A method for registering a target device with a network. The method includes a user sending an electronic registration message from a terminal device to a universal communication platform, wherein the registration message comprises information about an identity of the target device and an option for registering with the network. Integrating the—information in the registration message into an audio file by the universal communication platform. Sending the audio file from the universal communication platform to the user's terminal device. Playing the audio file by the terminal device of the user. The content of the audio file is captured by a microphone of the target device, and the information on the option for registering with the network is extracted. The target device registers with the network using the registration option.

A method (200) for operating a User Equipment (UE) is disclosed, the UE configured to connect to a communication network. The method comprises: indicating to the communication network an Integrity Protection for User Plane (IPUP) mode supported by the UE when requesting registration with the communication network (202). The IPUP mode comprises one of: use of Integrity Protection for User Plane data exchanged with the UE (202a), non-use of Integrity Protection for User Plane data exchanged with the UE (202b), or use of Integrity Protection for User Plane data, and non-use of Confidentiality Protection for User Plane data (202c). Also disclosed are an apparatus for operating a UE, methods and apparatus for operating a radio access node and a core node of a communication network, and a computer program operable to carry out methods for operating a UE, a radio access node and/or a core node of a communication network.

A method (200) for operating a User Equipment (UE) is disclosed, the UE configured to connect to a communication network. The method comprises: indicating to the communication network an Integrity Protection for User Plane (IPUP) mode supported by the UE when requesting registration with the communication network (202). The IPUP mode comprises one of: use of Integrity Protection for User Plane data exchanged with the UE (202a), non-use of Integrity Protection for User Plane data exchanged with the UE (202b), or use of Integrity Protection for User Plane data, and non-use of Confidentiality Protection for User Plane data (202c). Also disclosed are an apparatus for operating a UE, methods and apparatus for operating a radio access node and a core node of a communication network, and a computer program operable to carry out methods for operating a UE, a radio access node and/or a core node of a communication network.

A method is performed at a server that manages embedded subscriber identity module (eSIM) profiles. The method includes, when a user equipment that belongs to a global enterprise network relocates from a first locale to a second locale in which a first private network and a second private network of the global enterprise network are located, wherein the user equipment includes a locale-specific first eSIM profile that includes a first non-public network identifier of the first private network, receiving, from the user equipment over a network in the second locale, information that indicates the user equipment is in the second locale. The method further includes identifying the second private network based on the information, and generating a locale-specific second eSIM profile that includes a second non-public network identifier for the second private network. The method includes configuring the user equipment with the locale-specific second eSIM profile.

A method is performed at a server that manages embedded subscriber identity module (eSIM) profiles. The method includes, when a user equipment that belongs to a global enterprise network relocates from a first locale to a second locale in which a first private network and a second private network of the global enterprise network are located, wherein the user equipment includes a locale-specific first eSIM profile that includes a first non-public network identifier of the first private network, receiving, from the user equipment over a network in the second locale, information that indicates the user equipment is in the second locale. The method further includes identifying the second private network based on the information, and generating a locale-specific second eSIM profile that includes a second non-public network identifier for the second private network. The method includes configuring the user equipment with the locale-specific second eSIM profile.

A user device having a security context with a first network based on a first key may establish a security context with a second network. In a method, the user device may generate a key identifier based on the first key and a network identifier of the second network. The user device may forward the key identifier to the second network for forwarding to the first network by the second network to enable the first network to identify the first key at the first network. The user device may receive a key count from the second network. The key count may be associated with a second key forwarded to the second network from the first network. The user device may generate the second key based on the first key and the received key count thereby establishing a security context between the second network and the user device.

A method for an access and mobility management function (AMF) to register a user equipment (UE) and establish a session in a standalone non-public network (SNPN) is provided. The method includes receiving a registration request message from the UE through a base station, wherein the registration request message includes an onboarding indication, an onboarding subscriber concealed identifier (SUCI) set to “SNPN onboarding,” and default UE credentials, selecting a session management function (SMF) to establish a restricted protocol data unit (PDU) session for remote provisioning of the UE, transmitting a PDU session establishment request message to the selected SMF, receiving a PDU session establishment response message including information indicating PDU session establishment acceptance and a PDU session identifier (ID) from the SMF, and transmitting a message indicating UE registration and PDU session establishment acceptance to the UE through the base station.

A method for an access and mobility management function (AMF) to register a user equipment (UE) and establish a session in a standalone non-public network (SNPN) is provided. The method includes receiving a registration request message from the UE through a base station, wherein the registration request message includes an onboarding indication, an onboarding subscriber concealed identifier (SUCI) set to “SNPN onboarding,” and default UE credentials, selecting a session management function (SMF) to establish a restricted protocol data unit (PDU) session for remote provisioning of the UE, transmitting a PDU session establishment request message to the selected SMF, receiving a PDU session establishment response message including information indicating PDU session establishment acceptance and a PDU session identifier (ID) from the SMF, and transmitting a message indicating UE registration and PDU session establishment acceptance to the UE through the base station.

The invention provides a method performed by a home public land mobile network, PLMN, of controlling access of a user equipment, UE, device to a non-home PLMN when the UE device has an access to a non-trusted network and thereby a connection with the home PLMN via an interworking function entity, the method comprising in the event of the UE device requesting an attachment to the non-home PLMN, making in the home PLMN a decision as to whether control of the UE device should be handed over to the non-home PLMN; and communicating the decision to the non-home PLMN.

A communication method is provided for performance by a first network function entity. The communication method includes determining a service zone ID, transmitting information including the service zone ID to a second network function entity, where the service zone ID is used for the second network function entity to select a service producer instance from a service producer.