WO2022167083A1

WO2022167083A1 - Handling of unsuccessful authentication with a data network

Info

Publication number: WO2022167083A1
Application number: PCT/EP2021/052746
Authority: WO
Inventors: Ashok Kumar Nayak; Laurent Thiebaut; Bruno Landais
Original assignee: Nokia Technologies Oy
Current assignee: Nokia Technologies Oy
Priority date: 2021-02-05
Filing date: 2021-02-05
Publication date: 2022-08-11
Anticipated expiration: 2023-08-05

Abstract

There are provided measures for handling of unsuccessful authentication with a data network. Such measures exemplarily comprise, at an access and mobility management function entity of a mobile communications network, receiving, from a session management function entity of said mobile communications network, a message indicative of rejection of a session establishment of a terminal to a data network, wherein said message includes a reason for rejection of said session establishment of said terminal to said data network, and transmitting, towards a policy control function entity of said mobile communications network, a policy control update request message indicative of that said terminal is not allowed to access said data network.

Description

Title

Handling of unsuccessful authentication with a data network

Field

Various example embodiments relate to handling of unsuccessful authentication with a data network. More specifically, various example embodiments exemplarily relate to measures (including methods, apparatuses and computer program products) for realizing handling of unsuccessful authentication with a data network.

Background

The present specification generally relates to authorization and authentication as measures for improving security in mobile network communications.

Telecommunication networks are evolving rapidly across a broad technological environment which includes virtualization, loT and Industry 4.0. This is met by an equally broad yet deteriorating cybersecurity environment.

Advances in technology, together with the broader development of networks of 5^th Generation (5G) radio access networks (RAN) and beyond, are expected to have a significant impact on security.

Security plays an important role in 5G system (5GS) that brings security improvements with respect to previous generations. Apart from a primary authentication which devices goes through while registering with the 5G network, 5GS has an optional authentication and authorization mechanism before a terminal such as a user equipment (UE) is allowed to access some data network (DN). i nis new concept in

is called "Secondary authentication/authorization by a DN-AAA server during PDU Session" and is defined e.g. in technical specification (TS) 23.501.

According to clause 5.6.6 of this technical specification, at protocol data unit (PDU) session establishment to a DN, the DN-specific identity (TS 33.501) of a UE may be authenticated/authorized by the DN. Here, the data network authentication, authorization, and accounting (DN-AAA) server may belong to the 5G core network (5GC) or to the DN. If the UE provides authentication/authorization information corresponding to a DN-specific identity during the establishment of the PDU session, and the session management function (SMF) determines that secondary authentication/authorization of the PDU session establishment is required based on the SMF policy associated with the DN, the SMF passes the authentication/authorization information of the UE to the DN-AAA server. The DN-AAA server may then authenticate/authorize the PDU session establishment.

The secondary authentication/authorization procedure is defined in TS 23.502, clause 4.3.2.3, and in TS 33.501, clause 11.

Further, according to TS 23.501 and TS 23.503, clause 6.6.2, a UE is provided with a UE route selection policy (UR.SP).

In particular, a UE is provided with UR.SP rules from a policy and charging function (PCF) e.g. during registration procedure, or the UE may receive UR.SP rules from the PCF any time once it has been registered to a 3GPP network. UE uses the UR.SP to determine which PDU session to use to carry the traffic of an application and if needed to decide upon establishing a PDU session.

Currently, for security purposes, if a data network name (DNN) has been marked for secondary authentication/authorization for the subscriber in unified data management (UDM), or an SMF has a local policy (TS 23.501, clause 5.6.6) for secondary autnentication/autnorization or the DN for which a UE is trying to establish a PDU session, then the secondary authentication/authorization procedure with respect to the PDU session establishment is executed. After successful authentication/authorization from the DN-AAA server, the PDU session is established.

However, if a DN-AAA server is not configured with the DN-specific identity or EAP identify of the UE, the secondary authentication/authorization fails, and the PDU session is rejected. As the UE-side UR.SP remains unchanged in such case, the UE would continue to use the same DNN in the future, and, the PDU session would be rejected again. A repetition of the UE trying to establish a PDU session, execution of the secondary authentication/authorization procedure, failure of the secondary authentication/authorization procedure, and rejection of the PDU session would be a result. Consequently, many signaling messages are consumed, which leads to unnecessary usage of radio and as well core resources.

Hence, the problem arises that required secondary authentication/authorization in the course of a PDU session establishment by a terminal to a DN leads to waste of radio and core network resources in a case that the terminal is configured to utilize a route including the DN, while the competent AAA server is not configured with an identity of the terminal or does not allow access to the DN for another reason. This may happen e.g. because the user authorization to access the DN has been removed at the DN level but not yet at 3GPP (5GC) level.

Hence, there is a need to provide for handling of unsuccessful authentication with a data network.

Various example embodiments aim at addressing at least part of the above issues and/or problems and drawbacks. Various aspects of example embodiments are set out in the appended claims.

According to an exemplary aspect, there is provided a method of a session management function entity of a mobile communications network, comprising receiving, from an authentication and authorization entity with respect to a data network, a message indicative of that a terminal is not allowed to access said data network, wherein said message includes a reason for non-allowance of said terminal to access said data network, further comprising deciding to reject a session establishment of said terminal to said data network, and transmitting, towards an access and mobility management function entity of said mobile communications network, a message indicative of rejection of said session establishment of said terminal to said data network, wherein said message includes a reason for rejection of said session establishment of said terminal to said data network based on said reason for non-allowance of said terminal to access said data network.

According to an exemplary aspect, there is provided a method of an access and mobility management function entity of a mobile communications network, comprising receiving, from a session management function entity of said mobile communications network, a message indicative of rejection of a session establishment of a terminal to a data network, wherein said message includes a reason for rejection of said session establishment of said terminal to said data network, further comprising transmitting, towards a policy control function entity of said mobile communications network, a policy control update request message indicative of that said terminal is not allowed to access said data network.

According to an exemplary aspect, there is provided a method of an access and mobility management function entity of a mobile communications network, comprising receiving, from a terminal, a session establishment request requesting a session establishment between said terminal and a data network, determining whether said terminal has a subscription for said data network, and transmitting, towards a policy control runction entity of said mobile communications network, based on a result of said determining, a policy control update request message indicative of that said terminal is not allowed to access said data network.

According to an exemplary aspect, there is provided a method of a policy control function entity of said mobile communications network, comprising receiving, from an access and mobility management function entity of said mobile communications network, a policy control update request message indicative of that said terminal is not allowed to access a data network, modifying, based on said policy control update request message, entries related to said data network in a terminal route selection policy of said terminal, and transmitting said terminal route selection policy towards said terminal.

According to an exemplary aspect, there is provided an apparatus of a session management function entity of a mobile communications network, comprising receiving circuitry configured to receive, from an authentication and authorization entity with respect to a data network, a message indicative of that a terminal is not allowed to access said data network, wherein said message includes a reason for non-allowance of said terminal to access said data network, further comprising deciding circuitry configured to decide to reject a session establishment of said terminal to said data network, and transmitting circuitry configured to transmit, towards an access and mobility management function entity of said mobile communications network, a message indicative of rejection of said session establishment of said terminal to said data network, wherein said message includes a reason for rejection of said session establishment of said terminal to said data network based on said reason for non-allowance of said terminal to access said data network.

According to an exemplary aspect, there is provided an apparatus of an access and mobility management function entity of a mobile communications network, comprising receiving circuitry configured to receive, from a session management function entity or saio moone communications network, a message indicative of rejection of a session establishment of a terminal to a data network, wherein said message includes a reason for rejection of said session establishment of said terminal to said data network, further comprising transmitting circuitry configured to transmit, towards a policy control function entity of said mobile communications network, a policy control update request message indicative of that said terminal is not allowed to access said data network.

According to an exemplary aspect, there is provided an apparatus of an access and mobility management function entity of a mobile communications network, comprising receiving circuitry configured to receive, from a terminal, a session establishment request requesting a session establishment between said terminal and a data network, determining circuitry configured to determine whether said terminal has a subscription for said data network, and transmitting circuitry configured to transmit, towards a policy control function entity of said mobile communications network, based on a result of said determining circuitry, a policy control update request message indicative of that said terminal is not allowed to access said data network.

According to an exemplary aspect, there is provided an apparatus of a policy control function entity of said mobile communications network, comprising receiving circuitry configured to receive, from an access and mobility management function entity of said mobile communications network, a policy control update request message indicative of that said terminal is not allowed to access a data network, modifying circuitry configured to modify, based on said policy control update request message, entries related to said data network in a terminal route selection policy of said terminal, and transmitting circuitry configured to transmit said terminal route selection policy towards said terminal.

According to an exemplary aspect, there is provided an apparatus of a session management function entity of a mobile communications network, comprising at least one processor, at least one memory mciuomg computer program code, and at least one interface configured for communication with at least another apparatus, the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform receiving, from an authentication and authorization entity with respect to a data network, a message indicative of that a terminal is not allowed to access said data network, wherein said message includes a reason for non-allowance of said terminal to access said data network, deciding to reject a session establishment of said terminal to said data network, and transmitting, towards an access and mobility management function entity of said mobile communications network, a message indicative of rejection of said session establishment of said terminal to said data network, wherein said message includes a reason for rejection of said session establishment of said terminal to said data network based on said reason for non-allowance of said terminal to access said data network.

According to an exemplary aspect, there is provided an apparatus of an access and mobility management function entity of a mobile communications network, comprising at least one processor, at least one memory including computer program code, and at least one interface configured for communication with at least another apparatus, the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform receiving, from a session management function entity of said mobile communications network, a message indicative of rejection of a session establishment of a terminal to a data network, wherein said message includes a reason for rejection of said session establishment of said terminal to said data network, and transmitting, towards a policy control function entity of said mobile communications network, a policy control update request message indicative of that said terminal is not allowed to access said data network.

According to an exemplary aspect, there is provided an apparatus of an access and mobility management function entity of a mobile communications network, comprising at least one processor, at least one memory including computer program code, and at least one interface configured for communication with at least another apparatus, the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform receiving, from a terminal, a session establishment request requesting a session establishment between said terminal and a data network, determining whether said terminal has a subscription for said data network, and transmitting, towards a policy control function entity of said mobile communications network, based on a result of said determining, a policy control update request message indicative of that said terminal is not allowed to access said data network.

According to an exemplary aspect, there is provided an apparatus of a policy control function entity of said mobile communications network, comprising at least one processor, at least one memory including computer program code, and at least one interface configured for communication with at least another apparatus, the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform receiving, from an access and mobility management function entity of said mobile communications network, a policy control update request message indicative of that said terminal is not allowed to access a data network, modifying, based on said policy control update request message, entries related to said data network in a terminal route selection policy of said terminal, and transmitting said terminal route selection policy towards said terminal.

According to an exemplary aspect, there is provided a computer program product comprising computer-executable computer program code which, when the program is run on a computer (e.g. a computer of an apparatus according to any one of the aforementioned apparatus-related exemplary aspects of the present disclosure), is configured to cause the computer to carry out the method according to any one of the aforementioned method- related exemplary aspects of the present disclosure. Such computer program product may comprise (or be embodied) a (tangible) computer-readable (storage) medium or the like on which the computerexecutable computer program code is stored, and/or the program may be directly loadable into an internal memory of the computer or a processor thereof.

Any one of the above aspects enables an efficient avoidance of waste of radio and core network resources in particular in the above-outlined scenarios to thereby solve at least part of the problems and drawbacks identified in relation to the prior art.

By way of example embodiments, there is provided handling of unsuccessful authentication with a data network. More specifically, by way of example embodiments, there are provided measures and mechanisms for realizing handling of unsuccessful authentication with a data network.

Thus, improvement is achieved by methods, apparatuses and computer program products enabling/realizing handling of unsuccessful authentication with a data network.

Brief description of the drawings

In the following, the present disclosure will be described in greater detail by way of non-limiting examples with reference to the accompanying drawings, in which

Figure 1 is a block diagram illustrating an apparatus according to example embodiments,

Figure 2 is a block diagram illustrating an apparatus according to example embodiments, Figure 3 is a block diagram illustrating an apparatus according to example embodiments,

Figure 4 is a block diagram illustrating an apparatus according to example embodiments,

Figure 5 is a block diagram illustrating an apparatus according to example embodiments,

Figure 6 is a block diagram illustrating an apparatus according to example embodiments,

Figure 7 is a block diagram illustrating an apparatus according to example embodiments,

Figure 8 is a schematic diagram of a procedure according to example embodiments,

Figure 9 is a schematic diagram of a procedure according to example embodiments,

Figure 10 is a schematic diagram of a procedure according to example embodiments,

Figure 11 is a schematic diagram of a procedure according to example embodiments,

Figure 12 shows a schematic diagram of signaling sequences according to example embodiments, and

Figure 13 is a block diagram alternatively illustrating apparatuses according to example embodiments. Detailed description

The present disclosure is described herein with reference to particular nonlimiting examples and to what are presently considered to be conceivable embodiments. A person skilled in the art will appreciate that the disclosure is by no means limited to these examples, and may be more broadly applied.

It is to be noted that the following description of the present disclosure and its embodiments mainly refers to specifications being used as non-limiting examples for certain exemplary network configurations and deployments. Namely, the present disclosure and its embodiments are mainly described in relation to 3GPP specifications being used as non-limiting examples for certain exemplary network configurations and deployments. As such, the description of example embodiments given herein specifically refers to terminology which is directly related thereto. Such terminology is only used in the context of the presented non-limiting examples, and does naturally not limit the disclosure in any way. Rather, any other communication or communication related system deployment, etc. may also be utilized as long as compliant with the features described herein.

Further, is to be noted that in the following description of the present disclosure and its embodiments, using a DN-AAA is taken as an example only, and any DN authentication support mechanism may apply here, e.g., when the interface between the SMF and the DN authentication & authorization server is not based on AAA protocols like Radius and Diameter. Likewise, while "AAA" may imply an accounting ability/functionality, the present disclosure and its embodiments is not limited to a respective entity having mandatorily such accounting ability/functionality, i.e., referring below to some AAA entity does not mean that such accounting ability/functionality is required for the respective responsible entity according to example embodiments and that the (DN) entity is actually carrying out accounting (in other words, an AAA entity mentioned below may have authentication and authorization abi lities/runctionai ities only out no accounting ability/functionality).

Hereinafter, various embodiments and implementations of the present disclosure and its aspects or embodiments are described using several variants and/or alternatives. It is generally noted that, according to certain needs and constraints, all of the described variants and/or alternatives may be provided alone or in any conceivable combination (also including combinations of individual features of the various variants and/or alternatives).

According to example embodiments, in general terms, there are provided measures and mechanisms for (enabling/realizing) handling of unsuccessful authentication with a data network.

Example embodiments are described below in general terms.

In general, according to example embodiments, the PCF is triggered to update the UR.SP rules after the UE (as an example of a terminal) has requested the establishment of a PDU session towards e.g. a DN identified by a DNN or a network slice identified by a single network slice selection assistance information (S-NSSAI), which the UE is not allowed to access.

A high level description of the procedure according to example embodiments in case of unsuccessful authentication/authorization by the DN-AAA server is given below.

Namely, during secondary authentication/authorization with the DN-AAA server, if the DN-AAA server determines that the UE is not allowed to access this particular DN (any more), the DN-AAA server indicates this with an appropriate failure reason to the SMF. Subsequently, the SMF provides an indication tnat tne uE is not allowed (permanently) to access the DN(N) to AMF. According to example embodiments, the AMF relays such indication to the PCF. According to further example embodiments, the PCF is informed thereof by not just relaying the indication but by transmitting a different message indicative of that the UE is not allowed (permanently) to access the DN(N).

According to example embodiments, the PCF then updates the UR.SP by removing the DNN from the potential PDU sessions the UE may try to establish.

The PCF that updates the UR.SP rules on the UE is the PCF interfacing with the AMF; so that PCF may be different from a PCF interfacing with the SMF.

In case of roaming, the information from the AMF is relayed to the PCF in the home public land mobile network (HPLMN) via the PCF in the visited public land mobile network (VPLMN).

According to further example embodiments, the PCF or SMF raises an alarm towards the operations, administration and maintenance (OAM), as the subscription data of the UE may need an update.

Example embodiments described above are discussed below in other words.

Figure 1 is a block diagram illustrating an apparatus according to example embodiments. The apparatus may be a network entity or network node 10 such as a session management function entity of a mobile communications network comprising a receiving circuitry 11, a deciding circuitry 12, and a transmitting circuitry 13. The receiving circuitry 11 receives, from an authentication and authorization entity with respect to a data network (which may e.g. be an authentication, authorization, and accounting entity with respect to said data network), a message indicative of that a terminal is not allowed to access said data network. Here, the message includes a reason for non-allowance of said terminal to access a oata network. The deciding circuitry 12 decides to reject a session establishment of said terminal to said data network. The transmitting circuitry 13 transmits, towards an access and mobility management function entity of said mobile communications network, a message indicative of rejection of said session establishment of said terminal to said data network. Here, the message includes a reason for rejection of said session establishment of said terminal to said data network based on said reason for non-allowance of said terminal to access said data network. Figure 8 is a schematic diagram of a procedure according to example embodiments. The apparatus according to Figure 1 may perform the method of Figure 8 but is not limited to this method. The method of Figure 8 may be performed by the apparatus of Figure 1 but is not limited to being performed by this apparatus.

As shown in Figure 8, a procedure according to example embodiments comprises an operation of receiving (S81), from an authentication and authorization entity with respect to a data network, a message indicative of that a terminal is not allowed to access said data network, wherein said message includes a reason for non-allowance of said terminal to access a data network, an operation of deciding (S82) to reject a session establishment of said terminal to said data network, and an operation of transmitting (S83), towards an access and mobility management function entity of said mobile communications network, a message indicative of rejection of said session establishment of said terminal to said data network, wherein said message includes a reason for rejection of said session establishment of said terminal to said data network based on said reason for non-allowance of said terminal to access said data network.

In an embodiment at least some of the functionalities of the apparatus shown in Figure 1 may be shared between two physically separate devices forming one operational entity. Therefore, the apparatus may be seen to depict the operational entity comprising one or more physically separate devices for executing at least some of the described processes. According to a variation of the procedure shown in Figure 8, exemplary additional operations are given, which are inherently independent from each other as such. According to such variation, an exemplary method according to example embodiments may comprise an operation of transmitting, towards an operation and maintenance entity of said mobile communications network, an alarm message indicative of that said terminal is not allowed to access said data network, said alarm message including an identifier of said terminal and information on said data network.

According to further example embodiments, said message is indicative of that said terminal is permanently not allowed to access said data network.

According to further example embodiments, said mobile communications network is a 3GPP network. The 3GPP network may be a 3GPP 5G network. The 3GPP network may be a future 3GPP communication network, e.g. a 3GPP network of a later generation, e.g. a 3GPP 6G network.

Alternatively, or in addition, according to further example embodiments, said session establishment of said terminal to said data network is a protocol data unit session establishment.

Alternatively, or in addition, according to further example embodiments, said authentication and authorization entity with respect to said data network is an authentication and authorization entity of said data network (which may e.g. be an authentication, authorization, and accounting entity of said data network) or is an authentication and authorization entity of said mobile communications network (which may e.g. be an authentication, authorization, and accounting entity of said mobile communications network).

Figure 2 is a block diagram illustrating an apparatus according to example embodiments. The apparatus may be a network entity or network node 20 such as an access and mobility management function entity of a mobile communications network comprising a receiving circuitry 21 and a transmitting circuitry 22. The receiving circuitry 21 receives, from a session management function entity of said mobile communications network, a message indicative of rejection of a session establishment of a terminal to a data network. Here, the message includes a reason for rejection of said session establishment of said terminal to said data network. The transmitting circuitry 22 transmits, towards a policy control function entity of said mobile communications network, a policy control update request message indicative of that said terminal is not allowed to access said data network. Figure 9 is a schematic diagram of a procedure according to example embodiments. The apparatus according to Figure 2 may perform the method of Figure 9 but is not limited to this method. The method of Figure 9 may be performed by the apparatus of Figure 2 but is not limited to being performed by this apparatus.

As shown in Figure 9, a procedure according to example embodiments comprises an operation of receiving (S91), from a session management function entity of said mobile communications network, a message indicative of rejection of a session establishment of a terminal to a data network, wherein said message includes a reason for rejection of said session establishment of said terminal to said data network, and an operation of transmitting (S92), towards a policy control function entity of said mobile communications network, a policy control update request message indicative of that said terminal is not allowed to access said data network.

Figure 3 is a block diagram illustrating an apparatus according to example embodiments. In particular, Figure 3 illustrates a variation of the apparatus shown in Figure 2. The apparatus according to Figure 3 may thus further comprise a deciding circuitry 31.

In an embodiment at least some of the functionalities of the apparatus shown in Figure 2 (or 3) may be shared between two physically separate devices forming one operational entity. Therefore, the apparatus may be seen to depict the operational entity comprising one or more pnysically separate devices for executing at least some of the described processes.

According to example embodiments, said reason for rejection of said session establishment of said terminal to said data network is indicative of that said terminal is permanently not allowed to access said data network.

According to a variation of the procedure shown in Figure 9, exemplary additional operations are given, which are inherently independent from each other as such. According to such variation, an exemplary method according to example embodiments may comprise an operation of receiving, from said policy control function entity of said mobile communications network, a request to get notified upon any incidence of non-allowance of access, to said data network, of a communication entity asking for an establishment of a session between said communication entity and said data network, and an operation of deciding whether to transmit said policy control update request message towards said policy control function entity of said mobile communications network based on said request.

In other words, according to example embodiments, said operation of transmitting (S92) said policy control update request message indicative of that said terminal is not allowed to access said data network may be the result of said policy control function entity of said mobile communications network having requested to receive such indication (i.e. said operation of transmitting (S92) may be issued upon receipt of said message indicative of rejection of said session establishment of said terminal to a data network only in case that, beforehand, said policy control function entity of said mobile communications network has requested to receive such indication). According to example embodiments, this request may for example be exchanged with a newly defined value of PolicyControlRequestTrigger defined in clause 5.6.3.6 of TS 29.514. This new value is then indicative of a request to contact the policy control function entity of said mobile communications network when the terminal is not allowed to access a data network. According to further example embodiments, said policy control update request message is indicative of that said terminal is permanently not allowed to access said data network.

Figure 4 is a block diagram illustrating an apparatus according to example embodiments. The apparatus may be a network entity or network node 40 such as an access and mobility management function entity of a mobile communications network comprising a receiving circuitry 41, a determining circuitry 42, and a transmitting circuitry 53. The receiving circuitry 51 receives, from a terminal, a session establishment request requesting a session establishment between said terminal and a data network. The determining circuitry 52 determines whether said terminal has a subscription for said data network. The transmitting circuitry 43 transmits, towards a policy control function entity of said mobile communications network, based on a result of said determining circuitry 52, a policy control update request message indicative of that said terminal is not allowed to access said data network. Figure 10 is a schematic diagram of a procedure according to example embodiments. The apparatus according to Figure 4 may perform the method of Figure 10 but is not limited to this method. The method of Figure 10 may be performed by the apparatus of Figure 4 but is not limited to being performed by this apparatus. As shown in Figure 10, a procedure according to example embodiments comprises an operation of receiving (S101), from a terminal, a session establishment request requesting a session establishment between said terminal and a data network, an operation of determining (S102) whether said terminal has a subscription for said data network, and an operation of transmitting (S103), towards a policy control function entity of said mobile communications network, based on a result of said determining (S102), a policy control update request message indicative of that said terminal is not allowed to access said data network.

Figure 5 is a block diagram illustrating an apparatus according to example embodiments. In particular, Figure 5 illustrates a variation of the apparatus shown in Figure 4. The apparatus according to Figure 5 may thus further comprise a deciding circuitry 51.

In an embodiment at least some of the functionalities of the apparatus shown in Figure 4 (or 5) may be shared between two physically separate devices forming one operational entity. Therefore, the apparatus may be seen to depict the operational entity comprising one or more physically separate devices for executing at least some of the described processes.

According to a variation of the procedure shown in Figure 10, exemplary details of the transmitting operation (S103) are given, which are inherently independent from each other as such. According to such modification, in said transmitting operation (S103), said policy control update request message indicative of that said terminal is not allowed to access said data network is transmitted, if said result of said determining (S102) is indicative of that said terminal has no subscription for said data network.

According to a variation of the procedure shown in Figure 10, exemplary additional operations are given, which are inherently independent from each other as such. According to such variation, an exemplary method according to example embodiments may comprise an operation of receiving, from said policy control function entity or saio mooiie communications network, a request to get notified upon any incidence of non-allowance of access, to said data network, of a communication entity asking for an establishment of a session between said communication entity and said data network, and an operation of deciding whether to transmit said policy control update request message towards said policy control function entity of said mobile communications network based on said request.

In other words, according to example embodiments, said operation of transmitting (S103) said policy control update request message indicative of that said terminal is not allowed to access said data network may be the result of said policy control function entity of said mobile communications network having requested to receive such indication (i.e. said operation of transmitting (S103) may be issued upon receipt of said session establishment request from said terminal having no subscription for said data network only in case that, beforehand, said policy control function entity of said mobile communications network has requested to receive such indication). According to example embodiments, this request may for example be exchanged with a newly defined value of PolicyControlRequestTrigger defined in clause 5.6.3.6 of TS 29.514. This new value is then indicative of a request to contact the policy control function entity of said mobile communications network when the terminal is not allowed to access a data network.

According to further example embodiments, said policy control update request message is indicative of that said terminal is permanently not allowed to access said data network.

According to further example embodiments, said mobile communications network is a 3GPP network. The 3GPP network may be a 3GPP 5G network. The 3GPP network may be a future 3GPP communication network, e.g. a 3GPP network of a later generation, e.g. a 3GPP 6G network. Alternatively, or in addition, according to rurtner example embodiments, said session establishment of said terminal to said data network is a protocol data unit session establishment.

Figure 6 is a block diagram illustrating an apparatus according to example embodiments. The apparatus may be a network entity or network node 60 such as a policy control function entity of said mobile communications network comprising a receiving circuitry 61, a modifying circuitry 62, and a transmitting circuitry 63. The receiving circuitry 61 receives, from an access and mobility management function entity of said mobile communications network, a policy control update request message indicative of that said terminal is not allowed to access said data network. The modifying circuitry 62 modifies, based on said policy control update request message, entries related to said data network in a terminal route selection policy of said terminal. The transmitting circuitry 63 transmits said terminal route selection policy towards said terminal. Figure 11 is a schematic diagram of a procedure according to example embodiments. The apparatus according to Figure 6 may perform the method of Figure 11 but is not limited to this method. The method of Figure 11 may be performed by the apparatus of Figure 6 but is not limited to being performed by this apparatus.

As shown in Figure 11, a procedure according to example embodiments comprises an operation of receiving (Sill), from an access and mobility management function entity of said mobile communications network, a policy control update request message indicative of that said terminal is not allowed to access said data network, an operation of modifying (SI 12), based on said policy control update request message, entries related to said data network in a terminal route selection policy of said terminal, and an operation of transmitting (S113) said terminal route selection policy towards said terminal.

Figure 7 is a block diagram illustrating an apparatus according to example embodiments. In particular, Figure 7 illustrates a variation of the apparatus shown in Figure 6. The apparatus according to Figure / may thus further comprise a removing circuitry 71.

In an embodiment at least some of the functionalities of the apparatus shown in Figure 6 (or 7) may be shared between two physically separate devices forming one operational entity. Therefore, the apparatus may be seen to depict the operational entity comprising one or more physically separate devices for executing at least some of the described processes.

According to a variation of the procedure shown in Figure 11, exemplary details of the modifying operation (S112) are given, which are inherently independent from each other as such.

Such exemplary modifying operation (S112) according to example embodiments may comprise an operation of removing said entries related to said data network in said terminal route selection policy of said terminal.

According to a variation of the procedure shown in Figure 11, exemplary additional operations are given, which are inherently independent from each other as such. According to such variation, an exemplary method according to example embodiments may comprise an operation of transmitting, towards an operation and maintenance entity of said mobile communications network, an alarm message indicative of that said terminal is not allowed to access said data network, said alarm message including an identifier of said terminal and information on said data network.

According to a variation of the procedure shown in Figure 11, exemplary additional operations are given, which are inherently independent from each other as such. According to such variation, an exemplary method according to example embodiments may comprise an operation of deciding whether to request to get notified upon any incidence of non-allowance of access, to said data network, of any communication entity asking for establishment of session between said communication entity and said data network, and an operation of transmitting, oaseo on a result or saio oeciomg, towards said access and mobility management function entity of said mobile communications network, a request to get notified upon any incidence of nonallowance of access, to said data network, of any communication entity asking for establishment of session between said communication entity and said data network.

According to example embodiments, this request may for example be exchanged with a newly defined value of PolicyControlRequestTrigger defined in clause 5.6.3.6 of TS 29.514. This new value is then indicative of a request to contact the policy control function entity of said mobile communications network when the terminal is not allowed to access a data network.

Example embodiments described above are discussed below in more specific terms with reference to Figure 12.

Figure 12 shows a schematic diagram of signaling sequences according to example embodiments.

It starts out from the situation that, on the one hand, the UE (as an example of a terminal) is already registered successfully with the 5GC and the UR.SP is already provided by the PCF, and, on the other hand, either in the UDM, the DNN is marked for secondary authentication/authorization, or in the SMF, a local policy is provided for secondary authentication/authorization for the DN.

In a step 1 in Figure 12, several processing and signaling is effected. In particular, according to example embodiments, first, the UE is initiating a PDU session establishment, ano tne invokes secondary authentication/authorization.

In a step 2 in Figure 12, several processing and signaling is effected. In particular, according to example embodiments, first, the DN-AAA (server) determines that the UE is not allowed to access this particular DN (any more). Hence, the authentication fails.

In a step 3 in Figure 12, several processing and signaling is effected. In particular, according to example embodiments, the DN-AAA server indicates a permanent failure reason (e.g. "DN-specific identity/EAP identity is not allowed to access the DN") to the SMF e.g. in an "Authentication/Authorization response" message.

In a step 4 in Figure 12, several processing and signaling is effected. In particular, according to example embodiments, the SMF sends a notification indicative of rejection of the PDU session establishment to the UE via the AMF (e.g. "Nsmf_PDUSession_SMContextStatusNotify (Release)"). According to example embodiments, the example

"Nsmf_PDUSession_SMContextStatusNotify (Release)" contains the error information for AMF that the UE is not allowed (permanently) to access the DN(N).

According to example embodiments, the error information may be conveyed as one cause of a cause enumeration defining several entries of cause information.

The cause may have an enumeration value "REL_DUE_TO_EAP_ID_NOT_ALLOWED" and an enumeration description "Release due to EAP ID (UE ID) is not allowed to access the DNN".

The cause may be added to the "Enumeration: Cause" in Table 6.1.6.3.8-1 in TS 29.502. According to example embodiments, alternatively, the AMF may detect on its own (without exchanging PDU session establishment signaling with the SMF, for example, without receiving the notification indicative of rejection of the PDU session establishment (e.g. "Nsmf_PDUSession_SMContextStatusNotify (Release)") from the SMF) that the UE is asking for the establishment of a PDU session towards a DNN for which the UE has no subscription.

In other words, steps 2 to 4 in Figure 12 may be replaced by that the AMF detects that the UE is asking for the establishment of a PDU Session towards a DNN for which it has no subscription.

Namely, in such case, the UE sends a PDU session establishment request to the network. This is handled by the AMF that detects that the target DNN is not part of the subscription (and there is no wildcard subscription information that would allow the UE to access to a DNN not explicitly listed as authorized). In such case, according to the alternative example embodiments, upon such detection by the AMF, step 5 in Figure 12 is entered.

In a step 5 in Figure 12, several processing and signaling is effected. In particular, according to example embodiments, the AMF determines that a Policy Control Request Trigger condition is met where this Policy Control Request Trigger condition is related with the fact that the terminal is not allowed to access a data network. For this purpose a new value of PolicyControlRequestTrigger may be defined in clause 5.6.3.6 of TS 29.514. This new value is indicative of a request to contact the policy control function entity of said mobile communications network when the terminal is not allowed to access a data network. The AMF triggers e.g. a "NpcfJJEPolicyControl Update Request" (UE Policy Association ID associated with the SUPI and the Policy Control Request Trigger met) that contains an indication that the UE is not allowed (permanently) to access the DNN. In a roaming case, this may De relayed over an N 4 interface (vPCF-hPCF interface).

In a step 6 in Figure 12, several processing and signaling is effected.

In particular, according to example embodiments, the PCF determines to update the UR.SP with respect to the DNN.

This means that particular UR.SP rules with respect to the DNN need to be removed.

According to example embodiments, this updated UR.SP is pushed to UE as part of an existing UE configuration update procedure: (Step 6a in Figure 12) The (Home-)PCF ((H-)PCF) may create the UE policy container including UE policy information as defined in clause 6.6 of TS 23.503. In the case of roaming, the H-PCF may include the UE policy container in the "NpcfJJEPolicyControl UpdateNotify Request". (Step 6b in Figure 12) Upon request of the PCF, the AMF initiates the UE Configuration Update procedure (TS 23.502 clause 4.2.4.3) to update the policies on the UE.

As a result, according to example embodiments, advantageously, signaling messages exchanged between the UE and the 5GC are saved in particular by avoiding the UE to repeat a request for a PDU session with respect to a specific DN.

According to further example embodiments, subsequently, the PCF or the SMF raises an alarm with a user identifier like subscription permanent identifier (SUPI), subscription concealed identifier (SUCI), generic public subscription identifier (GPSI), and DN information, to the operator (e.g. to the OAM). Based on this alarm, the operator can take some corrective action like configuring the DN-specific identity for the UE in DN-AAA server or removing the subscription of the UE to the DNN from the UDM/unified data repository (UDR) data. The above-described procedures and functions may be implemented by respective functional elements, processors, or the like, as described below.

In the foregoing exemplary description of the network entity, only the units that are relevant for understanding the principles of the disclosure have been described using functional blocks. The network entity may comprise further units that are necessary for its respective operation. However, a description of these units is omitted in this specification. The arrangement of the functional blocks of the devices is not construed to limit the disclosure, and the functions may be performed by one block or further split into sub-blocks.

When in the foregoing description it is stated that the apparatus, i.e. network entity (or some other means) is configured to perform some function, this is to be construed to be equivalent to a description stating that a (i.e. at least one) processor or corresponding circuitry, potentially in cooperation with computer program code stored in the memory of the respective apparatus, is configured to cause the apparatus to perform at least the thus mentioned function. Also, such function is to be construed to be equivalently implementable by specifically configured circuitry or means for performing the respective function (i.e. the expression "unit configured to" is construed to be equivalent to an expression such as "means for").

In Figure 13, an alternative illustration of apparatuses according to example embodiments is depicted. As indicated in Figure 13, according to example embodiments, the apparatus (network entity) 10' (corresponding to the network entity 10) comprises a processor 131, a memory 132 and an interface 133, which are connected by a bus 134 or the like. Further, according to example embodiments, the apparatus (network entity) 20' (corresponding to the network entity 20) comprises a processor 131, a memory 132 and an interface 133, which are connected by a bus 134 or the like. Further, according to example embodiments, the apparatus (network entity) 40' (corresponding to the network entity 40) comprises a processor 131, a memory 132 and an interrace 155, wmcn are connected by a bus 134 or the like. Further, according to example embodiments, the apparatus (network entity) 60' (corresponding to the network entity 60) comprises a processor 131, a memory 132 and an interface 133, which are connected by a bus 134 or the like. The apparatuses 10', 20', 40', 60' may be connected via link 135 with respective others of apparatuses 10', 20', 40', 60' via respective links 135.

The processor 131 and/or the interface 133 may also include a modem or the like to facilitate communication over a (hardwire or wireless) link, respectively. The interface 133 may include a suitable transceiver coupled to one or more antennas or communication means for (hardwire or wireless) communications with the linked or connected device(s), respectively. The interface 133 is generally configured to communicate with at least one other apparatus, i.e. the interface thereof.

The memory 132 may store respective programs assumed to include program instructions or computer program code that, when executed by the respective processor, enables the respective electronic device or apparatus to operate in accordance with the example embodiments.

In general terms, the respective devices/apparatuses (and/or parts thereof) may represent means for performing respective operations and/or exhibiting respective functionalities, and/or the respective devices (and/or parts thereof) may have functions for performing respective operations and/or exhibiting respective functionalities.

When in the subsequent description it is stated that the processor (or some other means) is configured to perform some function, this is to be construed to be equivalent to a description stating that at least one processor, potentially in cooperation with computer program code stored in the memory of the respective apparatus, is configured to cause the apparatus to perform at least the thus mentioned function. Also, such function is to be construed to be equivalently impiementaoie oy specifically configured means for performing the respective function (i.e. the expression "processor configured to [cause the apparatus to] perform xxx-ing" is construed to be equivalent to an expression such as "means for xxx-ing").

According to example embodiments, an apparatus representing the network entity 10 (e.g. session management function entity of a mobile communications network) comprises at least one processor 131, at least one memory 132 including computer program code, and at least one interface 133 configured for communication with at least another apparatus. The processor (i.e. the at least one processor 131, with the at least one memory

132 and the computer program code) is configured to perform receiving, from an authentication and authorization entity with respect to a data network, a message indicative of that a terminal is not allowed to access said data network, wherein said message includes a reason for non-allowance of said terminal to access a data network (thus the apparatus comprising corresponding means for receiving), to perform deciding to reject a session establishment of said terminal to said data network (thus the apparatus comprising corresponding means for deciding), and to perform transmitting, towards an access and mobility management function entity of said mobile communications network, a message indicative of rejection of said session establishment of said terminal to said data network, wherein said message includes a reason for rejection of said session establishment of said terminal to said data network based on said reason for non-allowance of said terminal to access said data network (thus the apparatus comprising corresponding means for transmitting).

According to example embodiments, an apparatus representing the network entity 20 (e.g. access and mobility management function entity of a mobile communications network) comprises at least one processor 131, at least one memory 132 including computer program code, and at least one interface

133 configured for communication with at least another apparatus. The processor (i.e. the at least one processor 131, with the at least one memory 132 and the computer program code) is conngureo to perrorm receiving, from a session management function entity of said mobile communications network, a message indicative of rejection of a session establishment of a terminal to a data network, wherein said message includes a reason for rejection of said session establishment of said terminal to said data network (thus the apparatus comprising corresponding means for receiving), and to perform transmitting, towards a policy control function entity of said mobile communications network, a policy control update request message indicative of that said terminal is not allowed to access said data network (thus the apparatus comprising corresponding means for transmitting).

According to example embodiments, an apparatus representing the network entity 40 (e.g. access and mobility management function entity of a mobile communications network) comprises at least one processor 131, at least one memory 132 including computer program code, and at least one interface

133 configured for communication with at least another apparatus. The processor (i.e. the at least one processor 131, with the at least one memory 132 and the computer program code) is configured to perform receiving, from a terminal, a session establishment request requesting a session establishment between said terminal and a data network (thus the apparatus comprising corresponding means for receiving), to perform determining whether said terminal has a subscription for said data network (thus the apparatus comprising corresponding means for determining), and to perform transmitting, towards a policy control function entity of said mobile communications network, based on a result of said determining, a policy control update request message indicative of that said terminal is not allowed to access said data network (thus the apparatus comprising corresponding means for transmitting).

According to example embodiments, an apparatus representing the network entity 60 (e.g. policy control function entity of said mobile communications network) comprises at least one processor 131, at least one memory 132 including computer program code, and at least one interface 133 configured for communication with at least anotner apparatus. I ne processor (i.e. the at least one processor 131, with the at least one memory 132 and the computer program code) is configured to perform receiving, from an access and mobility management function entity of said mobile communications network, a policy control update request message indicative of that said terminal is not allowed to access said data network (thus the apparatus comprising corresponding means for receiving), to perform modifying, based on said policy control update request message, entries related to said data network in a terminal route selection policy of said terminal (thus the apparatus comprising corresponding means for modifying), and to perform transmitting said terminal route selection policy towards said terminal (thus the apparatus comprising corresponding means for transmitting).

For further details regarding the operability/functionality of the individual apparatuses, reference is made to the above description in connection with any one of Figures 1 to 12, respectively.

For the purpose of the present disclosure as described herein above, it should be noted that

- method steps likely to be implemented as software code portions and being run using a processor at a network server or network entity (as examples of devices, apparatuses and/or modules thereof, or as examples of entities including apparatuses and/or modules therefore), are software code independent and can be specified using any known or future developed programming language as long as the functionality defined by the method steps is preserved;

- generally, any method step is suitable to be implemented as software or by hardware without changing the idea of the embodiments and its modification in terms of the functionality implemented;

- method steps and/or devices, units or means likely to be implemented as hardware components at the above-defined apparatuses, or any module(s) thereof, (e.g., devices carrying out the functions of the apparatuses according to the embodiments as described above) are hardware independent and can be implemented using any Known or ruture oeveiopeo nardware technology or any hybrids of these, such as MOS (Metal Oxide Semiconductor), CMOS (Complementary MOS), BiMOS (Bipolar MOS), BiCMOS (Bipolar CMOS), ECL (Emitter Coupled Logic), TTL (Transistor-Transistor Logic), etc., using for example ASIC (Application Specific IC (Integrated Circuit)) components, FPGA (Field-programmable Gate Arrays) components, CPLD (Complex Programmable Logic Device) components or DSP (Digital Signal Processor) components;

- devices, units or means (e.g. the above-defined network entity or network register, or any one of their respective units/means) can be implemented as individual devices, units or means, but this does not exclude that they are implemented in a distributed fashion throughout the system, as long as the functionality of the device, unit or means is preserved;

- an apparatus like the user equipment and the network entity /network register may be represented by a semiconductor chip, a chipset, or a (hardware) module comprising such chip or chipset; this, however, does not exclude the possibility that a functionality of an apparatus or module, instead of being hardware implemented, be implemented as software in a (software) module such as a computer program or a computer program product comprising executable software code portions for execution/being run on a processor;

- a device may be regarded as an apparatus or as an assembly of more than one apparatus, whether functionally in cooperation with each other or functionally independently of each other but in a same device housing, for example.

In general, it is to be noted that respective functional blocks or elements according to above-described aspects can be implemented by any known means, either in hardware and/or software, respectively, if it is only adapted to perform the described functions of the respective parts. The mentioned method steps can be realized in individual functional blocks or by individual devices, or one or more of the method steps can be realized in a single functional block or by a single device. Generally, any method step is suitable to be implemented as software or by hardware without changing the idea of the present disclosure. Devices and means can be implemented as individual devices, but this does not exclude that they are implemented in a distributed fashion throughout the system, as long as the functionality of the device is preserved. Such and similar principles are to be considered as known to a skilled person.

Software in the sense of the present description comprises software code as such comprising code means or portions or a computer program or a computer program product for performing the respective functions, as well as software (or a computer program or a computer program product) embodied on a tangible medium such as a computer-readable (storage) medium having stored thereon a respective data structure or code means/portions or embodied in a signal or in a chip, potentially during processing thereof.

The present disclosure also covers any conceivable combination of method steps and operations described above, and any conceivable combination of nodes, apparatuses, modules or elements described above, as long as the above-described concepts of methodology and structural arrangement are applicable.

In view of the above, there are provided measures for handling of unsuccessful authentication with a data network. Such measures exemplarily comprise, at an access and mobility management function entity of a mobile communications network, receiving, from a session management function entity of said mobile communications network, a message indicative of rejection of a session establishment of a terminal to a data network, wherein said message includes a reason for rejection of said session establishment of said terminal to said data network, and transmitting, towards a policy control function entity of said mobile communications network, a policy control update request message indicative or tnat said terminal is not allowed to access said data network.

Even though the disclosure is described above with reference to the examples according to the accompanying drawings, it is to be understood that the disclosure is not restricted thereto. Rather, it is apparent to those skilled in the art that the present disclosure can be modified in many ways without departing from the scope of the inventive idea as disclosed herein.

List of acronyms and abbreviations

3GPP Third Generation Partnership Project

5G 5th Generation

5GC 5G core network

5GS 5G system

DN data network

DN-AAA data network authentication, authorization, and accounting

DNN data network name

GPSI generic public subscription identifier

H-PCF home-PCF

HPLMN home public land mobile network

OAM operations, administration and maintenance

PCF policy and charging function

PDU protocol data unit

RAN radio access networks

SMF session management function

S-NSSAI single network slice selection assistance information

SUCI subscription concealed identifier

SUPI subscription permanent identifier

TS technical specification

UDM unified data management

UDR unified data repository

UE user equipment UR.SP UE route selection policy

VPLMN visited public land mobile network

Claims

36 Claims

1. A method of a session management function entity of a mobile communications network, comprising receiving, from an authentication and authorization entity with respect to a data network, a message indicative of that a terminal is not allowed to access said data network, wherein said message includes a reason for non-allowance of said terminal to access said data network, further comprising deciding to reject a session establishment of said terminal to said data network, and transmitting, towards an access and mobility management function entity of said mobile communications network, a message indicative of rejection of said session establishment of said terminal to said data network, wherein said message includes a reason for rejection of said session establishment of said terminal to said data network based on said reason for non-allowance of said terminal to access said data network.

2. The method according to claim 1, further comprising transmitting, towards an operation and maintenance entity of said mobile communications network, an alarm message indicative of that said terminal is not allowed to access said data network, said alarm message including an identifier of said terminal and information on said data network.

3. The method according to claim 1 or 2, wherein said message is indicative of that said terminal is permanently not allowed to access said data network.

4. The method according to any of claims 1 to 3, wherein said mobile communications network is a 3GPP network, and/or 37 said session establishment or saio terminal to saio oata network is a protocol data unit session establishment, and/or said authentication and authorization entity with respect to said data network is an authentication and authorization entity of said data network or is an authentication and authorization entity of said mobile communications network.

5. A method of an access and mobility management function entity of a mobile communications network, comprising receiving, from a session management function entity of said mobile communications network, a message indicative of rejection of a session establishment of a terminal to a data network, wherein said message includes a reason for rejection of said session establishment of said terminal to said data network, further comprising transmitting, towards a policy control function entity of said mobile communications network, a policy control update request message indicative of that said terminal is not allowed to access said data network.

6. The method according to claim 5, wherein said reason for rejection of said session establishment of said terminal to said data network is indicative of that said terminal is permanently not allowed to access said data network.

7. A method of an access and mobility management function entity of a mobile communications network, comprising receiving, from a terminal, a session establishment request requesting a session establishment between said terminal and a data network, determining whether said terminal has a subscription for said data network, and transmitting, towards a policy control function entity of said mobile communications network, based on a result of said determining, a policy control update request message indicative of that said terminal is not allowed to access said data network.

8. The method according to claim 7, wherein in said transmitting, said policy control update request message is transmitted, if said result of said determining is indicative of that said terminal has no subscription for said data network.

9. The method according to any of claims 5 to 8, further comprising receiving, from said policy control function entity of said mobile communications network, a request to get notified upon any incidence of nonallowance of access, to said data network, of any communication entity asking for establishment of session between said communication entity and said data network, and deciding whether to transmit said policy control update request message towards said policy control function entity of said mobile communications network based on said request.

10. The method according to any of claims 5 to 9, wherein said policy control update request message is indicative of that said terminal is permanently not allowed to access said data network.

11. The method according to any of claims 5 to 10, wherein said mobile communications network is a 3GPP network, and/or said session establishment of said terminal to said data network is a protocol data unit session establishment.

12. A method of a policy control function entity of said mobile communications network, comprising receiving, from an access and mobility management function entity of said mobile communications network, a policy control update request message indicative of that said terminal is not allowed to access a data network, modifying, based on saio policy control upoate request message, entries related to said data network in a terminal route selection policy of said terminal, and transmitting said terminal route selection policy towards said terminal.

13. The method according to claim 12, wherein in relation to said modifying, said method further comprises removing said entries related to said data network in said terminal route selection policy of said terminal.

14. The method according to claim 12 or 13, further comprising transmitting, towards an operation and maintenance entity of said mobile communications network, an alarm message indicative of that said terminal is not allowed to access said data network, said alarm message including an identifier of said terminal and information on said data network.

15. The method according to any of claims 12 to 14, further comprising deciding whether to request to get notified upon any incidence of nonallowance of access, to said data network, of any communication entity asking for establishment of session between said communication entity and said data network, and transmitting, based on a result of said deciding, towards said access and mobility management function entity of said mobile communications network, a request to get notified upon any incidence of non-allowance of access, to said data network, of any communication entity asking for establishment of session between said communication entity and said data network.

16. The method according to any of claims 12 to 15, wherein said mobile communications network is a 3GPP network.

17. An apparatus of a session management function entity of a mobile communications network, comprising receiving circuitry configured to receive, from an authentication and authorization entity with respect to a data network, a message indicative of that a terminal is not allowed to access said data network, wherein said message includes a reason for non-allowance of said terminal to access said data network, further comprising deciding circuitry configured to decide to reject a session establishment of said terminal to said data network, and transmitting circuitry configured to transmit, towards an access and mobility management function entity of said mobile communications network, a message indicative of rejection of said session establishment of said terminal to said data network, wherein said message includes a reason for rejection of said session establishment of said terminal to said data network based on said reason for non-allowance of said terminal to access said data network.

18. The apparatus according to claim 17, further comprising transmitting circuitry configured to transmit, towards an operation and maintenance entity of said mobile communications network, an alarm message indicative of that said terminal is not allowed to access said data network, said alarm message including an identifier of said terminal and information on said data network.

19. The apparatus according to claim 17 or 18, wherein said message is indicative of that said terminal is permanently not allowed to access said data network.

20. The apparatus according to any of claims 17 to 19, wherein said mobile communications network is a 3GPP network, and/or said session establishment of said terminal to said data network is a protocol data unit session establishment, and/or said authentication and authorization entity with respect to said data network is an authentication and authorization entity of said data network or 41 is an authentication, autnonzation entity or saio moone communications network.

21. An apparatus of an access and mobility management function entity of a mobile communications network, comprising receiving circuitry configured to receive, from a session management function entity of said mobile communications network, a message indicative of rejection of a session establishment of a terminal to a data network, wherein said message includes a reason for rejection of said session establishment of said terminal to said data network, further comprising transmitting circuitry configured to transmit, towards a policy control function entity of said mobile communications network, a policy control update request message indicative of that said terminal is not allowed to access said data network.

22. The apparatus according to claim 21, wherein said reason for rejection of said session establishment of said terminal to said data network is indicative of that said terminal is permanently not allowed to access said data network.

23. An apparatus of an access and mobility management function entity of a mobile communications network, comprising receiving circuitry configured to receive, from a terminal, a session establishment request requesting a session establishment between said terminal and a data network, determining circuitry configured to determine whether said terminal has a subscription for said data network, and transmitting circuitry configured to transmit, towards a policy control function entity of said mobile communications network, based on a result of said determining circuitry, a policy control update request message indicative of that said terminal is not allowed to access said data network. 42

24. The apparatus according to claim 25, wnerem said transmitting circuitry is configured to transmit said policy control update request message, if said result of said determining circuitry is indicative of that said terminal has no subscription for said data network.

25. The apparatus according to any of claims 21 to 24, further comprising receiving circuitry configured to receive, from said policy control function entity of said mobile communications network, a request to get notified upon any incidence of non-allowance of access, to said data network, of a communication entity asking for an establishment of a session between said communication entity and said data network, and deciding circuitry configured to decide whether to transmit said policy control update request message towards said policy control function entity of said mobile communications network based on said request.

26. The apparatus according to any of claims 21 to 25, wherein said policy control update request message is indicative of that said terminal is permanently not allowed to access said data network.

27. The apparatus according to any of claims 21 to 26, wherein said mobile communications network is a 3GPP network, and/or said session establishment of said terminal to said data network is a protocol data unit session establishment.

28. An apparatus of a policy control function entity of said mobile communications network, comprising receiving circuitry configured to receive, from an access and mobility management function entity of said mobile communications network, a policy control update request message indicative of that said terminal is not allowed to access a data network, modifying circuitry configured to modify, based on said policy control update request message, entries related to said data network in a terminal route selection policy of said terminal, and 43 transmitting circuitry configured to transmit said terminal route selection policy towards said terminal.

29. The apparatus according to claim 28, further comprising removing circuitry configured to remove said entries related to said data network in said terminal route selection policy of said terminal.

30. The apparatus according to claim 28 or 29, further comprising transmitting circuitry configured to transmit, towards an operation and maintenance entity of said mobile communications network, an alarm message indicative of that said terminal is not allowed to access said data network, said alarm message including an identifier of said terminal and information on said data network.

31. The apparatus according to any of claims 28 to 30, further comprising deciding circuitry configured to decide whether to request to get notified upon any incidence of non-allowance of access, to said data network, of any communication entity asking for establishment of session between said communication entity and said data network, and transmitting circuitry configured to transmit, based on a result of said deciding circuitry, towards said access and mobility management function entity of said mobile communications network, a request to get notified upon any incidence of non-allowance of access, to said data network, of any communication entity asking for establishment of session between said communication entity and said data network.

32. The apparatus according to any of claims 28 to 31, wherein said mobile communications network is a 3GPP network.

33. An apparatus of a session management function entity of a mobile communications network, comprising at least one processor, at least one memory including computer program code, and 44 at least one interrace conngureo tor communication with at least another apparatus, the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform : receiving, from an authentication and authorization entity with respect to a data network, a message indicative of that a terminal is not allowed to access said data network, wherein said message includes a reason for non-allowance of said terminal to access said data network, deciding to reject a session establishment of said terminal to said data network, and transmitting, towards an access and mobility management function entity of said mobile communications network, a message indicative of rejection of said session establishment of said terminal to said data network, wherein said message includes a reason for rejection of said session establishment of said terminal to said data network based on said reason for non-allowance of said terminal to access said data network.

34. The apparatus according to claim 33, wherein the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform : transmitting, towards an operation and maintenance entity of said mobile communications network, an alarm message indicative of that said terminal is not allowed to access said data network, said alarm message including an identifier of said terminal and information on said data network.

35. The apparatus according to claim 33 or 34, wherein said message is indicative of that said terminal is permanently not allowed to access said data network.

36. The apparatus according to any of claims 33 to 35, wherein said mobile communications network is a 3GPP network, and/or 45 said session establishment or saio terminal to saio oata network is a protocol data unit session establishment, and/or said authentication and authorization entity with respect to said data network is an authentication and authorization entity of said data network or is an authentication and authorization entity of said mobile communications network.

37. An apparatus of an access and mobility management function entity of a mobile communications network, comprising at least one processor, at least one memory including computer program code, and at least one interface configured for communication with at least another apparatus, the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform : receiving, from a session management function entity of said mobile communications network, a message indicative of rejection of a session establishment of a terminal to a data network, wherein said message includes a reason for rejection of said session establishment of said terminal to said data network, and transmitting, towards a policy control function entity of said mobile communications network, a policy control update request message indicative of that said terminal is not allowed to access said data network.

38. The apparatus according to claim 37, wherein said reason for rejection of said session establishment of said terminal to said data network is indicative of that said terminal is permanently not allowed to access said data network.

39. An apparatus of an access and mobility management function entity of a mobile communications network, comprising at least one processor, at least one memory including computer program code, and 46 at least one interrace conngureo tor communication with at least another apparatus, the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform : receiving, from a terminal, a session establishment request requesting a session establishment between said terminal and a data network, determining whether said terminal has a subscription for said data network, and transmitting, towards a policy control function entity of said mobile communications network, based on a result of said determining, a policy control update request message indicative of that said terminal is not allowed to access said data network.

40. The apparatus according to claim 39, wherein in said transmitting, said policy control update request message is transmitted, if said result of said determining is indicative of that said terminal has no subscription for said data network.

41. The apparatus according to any of claims 37 to 40, wherein the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform : receiving, from said policy control function entity of said mobile communications network, a request to get notified upon any incidence of nonallowance of access, to said data network, of a communication entity asking for an establishment of a session between said communication entity and said data network, and deciding whether to transmit said policy control update request message towards said policy control function entity of said mobile communications network based on said request.

42. The apparatus according to any of claims 37 to 41, wherein said policy control update request message is indicative of that said terminal is permanently not allowed to access said data network. 47

43. The apparatus according to any of claims 37 to 42, wherein said mobile communications network is a 3GPP network, and/or said session establishment of said terminal to said data network is a protocol data unit session establishment.

44. An apparatus of a policy control function entity of said mobile communications network, comprising at least one processor, at least one memory including computer program code, and at least one interface configured for communication with at least another apparatus, the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform : receiving, from an access and mobility management function entity of said mobile communications network, a policy control update request message indicative of that said terminal is not allowed to access a data network, modifying, based on said policy control update request message, entries related to said data network in a terminal route selection policy of said terminal, and transmitting said terminal route selection policy towards said terminal.

45. The apparatus according to claim 44, wherein in relation to said modifying, the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform : removing said entries related to said data network in said terminal route selection policy of said terminal.

46. The apparatus according to claim 44 or 45, wherein the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform : 48 transmitting, towards an operation ana maintenance entity of said mobile communications network, an alarm message indicative of that said terminal is not allowed to access said data network, said alarm message including an identifier of said terminal and information on said data network.

47. The apparatus according to any of claims 44 to 46, wherein the at least one processor, with the at least one memory and the computer program code, being configured to cause the apparatus to perform : deciding whether to request to get notified upon any incidence of nonallowance of access, to said data network, of any communication entity asking for establishment of session between said communication entity and said data network, and transmitting, based on a result of said deciding, towards said access and mobility management function entity of said mobile communications network, a request to get notified upon any incidence of non-allowance of access, to said data network, of any communication entity asking for establishment of session between said communication entity and said data network.

48. The apparatus according to any of claims 44 to 47, wherein said mobile communications network is a 3GPP network.

49. A computer program product comprising computer-executable computer program code which, when the program is run on a computer, is configured to cause the computer to carry out the method according to any one of claims 1 to 4, 5 to 11, or 12 to 16.

50. The computer program product according to claim 49, wherein the computer program product comprises a computer-readable medium on which the computer-executable computer program code is stored, and/or wherein the program is directly loadable into an internal memory of the computer or a processor thereof.