Abstract: An apparatus for retrieving at least one of an access network or core network assigned user equipment identifier (NGAP ID) from outside of the access or core network using IP addressing information. The apparatus configured to receive IP addressing information of the user equipment; determine a subscriber permanent user identity for the user equipment from the IP addressing information; generate and transmit a request for the at least one of the access network or core network assigned user equipment identifier, the request including the subscriber permanent identity; and receive the at least one of the access network or core network assigned user equipment identifier.

Abstract: An apparatus relating to authorization of network functions includes at least one processor and at least one memory including computer program code. The at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to: send, from a first network function service consumer instance to an authorization server, a request for an access token for use in accessing a service provided by a network function service producer; receive, at the first network function service consumer instance from the authorization server, an access token for use in accessing the service provided by the network function service producer; and send, from the first network function service consumer instance to the network function service producer, a request to access the service provided by the network function service producer, the request to access the service including the access token.

Abstract: There is provided an apparatus, said apparatus comprising means for determining, at a first core network entity, an indication of domains supported on a data network, determining domain name system configuration information based at least on the indication of domains supported on the data network and providing the domain name system configuration information to a second core network entity.

Abstract: Described are apparatuses, methods, and computer program products for enabling splitting, switching, and steering of access traffic in a system, e.g., a fifth-generation (5G) system. Access and mobility management functions (AMF) of the 5G system forward one or more of the registration requests to unified data management (UDM) functions of the PLMNs. UDM function determines whether evolved packet system (EPS) interworking (IWK) is allowed for respective registration requests based on subscription, deployment, system capabilities, a radio access technology (RAT) of an access path between the UE and the 5G system, etc. UE can include an indication that EPS IWK is requested and/or required in a registration request.

Abstract: Techniques for accessing a core network via access points and gateway functions are provided. For example, a method comprises: determining one or more candidate gateway functions for accessing the core network via the access point; transmitting, to the one or more candidate gateway functions or to a core network function, a request for use of the one or more gateway functions to access the core network; and receiving, from the gateway function or from the core network function, a request response per candidate gateway function, the request response being configured to indicate whether the access to the core network via the respective gateway function is rejected and, in the case of rejection, to indicate a cause of rejection. The method may be performed by the terminal device (e.g., a user equipment, UE). Corresponding methods that can be performed by a network device are also provided.

Abstract: Improved techniques for secure access control in communication systems are provided. In one example, in accordance with an authorization server function, a method comprises receiving a request from a service consumer in a communication system for access to a service type and one or more resources associated with the service type. The method determines whether the service consumer is authorized to access the service type and the one or more resources associated with the service type. The method generates an access token that identifies one or more service producers for the service type and the one or more resources associated with the service type that the service consumer is authorized to access, and sends the access token to the service consumer. The service consumer can then use the access token to access the one or more services and one or more resources. In addition to such resource level access authorization, target network function group access authorization can be performed.

Abstract: According to one example embodiment, a method may include receiving, by a repository entity, first information on data related to a network entity. The method may further include storing, by the repository entity, second information related to the network entity based on the first information. The second information may include at least one of an identifier of the network entity and an identifier of a data acquiring entity having acquired the data.

Abstract: There are provided measures for (enabling/realizing) network operability on a resource instance level in (a core network of) a mobile/wireless communication system. Such measures may exemplarily comprise that an initiator entity sends a service request for a service operation on a specific resource managed by a responder entity of the network, said service request comprising at least one resource filter specifying a set of resource instances of the specific resource that the service operation is to be performed on, and receives a service response to the service request from the responder entity, said service response comprising a result of performing the service operation on the set of resource instances specified by the at least one resource filter.

Abstract: A method, for use in a network control element, is provide, the method comprising: allocating a network security function between a visited network and a home network of a user equipment, and controlling domain name system related signalling between an edge computing related network element in the visited network and a network element in the home network such that the domain name system related signalling is subjected to the network security function.

Abstract: A communication system includes a service responsible for sending signaling to a user equipment or an access network serving the user equipment. The service receives a request to send the signaling to the user equipment or the access network together with access type control information indicating whether the signaling is transmittable using any of a plurality of access types or a specific access type provided in the request. The service selectively forwards the signaling to the user equipment or the access network based on the access type control information.

Abstract: A UE activates a PS Data Off service to block downlink and uplink services except the exempted services determined by the HPLMN. To activate PS Data Off, the UE sends an indication to the MME or SGSN, or additionally to a S-CSCF or an IMS network. The UE may receive a confirmation of the PS Data Off activation and/or a list of exempt services. The MME may contact the HSS to notify about the activation of the PS Data Off and receive indication of support of the service or list of exempted services and send the indication and/or packet filtering per PDN to PDN GW(s). The PDN GW may contact a PCRF to get policy rules. The HSS may provide a list of exempt services to the S-CSCF.

Abstract: If a first condition for a handover of an analytics calculation for a user equipment by an analytics function is met, the analytics function requests, of at least one other analytics function of the communication network, preparation of the handover of the analytics calculation. If a second condition for the handover of the analytics calculation is met, the analytics function confirms the handover to one of the at least one other analytics function, the analytics calculation for the user equipment at the analytics function being deemed complete.

Abstract: There is provided an apparatus comprising at least one processor and at least one memory including a computer program code, the at least one memory and computer program code configured to, with the at least one processor, cause the apparatus at least to: receive, at a first network repository function in a first network from a security edge protection proxy in a second network, a request for discovering one or more roaming hubs and/or security edge protection proxies in the first network; and send, from the first network repository function to the security edge protection proxy in the second network, a response comprising information identifying the one or more roaming hubs and/or security edge protection proxies in the first network and information identifying one or more further networks which can be reached via a respective roaming hub and/or security edge protection proxy in the first network.

Abstract: An apparatus comprising: at least one processor; and at least one memory including computer program code; the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus at least to: send (800) a registration request comprising a range of addresses and/or ports managed by a network address and/or port translation service and an identifier of the network address and/or port translation service; and receive (804) an address and/or port translation information request comprising an address and/or port used by an application to communicate with a terminal, wherein the address and/or port used by the application to communicate with a terminal is within the range of addresses and/or ports managed by the network address and/or port translation service.

Abstract: A method, device and computer readable medium are used to support satellite access. The registration management entity of the network determines information regarding which beam covering the location of the terminal device and the corresponding timing; the terminal device triggers a registration update based on the information determined by the registration management entity. Thus, the method, device and computer readable medium can introduce less modification to the network and have good compatibility.

Abstract: Techniques for securing an identifier of user equipment for a request external to a communication network are disclosed. For example, a method comprises receiving, at a network entity, a request for identification information for user equipment from an entity external to a communication network to which the network entity belongs. The network entity generates a secure identifier for the user equipment, wherein the secure identifier comprises an encrypted form of a public subscription identifier associated with the user equipment. The network entity sends the secure identifier to the external entity. The network entity receives the secure identifier in a subsequent request from the external entity. The network entity utilizes the received secure identifier to confirm the received secure identifier corresponds to the user equipment.

Abstract: Techniques for determining a registration area are provided. A network entity may receive one or more indications of topology information from one or more radio access network nodes. Each indication of topology information is related to one or more tracking areas and each tracking area is associated with one or more cells in a radio access network served by each of the one or more radio access network nodes. The network entity may determine a registration area based at least in part on the received one or more indications of topology information related to the one or more tracking areas.

Abstract: Systems, methods, apparatuses, and computer program products for the assignment of a common edge application server (EAS) for ad-hoc groups of user equipment (UE). A method may include generating or updating binding information comprising a correlation between a group identifier of an ad-hoc group of user equipment (UE) and an edge application server (EAS) identifier assigned to the ad-hoc group, and storing, updating, and/or deleting the binding information, or causing the binding information to be stored, in a database.

Abstract: In an embodiment, there is provided an architecture for the support of user plane transactions over a mobile network between an User Equipment UE and an IP network, the mobile network comprising at least one node, referred to as control plane node, supporting control plane transactions between the UE and the mobile network over control plane bearer, the architecture includes the UE and the control plane node adapted to support user plane transactions over the mobile network between the UE and the control plane node, over control plane bearer, the control plane node adapted to support user plane transactions over the mobile network between the control plane node and the IP network without need of user plane bearer in the mobile network, the control plane node interfacing, with or without IP tunneling, with a gateway function interfacing with the IP network.

Abstract: It is provided a method comprising at least one of a) and b): a) monitoring whether a service request to produce a producer service is received and producing the producer service if the service request is received, wherein the producer service is a service produced by the access network; and b) consuming a producer service from a core network or an access network, wherein the producer service is consumed by an access network.