Abstract: Apparatuses, methods, and systems are disclosed for registering a personal Internet-of-Things (PIoT) network and PIoT device. One apparatus includes a first network interface that communicates with a PIoT network comprising at least one PIoT device. The apparatus includes a processor that detects a first PIoT device connecting to the PIoT network and determines a vendor of the first PIoT device. The processor sends a first request to a first PIoT server operated by the determined vendor, the first request enabling the first PIoT server to identify the first PIoT device as operating in the PIoT network, where the first request contains PIoT information which identifies a PIoT aggregation server associated with the PIoT network.

Abstract: Apparatuses, methods, and systems are disclosed for data connection establishment in response to a disaster condition. One method (600) includes receiving (602), at a first network function in a first mobile communication network, a first message from a second network function in the first mobile communication network. The first message includes a data connection establishment request from a remote unit and a disaster indication indicating that the data connection establishment request is in response to a disaster condition in a second mobile communication network, and the disaster condition disables the remote unit from connecting to the second mobile connection network. The method (600) includes determining (604) destination addresses in the second mobile communication network. The method (600) includes configuring (606) a data connection corresponding to the data connection establishment request to accept data traffic between the remote unit and the destination addresses.

Abstract: Apparatuses, methods, and systems are disclosed for determining mobile network policy freshness. One method includes accessing a first policy associated with a first mobile network, a first policy identifier, and a freshness parameter. The method includes determining, based on the freshness parameter, whether the first policy is fresh. The method includes transmitting a registration message to a second mobile network. The registration message includes the first policy identifier in response to determining that the first policy is not fresh.

Abstract: Apparatuses, methods, and systems are disclosed for modifying a data connection. One apparatus includes a processor, a first interface supporting a first data connection with a 5G core network over a first access and a second interface that communicates with a UE over a second access. The processor receives a request to establish a second data connection with the UE and determines whether the second data connection can be mapped into one of a plurality of QoS flows established over the first data connection. The processor sends a request to establish a new QoS flow over the first data connection upon determining that the second data connection cannot be mapped into an existing QoS flow of the first data connection and relays traffic between the second data connection and the new QoS flow over the first data connection.

Abstract: Apparatuses, methods, and systems are disclosed for determining an action for a network function based on network analytics. One apparatus includes a processor and a network interface that receives a first set of analytics from at least one network analytics function in a mobile communication network, the first set of analytics relating to a first KPI. The processor determines from the first set of analytics whether a first condition is met and determines a first set of actions when the first condition is not met. Via the network interface, the processor sends the first set of actions to at least one network function in the mobile communication network, each action in the first set of actions being sent to an associated network function.

Abstract: Apparatuses, methods, and systems are disclosed for supporting delegated data connections. One apparatus includes a processor and a transceiver that receives an access request indicating that a remote unit requires to access a first access network. The processor determines to establish a delegated data connection in a mobile communication network for the remote unit, the delegated data connection connecting the apparatus with an external data network. The processor enables the authentication of the remote unit by converting a first authentication signaling used by the mobile communication network to a second authentication signaling used by the first access network. The processor controls the transceiver to forward data traffic between the remote unit and the external data network over the delegated data connection, wherein the delegated data connection is reserved for use by the remote unit.

Abstract: Apparatuses, methods, and systems are disclosed for provisioning a subscription to access local services. One apparatus includes a network interface that receives a first request message from an application function associated with a first service, the first request message containing a second subscription that enables a UE having a first subscription to register with a second mobile communication network that is not accessible with the first subscription. The apparatus includes a processor that receives an indication that the UE has initiated communication with a remote server accessible via the first mobile communication network and sends a second request message to the UE, the second request message containing the second subscription and enables the UE to access a local server via the second mobile communication network, where the local server provides the first service.

Abstract: Apparatuses, methods, and systems are disclosed for selecting a data connection based on digital certificate information. One apparatus includes a transceiver and a processor that receives a request to send a data packet and determines a first application identity used by a first application. The processor finds a first policy rule in the apparatus that matches the first application identity and determines whether the first application matches a digital certificate information. Here, the first policy rule contains the digital certificate information. Upon determining that the first application matches the digital certificate information, the processor applies the first policy rule to select a first set of data connection parameters and the transceiver transmits the data packet via a data connection using the first set of data connection parameters.

Abstract: One apparatus includes a processor that creates a second request on behalf of a remote unit from a first request received from a non-3GPP access network, the second request including a subscriber identity of the remote unit. The processor sends the second request to a mobile core to initiate connection of the remote unit to the mobile core and receives a third request from the mobile core, the first request being part of a first authentication procedure and the third request being part of a NAS authentication procedure different than the first authentication procedure. The processor transforms the third request into a fourth request of the first authentication procedure and uses an authentication response of the first authentication procedure to complete connection of the remote unit to the mobile core.

Abstract: Apparatuses, methods, and systems are disclosed for configuring N6-LAN chain policies. One apparatus includes a processor and a network interface that receives a first request from an application function (“AF”), the first request comprising an external identifier for at least one user equipment (“UE”) and N6-LAN steering information indicating a service function or a chain of service functions in the N6-LAN that must process the user-plane traffic associated with the at least one UE. The processor translates the external identifier into a permanent subscription identifier of the at least one UE and sends a second request to a first network function to update an application data set to include the N6-LAN steering information and the permanent subscription identifier.

Abstract: Apparatuses, methods, and systems are disclosed for a split TNGF. One apparatus includes a processor that receives a request from the AMF. Here, the request is sent during registration of the remote unit with the mobile communication network via the apparatus, where the request contains a first security key. The processor selects a TNGF-SG and sends a first message to the selected TNGF-SG that contains the first security key, an identity of the remote unit and a destination address and port indicating where the remote unit is to send signaling messages for the mobile communication network. The processor receives a second message from the selected TNGF-SG and establishes a first connection with the remote unit via the selected TNGF-SG. The processor completes the registration of the remote unit with the mobile communication network.

Abstract: Apparatuses, methods, and systems are disclosed for Digital Identifier-based authentication for network access. One apparatus includes a memory coupled to a processor, the memory storing instructions executable by the processor to control the apparatus to receive a first authentication request message containing UE identifier that is based on a Digital Identifier (“DIG-ID”) comprising a verifiably secure identity. The instructions are executable by the processor to control the apparatus to receive subscription information from a service provider identified using the DIG-ID, and to store the subscription information and UE security context containing at least one security key derived using the DIG-ID. The instructions are executable by the processor to control the apparatus to transmit the at least one security key.

Abstract: Apparatuses, methods, and systems are disclosed for deriving an operating system identity. One method includes determining, at a remote unit, a type of operating system used by the remote unit. The method includes determining a domain name corresponding to the type of operating system. The method includes deriving an operating system identity by applying a hash function to the domain name and a predetermined value. The method includes transmitting a first message to a mobile communication network. In such embodiments, the first message includes the operating system identity.

Abstract: Apparatuses, methods, and systems are disclosed for reconfiguring a data connection using new parameters. One apparatus includes a transceiver that communicates with a UE and a processor that registers the UE with a mobile communication network using a first set of parameters, where the first set of parameters is based on a UE configuration. The processor identifies a second set of parameters to be used by the UE in the mobile communication network. Via the transceiver, the processor sends the second set of parameters to the UE and sends mapping information which indicates how the at least one parameter in the second set of parameters corresponds to at least one new parameter for the UE configuration.

Abstract: Apparatuses, methods, and systems are disclosed for supporting edge data network discovery. One apparatus includes a transceiver and a processor that receives a first request from a function in the mobile communication network including a UE identity and a UE network address. The processor determines whether the UE is located in a first service area based on a UE location and forwards a DNS request received from the UE network address to a first DNS server associated with the first service area in response to determining that the UE is located in the first service area. Via the transceiver, the processor receives a DNS reply from the first DNS server and sends a second request to a policy function in the mobile communication network in response to determining that the DNS reply includes a first IP address.

Abstract: Apparatuses, methods, and systems are disclosed for Digital Identifier-based subscription onboarding. One apparatus includes a memory coupled to a processor, the memory storing instructions executable by the processor to control the apparatus to acquire a Digital Identifier (“DIG-ID”) comprising a verifiably secure identity, and to generate a digital signature of the DIG-ID and a timestamp using a private key. The instructions are executable by the processor to control the apparatus to send a first request to a mobile communication network and to receive a response containing an onboarding authentication success indication and a verified DIG-ID, the first request including the DIG-ID, the timestamp and the digital signature. The instructions are executable by the processor to establish a provisioning connection to the mobile communication network and to receive a subscription credential and/or a user subscription profile via the provisioning connection.

Abstract: Apparatuses, methods, and systems are disclosed for supporting delegated data connections. One apparatus includes a processor and a transceiver that receives an access request indicating that a remote unit requires to access a first access network. The processor determines to establish a delegated data connection in a mobile communication network for the remote unit, the delegated data connection connecting the apparatus with an external data network. The processor enables the authentication of the remote unit by converting a first authentication signaling used by the mobile communication network to a second authentication signaling used by the first access network. The processor controls the transceiver to forward data traffic between the remote unit and the external data network over the delegated data connection, wherein the delegated data connection is reserved for use by the remote unit.

Abstract: Apparatuses, methods, and systems are disclosed for determining remote unit behavior parameters. One method includes receiving a message including parameters associated with an application in a remote unit. The method includes determining a first set of parameters including a first portion of the parameters, wherein each parameter of the first set of parameters corresponds to a remote unit behavior. The method includes determining a second set of parameters including a second portion of the parameters, wherein each parameter of the second set of parameters corresponds to a service behavior. The method includes associating the second set of parameters with a data network name, a single network slice selection assistance information, or a combination thereof.

Abstract: Apparatuses, methods, and systems are disclosed for determining remote unit behavior parameters. One method includes receiving a message including parameters associated with an application in a remote unit. The method includes determining a first set of parameters including a first portion of the parameters, wherein each parameter of the first set of parameters corresponds to a remote unit behavior. The method includes determining a second set of parameters including a second portion of the parameters, wherein each parameter of the second set of parameters corresponds to a service behavior. The method includes associating the second set of parameters with a data network name, a single network slice selection assistance information, or a combination thereof.

Abstract: Apparatuses, methods, and systems are disclosed for associating the start of an encrypted data flow with an application. One apparatus includes a memory storing instructions executable by a processor to cause the apparatus to authenticate an encrypted traffic detection function (“ETDF”) of the remote unit and to provide the remote unit with a list of application identifiers for which encrypted traffic detection information is to be provided, in response to successfully authenticating the ETDF of the remote unit. The instructions are executable by the processor to cause the apparatus to generate detection information for each application in the list of application identifiers and to send the list of application identifiers and the detection information for each application in the list of application identifiers to a network function in the mobile communication network.