410may perform beamforming. For beamforming, the RF processor410may adjust the phase and size of a signal to be transmitted/received by means of the antennas or antenna elements. The RF processor410may be configured to perform a MIMO operation through which the UE can receive multiple layers simultaneously. The RF processor410may perform a reception beam sweeping operation by properly configuring the antennas or antenna elements and adjust reception beam direction and beamwidth such that the reception beam is aligned with the corresponding transmission beam.

The baseband processor420has a baseband signal-bit string conversion function according to a physical layer standard of the system. For example, in a data transmission mode, the baseband processor420performs encoding and modulation on the transmission bit string to generate complex symbols. In a data reception mode, the baseband processor420performs demodulation and decoding on the baseband signal from the RF processor410to recover the transmitted bit string. In the case of using an OFDM scheme for data transmission, the baseband processor420performs encoding and modulation on the transmission bit string to generate complex symbols, maps the complex symbols to subcarriers, performs inverse fast Fourier transform (IFFT) on the symbols, and inserts a cyclic prefix (CP) into the symbols to generate OFDM symbols. In the data reception mode, the baseband processor420splits the baseband signal from the RF processor410into OFDM symbols, perform fast Fourier transform (FFT) on the OFDM symbols to recover the signals mapped to the subcarriers, and performs demodulation and decoding on the signals to recover the transmitted bit string.

The baseband processor420and the RF processor410process the transmission and reception signals as described above. Accordingly, the baseband processor420and the RF processor410may be referred to as a transmitter, a receiver, a transceiver, or a communication unit430. The communication unit430may communicate with an external node. The external node may be the NG RAN, CCNF unit, NSI unit, or third party server of the present invention by way of example; if the communication unit430communicates with an external node, this may include that the communication unit430communicates with the external node via an intermediate medium. For example, if the communication unit430communicates with the CCNF unit, this may include that the communication unit430communicates with the CCNF unit via the NG RAN. Alternatively, if the communication unit430communicates with the third party server, this may include that the communication unit430communicates with the third party server via the NG RAN and the NSI unit.

At least one of the baseband processor420and the RF processor410may include a plurality of communication modules for supporting different radio access technologies. At least one of the baseband processor420and the RF processor410may also include multiple communication modules for processing the signals in different frequency bands. For example, the different radio access technologies may include an LTE network and an NR network. The different frequency bands may include a super high frequency (SHF) band (e.g., 2.5 GHz and 5 GHz bands) and an mmWave band (e.g., 60 GHz).

The storage unit440may store data such as basic programs for operation of the UE, application programs, and setting information. The storage unit440may provide the stored data in response to a request from the controller450. The storage unit440may include an internal memory and an external memory by way of example. The internal memory may include at least one of a volatile memory (e.g., DRAM, SRAM, and SDRAM), a non-volatile memory (e.g., one time programmable ROM (OTPROM)), PROM, EPROM, EEPROM, mask ROM, flash ROM, flash memory, a hard drive, and a solid state drive (SSD) by way of example. The external memory may include a flash drive such as compact flash (CF), secure digital (SD), Micro-SD, Mini-SD, extreme digital (xD), multimedia card (MMC), and memory stick. The external memory may be functionally or physically connected to the UE via various interfaces.

In the present invention, an application associated with the third party server is installed, and the storage unit440may store a tenant ID and a slice type in association with the application.

The controller450controls overall operations of the UE. For example, the controller440controls the communication unit430to transmit and receive signals. The controller450also writes and reads data to and from the storage unit440. For this purpose, the controller450may include at least one processor. For example, the controller450may include a communication processor (CP) for controlling communications and an application processor (AP) for controlling higher layer programs such as applications.

According to various embodiments, the controller450may control the communication unit430to transmit a service request message including the tenant ID and slice type being provided by the application associated with the third party server to the CCNF unit. If a limited data session for authentication between the UE and the third party server is established by the NSI unit selected by the CCNF unit, the controller450may control the communication unit430to receive a service response message including information on the limited data session from the NSI unit. The controller450may also control the communication unit430to transmit an authentication request message for requesting authentication on the UE to the third party server through the limited data session based on the service response message.

According to various embodiments, the tenant ID and slice type may be stored in the UE in association with an application while the application is installed in the UE.

According to various embodiments, in the case where the controller450is configured to control the communication unit430to transmit the service request message, if the third party application is installed or executed on the UE or generates an event triggering a third party service, the controller controls the communication unit to transmit the service request message to the CCNF unit via the NG RAN.

According to various embodiments, if the UE is authenticated, the controller450may control the communication unit430to receive an authentication response message including a token from the third party server.

According to various embodiments, the controller450may control the communication unit430to transmit a service authentication result message including the token to the NSI unit and forward the traffic of the application to the third party server through the data session updated based on the service authentication result message.

According to various embodiments, at least one of the tenant ID and the slice type may be determined based on the network identifier (PLMN ID) of the communication operator subscribed to by the UE.

FIG.5is a block diagram illustrating a configuration of an NSI unit of a wireless communication system according to an embodiment of the present invention.

As shown in the drawing, the NSI unit includes a communication unit510and a controller520.

The communication unit510may communicate with an external node. The external node may be the NG RAN, CCNF unit, NSI unit, or third party server of the present invention by way of example; if the communication unit510communicates with an external node, this may include that the communication unit430communicates with the external node via an intermediate medium. For example, if the communication unit510communicates with a UE, this may include that the communication unit510communicates with the UE via an NG RAN.

A storage unit (not shown) stores data such as basic programs for operation of the NSI unit, application programs, and setting information. The storage unit (not shown) may provide the stored data in response to a request from the controller520. The storage unit (not shown) may include an internal memory and an external memory by way of example. The internal memory may include at least one of a volatile memory (e.g., DRAM, SRAM, and SDRAM), a non-volatile memory (e.g., one time programmable ROM (OTPROM)), PROM, EPROM, EEPROM, mask ROM, flash ROM, flash memory, a hard drive, and a solid state drive (SSD) by way of example. The external memory may include a flash drive such as compact flash (CF), secure digital (SD), Micro-SD, Mini-SD, extreme digital (xD), multimedia card (MMC), and memory stick. The external memory may be functionally or physically connected to the NSI unit via various interfaces.

The controller520controls overall operations of the NSI unit. For example, the controller520controls the communication unit510to transmit and receive signals. The controller520also writes and reads data to and from the storage unit (not shown). For this purpose, the controller520may include at least one processor. For example, the controller520may include a communication processor (CP) for controlling communications and an application processor (AP) for controlling higher layer programs such as applications.

According to various embodiments, the controller520may control the communication unit510to receive a service request message from the UE. The controller520may establish a limited data session for authentication between the UE and the third party server based on the received service request message. The controller520may also control the communication unit510to transmit a service response message including information on the limited data session to the UE for assigning the limited data session.

According to various embodiments, if the authentication is achieved between the UE and the third party server through the limited data session, the controller520may control the communication unit510to receive a service authentication result message including an update rule from the third party server. The controller520may also establish an updated data session based on the update rule.

According to various embodiments, if the controller is configured to control the communication unit510to receive a service request message from the UE in the wireless communication system, it may control the communication unit510to receive the service request message from the UE via a CCNF unit selected by the NSI.

According to various embodiments, if the controller520is configured to establish a session for authentication between the UE and the third party server, it may control the CP NF unit to send a session creation request message to a UP NF unit based on the service request message. The controller520may also control the UP NF unit to send a session creation response message to the CP NF unit in reply to the session creation request message.

FIG.6is a flowchart illustrating a procedure for a UE to request to a third party server for authentication in a wireless communication system according to an embodiment of the present invention.

At step601, the UE may first transmit to a CCNF unit a service request message including a tenant ID and a slice type provided by an application associated with the third party server.

Here, the tenant ID and slice type may be stored in the UE in association with the application while the application is being installed on the UE. At least one of the tenant ID and the slice type may be determined based on a network ID (PLMN ID) of the communication operator previously subscribed to by the UE.

In the case of being configured to transmit the service request message, the UE may transmit the service request message to a CCNF unit via a GN RAN, if the third party application is installed or executed on the UE or generates an event triggering a third party service.

If a limited data session for authentication between the UE and the third party server is established by the NSI unit selected by the CCNF unit, the UE may receive a service response message including information on the limited data session from the NSI unit at step603.

Next, the UE may transmit an authentication request message for authentication on the UE to the third party server, at step605, through the limited data session based on the service response message.

If the UE is authenticated, it may receive an authentication response message including a token from the third party server.

Next, the UE may transmit a service authentication result message including the token to the NSI unit. Then, the UE may transmit traffic of the application to the third party server via the data session updated based on the service authentication result message.

FIG.7is a flowchart illustrating a procedure for an NSI unit to establish a data session in a wireless communication according to an embodiment of the present invention.

At step701, the NSI unit may first receive a service request message from a UE. In this case, the NSI unit may receive the service request message from the UE via a CCNF that has selected the NSI.

Next, the NSI unit may establish a limited data session for authentication between the UE and the third party server at step703.

For example, a CP NF unit of the NSI unit may send a session creation request message to a UP NF unit of the NSI unit based on the service request message. In response to the session creation request message, the UP NF unit may send the CP NF unit a session creation response message including information on the established data session.

Next, the NSI unit may transmit a service response message including the information on the limited data session to the UE, at step705, for assigning the limited data session between the UE and the third party server.

If the authentication is achieved between the UE and the third party server through the limited data session, the NSI unit may receive a service authentication result message including an update rule from the third party server. The NSI unit may establish a data session updated based on the updated rule.

As a consequence, the UE may transmit traffic of the application to the third party server through the updated data session.

According to an embodiment of the present invention, at least part of the components (e.g. modules or their functions) of the wireless communication system or methods (e.g., operations) may be implemented in the form of program modules stored in a non-transitory computer-readable storage medium. In the case that the instructions are executed by a processor, the processor may execute the functions corresponding to the instructions.

Here, a program may be stored in a non-transitory computer-readable storage medium and read and executed by a computer according to an embodiment of the present invention.

Here, non-transitory storage media may include volatile and non-volatile memories storing data temporarily for operation or transmission such as a resistor, a cache, and a buffer as well as media storing data readable by a device semi-persistently. However, temporary transmission media such as signals and current are not included in the non-transitory storage media.

In detail, the above described programs may be provided in the state of being stored in a non-transitory computer-readable storage medium such as CD, DVD, hard disk, blu-ray disk, USB, internal memory of the device of the present invention, memory card, ROM, and RAM.

The above-described programs may also be stored in a memory of a server and transmitted to a terminal (e.g., device of the present invention) connected to server through a network for sale or transferred or registered to the server by a program provider (e.g., program developer and program producer).

In the case where the above-described programs are transmitted from a server to a terminal for sale, at least part of the programs may be loaded on a buffer of the server temporarily before being transmitted. In this case, the buffer of the server may be the non-transitory storage medium.

According to an embodiment, the non-transitory computer-readable storage medium may store a program being executed by a terminal, which transmits a service request message including a tenant ID and a slice type provided by the application associated with the third party server to a CCNF unit, receives, if a limited data session is established by an NSI unit selected by the CCNF unit for authentication between the terminal and the third party server based on the service request message, a service response message including information on the limited data session from the NSI unit, and transmit an authentication request message for authenticating the terminal to the third party server through the limited data session based on the service response message.

According to an embodiment, the non-transitory computer-readable storage medium may store a program being executed by an NSI unit, which receives a service request message from a terminal, establishes a limited data session for authentication between the terminal and a third party server based on the received service request message, and transmits a service response message including information on the limited data session to the terminal to assign the limited data session between the terminal and the third party server.

Although the description has been made with reference to particular embodiments, the present invention can be implemented with various modifications without departing from the scope of the present invention. Thus, the present invention is not limited to the particular embodiments disclosed and will include the following claims and their equivalents.