TECHNICAL FIELD

This relates to a method performed by a wireless device for requesting use of a network slice from a network. It also relates to wireless devices, a network node, a method performed by a network node, a User Equipment, a computer program product, and non-transitory storage media.

BACKGROUND

Generally, all terms used herein are to be interpreted according to their ordinary meaning in the relevant technical field, unless a different meaning is clearly given and/or is implied from the context in which it is used. All references to a/an/the element, apparatus, component, means, step, etc. are to be interpreted openly as referring to at least one instance of the element, apparatus, component, means, step, etc., unless explicitly stated otherwise. The steps of any methods disclosed herein do not have to be performed in the exact order disclosed, unless a step is explicitly described as following or preceding another step and/or where it is implicit that a step must follow or precede another step. Any feature of any of the embodiments disclosed herein may be applied to any other embodiment, wherever appropriate. Likewise, any advantage of any of the embodiments may apply to any other embodiments, and vice versa. Other objectives, features and advantages of the enclosed embodiments will be apparent from the following description.

3GPP is standardizing the 5G system. This is the next generation mobile network. A rough division of the 5G system splits it into three parts. The User Equipment (UE) that is operated by the subscriber. This contains both the modem or the Mobile Equipment (ME) and some tamper resistant secure hardware component that stores the subscriber credentials of the user. Examples of the tamper resistant hardware component may be a standard, removable UICC, or an embedded UICC (eUICC), or even an integrated UICC (iUICC). Another part of the 5G system is the Visited Network (VN) which operates the base station (gNB) and the Access & Mobility management function (AMF) that the UE connects to. In relation to LTE the gNB is the 5G version of eNB and the AMF is roughly the 5G version of the MME. The last part of the 5G system is the Home Network (HN). This is the network owned by the user's operator, i.e. the operator with which the user has a subscription. In case of roaming the HN and VN are logically two distinct networks while otherwise they may be part of the same network.

The 5G system will support network slices. A network slice is a logical network that provides specific network capabilities and network characteristics. Network slices are a way to separate resources between different types of services and subscribers. The user's operator provisions the tamper resistant secure hardware component of the UE with information about which slices the user is allowed to connect to. The UE is then able to select which of its allowed slices it wants to use.

To select network slices Network Slice Selection Assistance Information (NSSAI) is used.

The NSSAI and related terms are as follows:

(1) “NSSAI” is a collection of at most 8 S-NSSAIs.

(2) “S-NSSAI” is Single-NSSAI that identifies a network slice.

(3) “Allowed NSSAI” is what identifies network slices that the UE is allowed to use.

(4) “Configured NSSAI” is the NSSAI provisioned in the UE.

(5) “Requested NSSAI” is what UE provides to the network, e.g., at Registration procedure.

The S-NSSAI is composed of SST (Slice/Service Type) and SD (Slice Differentiator). The SST refers to the expected Network Slice behavior in terms of features and services while the SD is optional information that compliments the Slice/Service type(s) to differentiate amongst multiple Network Slices of the same Slice/Service type.

Currently there exists only three SST values while there may exist multiple SDs for each SST.

According to the current state of the 5G standard (which is in progress), the Requested NSSAI exists not only in the non-access stratum (NAS) layer, but also in the radio resource control (RRC) layer. The NAS layer provides communication between the UE and the AMF (transparently via the gNB), and the RRC layer provides communication between the UE and the gNB. While it is almost certain that the NAS layer will contain Requested NSSAI, the working groups in the 3GPP are still discussing whether the RRC layer will contain the Requested NSSAI or not. In this document, where it is necessary to distinguish between them, the terms Requested NSSAI-NAS and Requested NSSAI-RRC are used to refer to the Requested NSSAI in the NAS layer and in the RRC layer respectively.

3GPP TS 23.502 V1.0.0, in paragraph 4.2.2.2.33, describes a Registration procedure with AMF relocation. As can be seen at step 2 in FIG. 4.2.2.2.3-1, the initial AMF only authenticates the UE. It does not establish a NAS security context with the UE. The motivation for adding authentication without setting up a NAS security context in Step 2 was a strategy to mitigate DoS towards the target AMF.

As can be seen at steps 3 and 4 in FIG. 4.2.2.2.3-1, the Initial AMF has procedures defined with the UDM and NSSF to retrieve the Allowed NSSAI for the UE.

As can be seen at step 9 in FIG. 4.2.2.2.3-1, the target AMF again authenticates the UE, and establishes a NAS security context with the UE.

It is the Requested NSSAI that is sent by UE over-the-air that causes an issue of privacy.

Subscriber privacy is an issue in the existing LTE system. For example, it is possible for attackers to track specific subscribers by monitoring the air interface and recognizing when that subscriber's International Mobile Subscriber Identity (IMSI) is sent. The 5G system is being designed to increase subscriber privacy. For example, the Subscription Permanent Identifier (SUPI) can be sent in an encrypted form to the home network. This encryption protects the subscriber from being tracked as described above. Example of SUPI is IMSI (as e.g. defined in 3GPP TS 23.003 V 15.1.0) and NAI or any future 5G generalization of IMSI.

Similarly, just as it is a privacy issue if a single subscriber can be tracked, there is a privacy issue if a certain group can be tracked. When the Requested NSSAI is sent by UE over-the-air it leaks privacy sensitive information. For example, if a small group of people are the only ones with access to a specific slice, an attacker observing an S-NSSAI associated with this slice knows that someone from this group is present in the area of observation.

Therefore, exposure of NSSAI over-the-air is a privacy concern. As there are few possibilities for value of the SST part of NSSAI it is expected that this part is less privacy sensitive as many users will use the same SST. The main issue is expected to be the SD part which could be unique to a single individual or a small group of people.

SUMMARY

An object of the present disclosure and embodiments is to provide solutions to these or other challenges. More specifically, it is an object of some embodiments to allow a UE to indicate its selected or requested slices to a network without leaking privacy sensitive information over-the-air.

There is disclosed a method performed by a UE for requesting a network slice from a network without revealing the requested network slice while sent over-the-air, the method comprising:

a. obtaining a UE specific slice-pseudonym for the requested network slice;

b. sending the UE specific slice-pseudonym to the network.

The UE specific slice-pseudonym shall be interpreted as a pseudonym for a slice and that this pseudonym is associated with a specific UE. In other words, it is not meant to mean that it is a pseudonym for the slice which pseudonym is only used internally in the UE.

Obtaining the UE specific slice-pseudonym for the requested network slice may further comprise the UE and its home network (HN) agreeing on a mapping of a UE specific slice-pseudonym from and to a network slice.

The mapping of a UE specific slice-pseudonym from and to a network slice may further comprise the HN provisioning the mapping at the UE. A device/function/node in the HN may be a separate privacy node or Unified Data Management node, UDM. The UDM is an exemplary node in case the agreement is done by being provisioned to a USIM in a UICC/eUICC/iUICC in the UE.
A network slice may be represented as Single Network Slice Selection Information (S-NSSAI). The UE may be for example a mobile phone, a laptop, a tablet, a TV, a set-top box and a camera. The UE may also be a wearable, such as a watch, virtual reality glasses/goggles, and a fitness tracker in the form of e.g. an armband, waistband/belt and a shoe equipped with a telematics unit. The UE may also be an embedded device/telematics unit, e.g. in a 3D printer, a robot, weather station, white goods (such as a refrigerator and robot vacuum cleaner) or a vehicle (such as a fleet management system and infotainment system in the dashboard of a car or truck).
There are, proposed herein, various embodiments which address one or more of the issues disclosed herein.
According to one embodiment, there is provided a method performed by a wireless device for requesting use of a network slice from a network. The method comprises: identifying at least one network slice to be requested; based on a mapping method that is specific to the wireless device (i.e. each UE has their own mapping instead of having a shared mapping over multiple UEs), forming a slice pseudonym/network slice pseudonym for the or each network slice to be requested; and transmitting a request message to the network, wherein the request message comprises the or each slice pseudonym.

The mapping method may comprise a method for generating a slice pseudonym for each network slice that is allowed for use by the wireless device.

The mapping method may comprise a one-to-one mapping step that is known in advance to the wireless device for each network slice that is allowed for use by the wireless device.

Specifically, the mapping method may comprise performing a one-to-one mapping between a network slice identifier of the network slice to be requested and the slice pseudonym for said network slice to be requested, wherein the slice pseudonym for said network slice to be requested is specific to the wireless device. Alternatively, the mapping method may comprise: performing a one-to-one mapping between a network slice identifier of the network slice to be requested and a slice number associated with said network slice to be requested, wherein the association between network slice identifiers of the network slices and associated slice numbers is specific to the wireless device, determining a next adjacent slice number in an ordered list of slice numbers associated with network slices that are allowed for use by the wireless device, and selecting a slice pseudonym as a number between the slice number associated with said network slice to be requested and said next adjacent slice number. Alternatively, the mapping method may comprise: performing a one-to-one mapping between a network slice identifier of the network slice to be requested and an index value, and generating the slice pseudonym, for said network slice to be requested, from said index value by adding to the index value a product of a random integer and a predetermined multiplicand that is greater than or equal to the number of network slices that are allowed for use by the wireless device.

The wireless device may be a UE, for example in the form of a mobile phone, a laptop, a tablet, a TV, a set-top box and a camera. The UE may also be a wearable, such as a watch, virtual reality glasses/goggles, and a fitness tracker in the form of e.g. an armband, waistband/belt and a shoe equipped with a telematics unit. The UE may also be an embedded device/telematics unit, e.g. in a 3D printer, a robot, weather station, white goods (such as a refrigerator and robot vacuum cleaner) or a vehicle (such as a fleet management system and infotainment system in the dashboard of a car or truck).

According to another embodiment, there is provided a method performed by a network node for allocating a network slice to a wireless device. The method comprises: receiving a request message relating to a request sent by a wireless device, wherein the request message comprises at least one received slice pseudonym; and, based on a mapping method used by the wireless device that is specific to the wireless device, identifying at least one requested network slice from the or each received slice pseudonym.

The mapping method may comprise a one-to-one mapping step that is known in advance to the wireless device.

According to another embodiment, there is provided a method performed by a network node for allocating a network slice to a wireless device. The method comprises: receiving a request message sent by a wireless device, wherein the request message comprises at least one received slice pseudonym; notifying a second network node of the or each received slice pseudonym and an identifier of the wireless device; receiving from the second network node information identifying at least one requested network slice; and providing the wireless device with access to the or each requested network slice.

The network node may be a node of a network visited by the wireless device, and the second network node may then be a node of a home network of the wireless device.

Certain embodiments may provide one or more of the following technical advantage(s), namely solving the problem of how the UE can indicate its selected or requested slices to a network without leaking privacy sensitive information over-the-air. It has next to no overhead of computation, no increase in number of messages transmitted and is easy to implement. Further, certain techniques to select privacy sensitive slices might be unusable due to regulation. Some embodiments do not suffer from such regulatory issues.

