DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 08/13/2026 has been entered.
Response to Arguments
Claim Objection to claim 22A is withdrawn in light of the correction made. Applicant’s arguments/remarks made in an amendment filed August 13, 2026, have been fully considered. In view of the amended claims 1, 12, 22, 23 and 24 and upon further consideration, a new ground(s) of rejection, necessitated by the amendments is made in view of different interpretation of the previously applied references and new prior art as presented in this Office action. Applicant’s arguments with respect to claim(s) 1-4, 6-10, 12, 15, 16, 18, 20, 22-24, 26, 27 and 39 are therefore moot.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-4, 6-10, 12, 15, 16, 18, 20, 22, 23, 24, 26, 27 and 39 are rejected under 35 U.S.C. 103 as being unpatentable over US 20240056907 A1 (WU) in view of US 20230164194 A1 (Foti) and in further view of HUAWEI et al., "Clarification on Key Issue #2", S3-202749, 3GPP TSG WG3 Meeting #100bis-e, e-meeting, 12-16 October 2020, (3p) (hereinafter Huawei).
In re claims 1 and 12, WU discloses a credential transmission method (Fig. 2, [0004], “Embodiments of this application provide a security configuration method in a handover scenario and a communication apparatus, to improve communication security”), comprising: sending a first protocol data unit (PDU) session establishment request message to a base station (Fig. 2: step 1, [0129], “The UE sends a non-access stratum (NAS) message to an AMF through an NG-RAN. The NAS message includes an N1 session management (session management, SM) container, the container includes a PDU session establishment request, and the request includes information such as a PDU Session identifier” (UE sends PDU session establishment request message to base station), wherein the first PDU session establishment request message carries data network name (DNN) information (Fig. 8A-8B, [0105], “FIG. 8A and FIG. 8B are another schematic flowchart of a security configuration method in an N2 interface-based handover scenario according to an embodiment of this application”. [0346], “The N2 information includes the target cell identifier and the list of the PDU session resources. The UE context includes a subscription permanent identifier (SUPI), allowed NSSAI corresponding to the access type, a PDU session identifier, corresponding SMF information, S-NSSAI, a PCF identifier, and a data network name (DNN)”) used for obtaining a credential for accessing a stand-alone non-public network (SNPN), wherein the DNN information is used by a first core network device to verify whether a DNN corresponding to the DNN information matches a DNN determined based on login configuration data of the first core network device; and receiving, by a terminal, first indication information sent by the base station (Fig. 2: step 8, [0144], “The NG-RAN sends an RRC Connection Reconfiguration message to the UE. The message contains the UP-security activation indication information”); wherein the first indication information is determined by the base station based on security policy information from a second core network device (Fig. 2, steps 4-6, [0132], “The SMF obtains a user plane security policy”. [0133], “The SMF may obtain the user plane security policy from a UDM, or may obtain the user plane security policy from a local configuration. The user plane security policy includes a UP ciphering protection policy and/or a UP integrity protection policy”. [0136], “The SMF sends a determined user plane security policy to the AMF”. [0138], “The AMF further sends a UP security policy to the NG-RAN”. [0140], “The NG-RAN activates the user plane security according to the received-UP security policy”), the security policy information is determined by the second core network device according to a second PDU session establishment request message sent by the first core network device (Fig. 2: step 2, [0130], “The AMF (first core network) generates, based on the NAS message, a PDU session establishment request message sent to an SMF (second core network)”), and the second PDU session establishment request message at least includes the DNN information (Fig. 2: step 2, [0130], “The AMF generates, based on the NAS message, a PDU session establishment request message sent to an SMF...The message includes the N1 session management (SM) container” (includes identifier information). [0346], “The N2 information includes the target cell identifier and the list of the PDU session resources. The UE context includes a subscription permanent identifier (SUPI), allowed NSSAI corresponding to the access type, a PDU session identifier, corresponding SMF information, S-NSSAI, a PCF identifier, and a data network name (DNN)”) used for obtaining the credential for accessing the SNPN; wherein the first indication information is used for indicating that a user plane security protection operation of a data radio bearer (DRB) of the terminal is requested to be activated or not to be activated (Fig. 2: step 8, [0135], “The UP integrity protection policy can be required to enable, preferred (Preferred) to enable, or not needed to enable”. [0144], “The NG-RAN sends an RRC Connection Reconfiguration message to the UE. The message contains the UP-security activation indication information”. [0148], “Currently, for each DRB of a PDU session, the RRC connection reconfiguration message sent by the NG-RAN includes one piece of user plane security activation indication information corresponding to each DRB. A user plane security activation state of each DRB in the PDU session is the same, and may include enabling or not enabling. Enabling may also be referred to as being activated, and not enabling may be referred to as not being activated, or the like”. [0141], “For example, if the received is that a ciphering protection policy indicate to be required (required) to enable and an integrity protection policy indicate to be required to enable, the NG-RAN enables UP ciphering protection and UP integrity protection, and performs ciphering protection...” (activate). [0142], “...and the UP-integrity protection policy indicates to be not needed to enable, the NG-RAN enables UP ciphering protection, does not enable UP integrity protection, and performs ciphering protection or decipherment on the UP data between the NG-RAN and the UE” (not to activate)); and the DRB is at least used for bearing the credential required by the terminal for accessing the SNPN ([0141], “if the received is that a ciphering protection policy indicate to be required (required) to enable and an integrity protection policy indicate to be required to enable, the NG-RAN enables UP ciphering protection and UP integrity protection, and performs ciphering protection, integrity protection, decipherment, and integrity verification on the UP data between the NG-RAN and the UE by using a UP ciphering key, a UP integrity protection key, and a UP security algorithm” (if user plane protection is activated, need credential verification)).
WU does not explicitly disclose DNN used for obtaining a credential for accessing a stand-alone non-public network (SNPN), wherein the DNN information is used by a first core network device to verify whether a DNN corresponding to the DNN information matches a DNN determined based on login configuration data of the first core network device.
Foti discloses DNN used for obtaining a credential for accessing a stand-alone non-public network (SNPN) (Fig. 2, Fig. 13B, [0052], “As seen in FIG. 2, system 10 comprises a Standalone NPN (SNPN 20) comprising core NPN 12 and IMS network 14”. [0132], “In at least one embodiment, the IMS subscription data comprises an IMS DNN to access the IMS network 14 of the SNPN 20”. [0135], “FIG. 8 is a flow diagram illustrating a method 120, implemented at SMF 24, for providing a UE 18 with remote provisioning information...As previously stated, the DNN may comprise one or more of a default DNN, a DNN for a packet data network, a DNN for remote provisioning in the NPN, and a DNN for the SNPN 20. Once received, SMF 24 obtains the remote provisioning information for the UE 18 (box 124). In one embodiment, the remote provisioning information, which is associated with SNPN 20, is received in UDM subscription information obtained from the UDM”. [0096], “In one embodiment, however, the remote provisioning information returned to UE 18 in the PDU session establishment accept response message includes...authentication credentials for authenticating the UE with the remote provisioning system”), wherein the DNN information is used by a first core network device to verify whether a DNN corresponding to the DNN information matches a DNN determined based on login configuration data of the first core network device ([0069], “to enable the use of IMS voice and emergency services by UEs 18 connected to SNPN 20, the present disclosure remotely provisions the UEs 18 for the needed IMS access related information”. [0078], “...as part of the onboarding process, the selected IMS provider is provisioned with the requisite IMS subscription related information, per subscriber, depending on the agreement in place between the core NPN 12 and the IMS provider”. [0188], “As seen in FIG. 15, AMF 22 receives, from UE 18 in SNPN 20, a session establishment request message requesting to establish a Protocol Data Unit (PDU) session for the UE to a Data Network Name (DNN) (box 252). In this aspect, the session establishment request message includes pre-defined triggering information, such as a pre-defined DNN, a session establishment request type, an internet DNN, and the like”. [0111], “In line 90-2, UE 18 initiates a Packet Data Network (PDN) connection for a DNN as specified by the procedures in 3GPP TS 23.502, the UE may include the DNN for the provisioning system or may omit to include the DNN. If the UE has included the DNN, the AMF verifies if the DNN is compatible with the temporary subscription” (verification by the AMF based on DNN and subscription information provided)).
It would have been obvious for one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of WU with Foti to provide an authentication method in a handover scenario indicating to use a user plane security configuration that is same as that of a data radio bearer of the source access network node. The advantage of doing so is to reduce security risk caused by different security configurations of the data radio bearer when the target access network node and the source access network node transmit same data packet and hence improve data transmission security.
WU and Foti do not explicitly disclose DRB is at least used for bearing the credential required by the terminal for accessing a stand-alone non-public network (SNPN).
Huawei discloses DRB is at least used for bearing a credential required by the terminal for accessing the SNPN (Pages 1-3, “the UE can perform the onboarding procedure on onboarding network, and then the UE may be remotely provisioned with the SNPN credentials by Provisioning Server (PS). The SNPN credentials shall be confidentiality protected, integrity protected, and replay protected during remote provisioning”).
It would have been obvious for one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of WU and Foti with Huawei to provide a security configuration method in a handover scenario indicating to use a user plane security configuration that is of a data radio bearer and that is the same as that of a data radio bearer of the source access network node. The advantage of doing so is to reduce security risk caused by different security configurations of the data radio bearer when the target access network node and the source access network node transmit a same data packet and improve data transmission security.
In re claim 2, the combination discloses the method according to claim 1, wherein WU discloses wherein the user plane security protection operation comprises at least one of integrity protection or encryption ([0012], “In an embodiment, the user plane security of the data radio bearer includes ciphering protection and/or integrity protection”. [0133], “The SMF may obtain the user plane security policy from a UDM, or may obtain the user plane security policy from a local configuration. The user plane security policy includes a UP ciphering protection policy and/or a UP integrity protection policy”. [0145], “The UP-security activation indication information includes UP ciphering protection activation indication information and/or UP integrity protection activation indication information, the UP-ciphering protection activation indication information indicates whether to enable UP ciphering protection, and the UP-integrity protection activation indication information indicates whether to enable UP integrity protection” (user plane security protection includes integrity protection)).
In re claim 3, the combination discloses the method according to claim 1, wherein WU discloses wherein the receiving the first indication information sent by the base station comprises: receiving a radio resource control (RRC) connection reconfiguration message carrying the first indication information sent by the base station (Fig. 2: step 8, [0144], “The NG-RAN sends an RRC Connection Reconfiguration message to the UE. The message contains the UP-security activation indication information”).
In re claim 4, the combination discloses the method according to claim 3, wherein WU discloses the method further comprising: verifying the RRC connection reconfiguration message, and obtaining a result of the verifying; and determining, based on the first indication information in response to the result of the verifying indicating that the verifying is successful, whether to activate the user plane security protection operation of the DRB of the terminal ([0147], “Alternatively, the NG-RAN may indicate, in another manner, the UE whether to enable security protection (ciphering protection and/or integrity protection). For example, the RRC connection reconfiguration message carries or does not carry an information element (IE) to indicate whether the UE enables security protection or not”. [0150], “The UE activates the UP security between the UE and the base station based on the UP-security activation indication information carried in operation 8, to perform security protection or deciphering security protection on the UP data between the UE and the base station. In an embodiment, activating the UP security may include configuring a packet data convergence protocol (PDCP) entity corresponding to the DRB” (whether to activate the user plane data integrity protection may be determined based on the indication from the base station)).
In re claim 6, the combination discloses the method according to claim 4, wherein WU discloses the method further comprising: rejecting the RRC connection reconfiguration message in response to the first indication information indicating that the user plane security protection operation of the DRB of the terminal is requested not to be activated ([0126], “The user plane ciphering protection indication information indicates three possible values, which are respectively required (required), preferred (preferred), or not needed (not needed). The user plane integrity protection indication information indicates three possible values, which are respectively not needed, preferred, and required, not needed indicates that user plane security does not need to be activated, preferred indicates that user plane security may be activated or may not be activated, and required indicates that user plane security needs to be activated. The foregoing three possible values may be each indicated by using two bits (bit). For example, 00 indicates that activation is not needed...”. [0146], “For example, when the UP-security activation indication information does not carry the UP-ciphering protection activation indication information...when ciphering is not enabled... and the UP ciphering protection activation indication information notifies that the UE does not enable ciphering protection”); or in response to the first indication information indicating that the user plane security protection operation of the DRB of the terminal is requested to be activated ([0146], “For example, the UP integrity protection activation indication information may notify, by using an indication enablement (enabled), that the UE enables integrity protection”), accepting the RRC connection reconfiguration message, and performing the user plane security protection operation ([0150], “The UE activates the UP security between the UE and the base station based on the UP security activation indication information carried in operation 8, to perform security protection or deciphering security protection on the UP data between the UE and the base station. In an embodiment, activating the UP security may include configuring a packet data convergence protocol (PDCP) entity corresponding to the DRB”).
In re claim 7, the combination discloses the method according to claim 6, wherein WU discloses the method further comprising: sending an RRC connection reconfiguration completion message to the base station (Fig. 2: step 10, [0152], “The UE sends an RRC connection reconfiguration acknowledgment (ACK) message to the NG-RAN”).
In re claim 8, the combination discloses the method according to claim 1, wherein Foti discloses wherein the base station is in an onboarding network (ONN), and the method further comprises: sending second indication information to the base station during an RRC connection establishment process wherein the second indication information is used for indicating that an RRC connection being established is used for the terminal to log into the ONN (Fig. 4, [0089], “a UE 18 wishing to access IMS services sends a PDU session establishment request message to the core NPN 12 (line 62) and receives, in return, a PDU session establishment accept message (line 64). The PDU session establishment accept message includes the remote provisioning information needed by the UE 18 to access a remote provisioning system (e.g., remote provisioning system 50 or a system provided by IMS network 14)”. [0006], “The processing circuitry is configured to establish a first Protocol Data Unit (PDU) session with a pre-defined Data Network Name (DNN) for remote provisioning, initiate an onboarding procedure over the first PDU session using remote provisioning information that enables the UE to access a remote provisioning system in the pre-defined DNN... establish a second PDU session with the IMS network using the IMS subscription data”. [0010], “a session establishment request message requesting to establish a Protocol Data Unit (PDU) session for the UE to a Data Network Name (DNN), wherein the DNN comprises one of a pre-defined DNN used for remotely provisioning the UE, and an internet DNN provided by the Access and Mobility Management Function (AMF), obtaining, for the UE, remote provisioning information associated with the NPN, wherein the remote provisioning information is used by the UE to initiate an onboarding procedure that enables the UE to access the remote provisioning system” (establishing a PDU session for initiating onboarding procedure)).
In re claim 9, the combination discloses the method according to claim 8, wherein Foti discloses the method further comprising: sending, in response to the terminal initiating registration to the ONN ([0089], “The UE 18 then initiates a remote provisioning procedure at the remote provisioning system 50”), a registration request message to the base station; wherein a registration type of the registration request message is set to be a predetermined registration type ([0110], “In box 90-1, UE 18 registers with the core NPN 12 in accordance with the procedures specified in 3GPP TS 23.502 V16.4.0...”); and the predetermined registration type is used for indicating that the registration request message is used for logging into the ONN to obtain the credential ([0078], “Once the requisite IMS access related information is downloaded to the UE 18, it can be used for IMS registration and to acquire desired IMS services”. [0114], “In line 90-5, the PDU Session Establishment Accept Response message, which includes the remote provisioning related information required for UE 18 to initiate the remote provisioning procedure, is sent to UE 18”. [0120], “The UDM also obtains any relevant subscription data to allow the UE to establish a PDU session to IMS to access IMS services based on the real/actual SUPI, such as IMS DDN at a minimum”).
In re claim 10, the combination discloses the method according to claim 9, wherein Foti discloses the method further comprising: initiating, in response to the terminal logging into the ONN successfully and requiring to receive the credential via the ONN, a PDU session establishment procedure ([0005], “...initiating an onboarding procedure over the first PDU session using remote provisioning information that enables the UE to access a remote provisioning system in the pre-defined DNN, receiving, from the remote provisioning system, the UE configuration/subscription data, wherein the UE configuration/subscription data comprises Internet Protocol Multimedia Subsystem (IMS) subscription data for an IMS network associated with a Non-Public Network (NPN), and responsive to determining that a connection to the IMS network associated with the NPN is required, establishing a second PDU session with the IMS network using the IMS subscription data”. [0089], “In return, the UE 18 receives credentials (e.g., eSIM credentials) with which it can access IMS services (line 68) ...Once provisioned, the UE 18 can establish a session with the IMS network 14 and access the desired IMS services”).
In re claim 15, the combination discloses the method according to claim 12, wherein WU discloses the method further comprising: initiating, in response to sending a radio resource control the (RRC) connection reconfiguration message to the terminal, a user plane security protection operation of a DRB of the base station ([0144], “The NG-RAN sends an RRC Connection Reconfiguration message to the UE. The message contains the UP-security activation indication information”. [0145], “The UP-security activation indication information includes UP ciphering protection activation indication information and/or UP integrity protection activation indication information, the UP-ciphering protection activation indication information indicates whether to enable UP ciphering protection, and the UP-integrity protection activation indication information indicates whether to enable UP integrity protection”. [0148], “Currently, for each DRB of a PDU session, the RRC connection reconfiguration message sent by the NG-RAN includes one piece of user plane security activation indication information corresponding to each DRB”. [0150], “The UE activates the UP security between the UE and the base station based on the UP-security activation indication information carried in operation 8, to perform security protection or deciphering security protection on the UP data between the UE and the base station” (initiating the user plane security protection operation based on the indication from the base station)).
In re claim 16, the combination discloses the method according to claim 12, wherein Foti discloses the method further comprising: receiving second indication information sent by the terminal during an RRC connection establishment process, wherein the second indication information is used for indicating that an RRC connection being established is used for the terminal to log into an onboarding network (ONN); and determining, in response to receiving the second indication information, a first core network device used for supporting the terminal to log into the ONN ([0346], “S312: The NG-RAN forwards the PDU session establishment request to an access and mobility management function (AMF) network element, and after receiving the PDU session establishment request, the AMF network element forwards the PDU session establishment request to the SMF”. [0348], “S313: The SMF obtains a user plane security policy (UP security policy or user plane security enforcement information)”. [0352], “The N2 information may carry the user plane security policy obtained by the SMF in S33” (equivalent to receiving security policy information sent by the second core network device)); wherein the first core network device is configured with access control and mobility management function (AMF) login configuration data ([0351], “S314: The SMF network element sends N2 information (message) to the NG-RAN through the AMF, and the NG-RAN receives the N2 information from the SMF network element through the AMF”); and the AMF login configuration data comprises at least one of: DNN information used for obtaining the credential, or information restricting the terminal to only be configured to request to obtain the credential ([0345], “The PDU session establishment request message may include information such as a PDU session ID, a data network name (DNN), and network slice selection assistance information (NSSAI)”).
In re claim 18, the combination discloses the method according to claim 16, wherein Foti discloses the method further comprising: receiving a registration request message sent by the terminal ([0078], “Once the requisite IMS access related information is downloaded to the UE 18, it can be used for IMS registration and to acquire desired IMS services”. [0092], “In this embodiment, to accomplish such registration, UE 18 uses a well-known “temporary” SUPI”. [0108], “First, it allows the UE 18 to be assigned an “actual” unique SUPI so it can register with the NPN access network 16 and core NPN 12 using the assigned SUPI”), wherein a registration type of the registration request message is set to be a predetermined registration type ([0110], “In box 90-1, UE 18 registers with the core NPN 12 in accordance with the procedures specified in 3GPP TS 23.502 V16.4.0...”); and the predetermined registration type is used for indicating that the registration request message is used for logging into the ONN to obtain the credential ([0078], “Once the requisite IMS access related information is downloaded to the UE 18, it can be used for IMS registration and to acquire desired IMS services”. [0114], “In line 90-5, the PDU Session Establishment Accept Response message, which includes the remote provisioning related information required for UE 18 to initiate the remote provisioning procedure, is sent to UE 18”. [0120], “The UDM also obtains any relevant subscription data to allow the UE to establish a PDU session to IMS to access IMS services based on the real/actual SUPI, such as IMS DDN at a minimum”); and sending the registration request message to the first core network device ([0110], “In box 90-1, UE 18 registers with the core NPN 12 in accordance with the procedures specified in 3GPP TS 23.502 V16.4.0”...As part of the registration procedure, the AMF may contact the UDM to retrieve from the UDM the subscription data” (sending registration request to the first core network device (AMF)).
In re claim 20, the combination discloses the method according to claim 18, wherein WU discloses sending the first PDU session establishment request message to the first core network device (Fig. 2: step 1, [0129], “The UE sends a non-access stratum (NAS) message to an AMF through an NG-RAN. The NAS message includes an N1 session management (session management, SM) container, the container includes a PDU session establishment request, and the request includes information such as a PDU session identifier”).
In re claim 22, WU discloses a credential transmission method (Fig. 2, [0004], “Embodiments of this application provide a security configuration method in a handover scenario and a communication apparatus, to improve communication security”), comprising: receiving, by a first core network device, a first protocol data unit (PDU) session establishment request message sent by a base station (Fig. 2: step 1, [0129], “The UE sends a non-access stratum (NAS) message to an AMF through an NG-RAN. The NAS message includes an N1 session management (session management, SM) container, the container includes a PDU session establishment request, and the request includes information such as a PDU Session identifier” (base station sends PDU session establishment request message to AMF), wherein the first PDU session establishment request message comprises data network name (DNN) information (Fig. 8A-8B, [0105], “FIG. 8A and FIG. 8B are another schematic flowchart of a security configuration method in an N2 interface-based handover scenario according to an embodiment of this application”. [0346], “The N2 information includes the target cell identifier and the list of the PDU session resources. The UE context includes a subscription permanent identifier (SUPI), allowed NSSAI corresponding to the access type, a PDU session identifier, corresponding SMF information, S-NSSAI, a PCF identifier, and a data network name (DNN)”) used for obtaining a credential for accessing a stand-alone non-public network (SNPN), wherein the DNN information is used by the first core network device to verify whether a DNN corresponding to the DNN information matches a DNN determined based on login configuration data of the first core network device; and sending, by the first core network device, a second PDU session establishment request message to a second core network device (Fig. 2: step 2, [0130], “The AMF generates, based on the NAS message, a PDU session establishment request message sent to an SMF”), wherein the second PDU session establishment request message at least includes the DNN information used for obtaining the credential ([0130], “...The message includes the N1 session management (SM) container” (includes identifier information). [0346], “The N2 information includes the target cell identifier and the list of the PDU session resources. The UE context includes a subscription permanent identifier (SUPI), allowed NSSAI corresponding to the access type, a PDU session identifier, corresponding SMF information, S-NSSAI, a PCF identifier, and a data network name (DNN)”), the second PDU session establishment request message is used for the second core network device to determine security policy information (Fig. 2, steps 4-6, [0132], “The SMF obtains a user plane security policy”. [0133], “The SMF may obtain the user plane security policy from a UDM, or may obtain the user plane security policy from a local configuration. The user plane security policy includes a UP ciphering protection policy and/or a UP integrity protection policy”. [0136], “The SMF sends a determined user plane security policy to the AMF”. [0138], “The AMF further sends a UP security policy to the NG-RAN”), and the security policy information is used for the base station to determine first indication information (Fig. 2: step 8, [0140], “The NG-RAN activates the user plane security according to the received-UP security policy”. [0144], “The NG-RAN sends an RRC Connection Reconfiguration message to the UE. The message contains the UP-security activation indication information”. [0143], “For another example, when the UP-ciphering protection policy or the UP-integrity protection policy is preferred to enable, the NG-RAN may determine whether to enable UP ciphering or not to enable UP ciphering, or enable UP integrity protection or not. In this case, the NG-RAN may send a determined d UP activation result to the SMF”), wherein the first indication information is used for indicating that a user plane security protection operation of a data radio bearer (DRB) of a terminal is requested to be activated or not to be activated ([0135], “The UP-integrity protection policy can be required to enable, preferred (Preferred) to enable, or not needed to enable”. [0148], “Currently, for each DRB of a PDU session, the RRC connection reconfiguration message sent by the NG-RAN includes one piece of user plane security activation indication information corresponding to each DRB. A user plane security activation state of each DRB in the PDU session is the same, and may include enabling or not enabling. Enabling may also be referred to as being activated, and not enabling may be referred to as not being activated, or the like”. [0141], “For example, if the received is that a ciphering protection policy indicate to be required (required) to enable and an integrity protection policy indicate to be required to enable, the NG-RAN enables UP ciphering protection and UP integrity protection, and performs ciphering protection...” (activate). [0142], “...and the UP-integrity protection policy indicates to be not needed to enable, the NG-RAN enables UP ciphering protection, does not enable UP integrity protection, and performs ciphering protection or decipherment on the UP data between the NG-RAN and the UE” (not to activate)); and the DRB is at least used for bearing the credential required by the terminal for accessing the SNPN ([0141], “if the received is that a ciphering protection policy indicate to be required (required) to enable and an integrity protection policy indicate to be required to enable, the NG-RAN enables UP ciphering protection and UP integrity protection, and performs ciphering protection, integrity protection, decipherment, and integrity verification on the UP data between the NG-RAN and the UE by using a UP ciphering key, a UP integrity protection key, and a UP security algorithm” (if user plane protection is activated, need credential verification)).
WU does not explicitly disclose DNN used for obtaining a credential for accessing a stand-alone non-public network (SNPN), wherein the DNN information is used by a first core network device to verify whether a DNN corresponding to the DNN information matches a DNN determined based on login configuration data of the first core network device.
Foti discloses DNN used for obtaining a credential for accessing a stand-alone non-public network (SNPN) (Fig. 2, Fig. 13B, [0052], “As seen in FIG. 2, system 10 comprises a Standalone NPN (SNPN 20) comprising core NPN 12 and IMS network 14”. [0132], “In at least one embodiment, the IMS subscription data comprises an IMS DNN to access the IMS network 14 of the SNPN 20”. [0135], “FIG. 8 is a flow diagram illustrating a method 120, implemented at SMF 24, for providing a UE 18 with remote provisioning information...As previously stated, the DNN may comprise one or more of a default DNN, a DNN for a packet data network, a DNN for remote provisioning in the NPN, and a DNN for the SNPN 20. Once received, SMF 24 obtains the remote provisioning information for the UE 18 (box 124). In one embodiment, the remote provisioning information, which is associated with SNPN 20, is received in UDM subscription information obtained from the UDM”. [0096], “In one embodiment, however, the remote provisioning information returned to UE 18 in the PDU session establishment accept response message includes...authentication credentials for authenticating the UE with the remote provisioning system”), wherein the DNN information is used by a first core network device to verify whether a DNN corresponding to the DNN information matches a DNN determined based on login configuration data of the first core network device ([0069], “to enable the use of IMS voice and emergency services by UEs 18 connected to SNPN 20, the present disclosure remotely provisions the UEs 18 for the needed IMS access related information”. [0078], “...as part of the onboarding process, the selected IMS provider is provisioned with the requisite IMS subscription related information, per subscriber, depending on the agreement in place between the core NPN 12 and the IMS provider”. [0188], “As seen in FIG. 15, AMF 22 receives, from UE 18 in SNPN 20, a session establishment request message requesting to establish a Protocol Data Unit (PDU) session for the UE to a Data Network Name (DNN) (box 252). In this aspect, the session establishment request message includes pre-defined triggering information, such as a pre-defined DNN, a session establishment request type, an internet DNN, and the like”. [0111], “In line 90-2, UE 18 initiates a Packet Data Network (PDN) connection for a DNN as specified by the procedures in 3GPP TS 23.502, the UE may include the DNN for the provisioning system or may omit to include the DNN. If the UE has included the DNN, the AMF verifies if the DNN is compatible with the temporary subscription” (verification by the AMF based on DNN and subscription information provided)).
It would have been obvious for one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of WU with Foti to provide an authentication method in a handover scenario indicating to use a user plane security configuration that is same as that of a data radio bearer of the source access network node. The advantage of doing so is to reduce security risk caused by different security configurations of the data radio bearer when the target access network node and the source access network node transmit same data packet and hence improve data transmission security.
WU and Foti do not explicitly disclose DRB is at least used for bearing the credential required by the terminal for accessing a stand-alone non-public network (SNPN).
Huawei discloses DRB is at least used for bearing a credential required by the terminal for accessing the SNPN (Pages 1-3, “the UE can perform the onboarding procedure on onboarding network, and then the UE may be remotely provisioned with the SNPN credentials by Provisioning Server (PS). The SNPN credentials shall be confidentiality protected, integrity protected, and replay protected during remote provisioning”).
It would have been obvious for one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of WU and Foti with Huawei to provide a security configuration method in a handover scenario indicating to use a user plane security configuration that is of a data radio bearer and that is the same as that of a data radio bearer of the source access network node. The advantage of doing so is to reduce security risk caused by different security configurations of the data radio bearer when the target access network node and the source access network node transmit a same data packet and improve data transmission security.
In re claim 39, the combination discloses the method according to claim 22, wherein Foti discloses the method further comprising: receiving, by the first core network device, a registration request message sent by the base station (Fig. 6, [0108], “First, it allows the UE 18 to be assigned an “actual” unique SUPI so it can register with the NPN access network 16 and core NPN 12 using the assigned SUPI”. [0123], “In box 90-14, the UE 18 initiates a new registration with the core NPN 12 using the newly assigned SUPI and performs authentication”. [0147], “UDM issues a UE Update Procedure to request the UE to re-register and initiate onboarding” (receives registration request via the base station from UE)); wherein a registration type of the registration request message is set to be a predetermined registration type ([0110], “In box 90-1, UE 18 registers with the core NPN 12 in accordance with the procedures specified in 3GPP TS 23.502 V16.4.0...”); and the predetermined registration type is used for indicating that the registration request message is used for the terminal to log into an onboarding network (ONN) to obtain the credential required by the terminal for accessing the SNPN ([0078], “Once the requisite IMS access related information is downloaded to the UE 18, it can be used for IMS registration and to acquire desired IMS services”. [0114], “In line 90-5, the PDU Session Establishment Accept Response message, which includes the remote provisioning related information required for UE 18 to initiate the remote provisioning procedure, is sent to UE 18”. [0120], “The UDM also obtains any relevant subscription data to allow the UE to establish a PDU session to IMS to access IMS services based on the real/actual SUPI, such as IMS DDN at a minimum”).
In re claim 23, the combination discloses the method according to claim 39, wherein Foti discloses the method further comprising: initiating, in response to receiving the registration request message, a procedure for authenticating the terminal ([0120], “In box 90-11, the UDM 26 obtains, from a node in the IMS network 14 (including the eSIM provisioning system), directly or via NEF, real provisioning information that includes creation of an access related subscription associated with the actual/real SUPI of the UE and would enable the UE to perform a new registration with the real SUPI and be authenticated and establishment of PDU sessions to allowed DDNs. The UDM also obtains any relevant subscription data to allow the UE to establish a PDU session to IMS to access IMS services based on the real/actual SUPI, such as IMS DDN at a minimum”. [0123], “In box 90-14, the UE 18 initiates a new registration with the core NPN 12 using the newly assigned SUPI and performs authentication”) wherein WU discloses to an authentication service function (AUSF) in the ONN ([0116], “The data may be used for authentication and authorization when the terminal device accesses a carrier network. The AUSF is mainly responsible for a function of authenticating the terminal device”).
In re claim 24, the combination discloses the method according to claim 23, wherein Foti discloses determining, based on the DNN determined according to the DNN information in the first PDU session establishment request message and a DNN determined according to DNN information in access control and mobility management function (AMF) login configuration data, whether the terminal requests an establishment of a PDU session for obtaining the credential ([0188], “As seen in FIG. 15, AMF 22 receives, from UE 18 in SNPN 20, a session establishment request message requesting to establish a Protocol Data Unit (PDU) session for the UE to a Data Network Name (DNN) (box 252). In this aspect, the session establishment request message includes pre-defined triggering information, such as a pre-defined DNN, a session establishment request type, an internet DNN, and the like”. [0095], “In box 80-5, upon receiving the message from the AMF 22, SMF 24 fetches the session subscription related information for the UE 18 from UDM 26. According to the present embodiments, the session subscription related information received from the UDM 26 includes remote provisioning information and eSIM enabling triggering information. The remote provisioning information is sent by UDM 26 to SMF 24 in the UDM session subscription information as transparent information to be transported to UE 18 in the PDU session establishment accept response message”. [0111], “In line 90-2, UE 18 initiates a Packet Data Network (PDN) connection for a DNN as specified by the procedures in 3GPP TS 23.502, the UE may include the DNN for the provisioning system or may omit to include the DNN. If the UE has included the DNN, the AMF verifies if the DNN is compatible with the temporary subscription”. [0097], “In line 80-6, the PDU Session Establishment Accept Response, which includes the remote provisioning related information required for UE 18 to initiate the remote provisioning procedure, is sent to UE 18” (establishment of PDU session on verification)).
In re claim 26, the combination discloses the method according to claim 24, wherein Foti discloses wherein the determining, whether the terminal requests the establishment of the PDU session for obtaining the credential comprises: rejecting, in response to the DNN determined according to the DNN information in the first PDU session establishment request message not matching with the DNN determined according to the DNN information in the AMF login configuration data, the first PDU session establishment request message ([0069], “to enable the use of IMS voice and emergency services by UEs 18 connected to SNPN 20, the present disclosure remotely provisions the UEs 18 for the needed IMS access related information”. [0078], “...as part of the onboarding process, the selected IMS provider is provisioned with the requisite IMS subscription related information, per subscriber, depending on the agreement in place between the core NPN 12 and the IMS provider”. [0188], “As seen in FIG. 15, AMF 22 receives, from UE 18 in SNPN 20, a session establishment request message requesting to establish a Protocol Data Unit (PDU) session for the UE to a Data Network Name (DNN) (box 252). In this aspect, the session establishment request message includes pre-defined triggering information, such as a pre-defined DNN, a session establishment request type, an internet DNN, and the like”. [0111], “In line 90-2, UE 18 initiates a Packet Data Network (PDN) connection for a DNN as specified by the procedures in 3GPP TS 23.502, the UE may include the DNN for the provisioning system or may omit to include the DNN. If the UE has included the DNN, the AMF verifies if the DNN is compatible with the temporary subscription” (it is implicit that if the verification information does not match and authentication fails, PDU session request will be rejected to access SNPN)); or determining, in response to the DNN determined according to the DNN information in the first PDU session establishment request message matching with the DNN determined according to the DNN information in the AMF login configuration data, a second core network device connected to the DNN ([0111], “If the UE has included the DNN, the AMF verifies if the DNN is compatible with the temporary subscription”. [0112], “If the AMF had provided a DNN for remote provisioning for the temporary SUPI, and optionally an indication that the UE is using a temporary SUPI, the SMF may verify if the DNN is compatible with a configured DNN for remote provisioning if one is configured determines that the UE can only transmit traffic over the PDU session for provisioning and may provide as part of remote provisioning information, packet filters for uplink to the UE in the PDU session establishment accept message and may also provide an identification of the remote provisioning system server”. [0113], “In box 90-4, SMF 24 fetches the session subscription related information associated with the UE's 18 registered temporary SUPI. The session subscription related information includes eSIM remote provisioning information for the temporary SUPI, and is sent to the SMF 24 by UDM 26 as either transparent information to be transported to UE 18 as remote provisioning information in the PDU Session Establishment Accept response message” (SMF connects to the DNN on verification)).
In re claim 27, the combination discloses the method according to claim 26, wherein Foti discloses wherein further comprising: sending, in response to determining the second core network device, a second PDU session establishment request message to the second core network device, wherein the second PDU session establishment request message carries information of the DNN, and creation indication information for creating the PDU session used for obtaining the credential; or sending, in response to determining the second core network device, a third PDU session establishment request message to the second core network device, wherein the third PDU session establishment request message carries information of the DNN, and does not carry creation indication information for creating the PDU session used for obtaining the credential ([0195], “The PDU session establishment module/unit 294 is configured to establish PDU sessions with the core NPN 12 and IMS network 14, as previously described. The registration/deregistration module/unit 296 is configured to deregister and reregister UE 18 from NPN access network 16, as previously described”. [0120], “In box 90-11, the UDM 26 obtains, from a node in the IMS network 14 (including the eSIM provisioning system), directly or via NEF, real provisioning information that includes creation of an access related subscription associated with the actual/real SUPI of the UE and would enable the UE to perform a new registration with the real SUPI and be authenticated and establishment of PDU sessions to allowed DDNs. The UDM also obtains any relevant subscription data to allow the UE to establish a PDU session to IMS to access IMS services based on the real/actual SUPI, such as IMS DDN at a minimum”. [0123], “In box 90-14, the UE 18 initiates a new registration with the core NPN 12 using the newly assigned SUPI and performs authentication” (registration/deregistration process can go on depending on access needed for IMS services by the UE. All features covered in claim 26. See “In re claim 26”. Based on authentication, if DNN credentials matches a third PDU session establishment is made with the second core network and so on...)).
Contact
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SWATI JAIN whose telephone number is (571)270-0699. The examiner can normally be reached Mon - Fri (830 am - 530 pm).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Pan Yuwen can be reached on 571-272-7855. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/SWATI JAIN/Examiner, Art Unit 2649
Prosecution Insights