Tunnel establishment for non-seamless wlan offloading

An apparatus in an access network, the apparatus comprising:

• a memory;
• and
• a processor coupled with the memory and configured to cause the apparatus to:
• initiate a Non-Seamless WLAN Offloading (“NSWO”) authentication procedure with a user equipment (“UE”);
• receive a network access identifier from the UE during the NSWO authentication procedure, wherein the network access identifier comprises a subscriber concealed identity (“SUCI”) of the UE and an indication of a first set of requested services to be reachable via the access network;
• transmit, to an authentication proxy in a mobile communication network, a first message indicating that the UE requests to connect to the access network using credentials associated with the mobile communication network, wherein the first message comprises the SUCI and the indication of the first set of requested services;
• receive, from the authentication proxy, a set of tunnel attributes;
• establish a compulsory tunnel using the set of tunnel attributes;
• and
• relay all traffic of the UE via the compulsory tunnel.

A network apparatus comprising:

• a memory;
• and
• a processor coupled with the memory and configured to cause the network apparatus to:
• receive, from an authentication server in a mobile communication network, an authentication request comprising a Non-Seamless Wireless local area network Offloading (“NSWO”) indicator and an identity of a user equipment (“UE”), wherein the authentication request indicates an attempt by the UE to connect to a Wireless Local Area Network (“WLAN”) using credentials associated with the mobile communication network;
• transmit, to the authentication server, an authentication vector for the UE;
• receive, from a NSWO function and in response to successful authentication of the UE, a subscription data request;
• and
• transmit, to the NSWO function, a subscription data response indicating a first set of services reachable by the UE via the WLAN.

A method performed by a network apparatus, the method comprising:

• receiving a first message indicating that a user equipment (“UE”) requests to connect to a wireless local area network (“WLAN”) access network using credentials associated with a mobile communication network;
• determining that the UE is authorized by an authentication server to connect to the WLAN access network;
• determining a set of tunnel attributes associated with the UE, in response to the UE being authorized by the authentication server to connect to the WLAN access network;
• and
• providing, to the WLAN access network, the set of tunnel attributes and an indication to establish a compulsory tunnel to a first data network and relay all traffic of the UE via the compulsory tunnel.