Home network triggered authentication process

Abstract

Embodiments of the present disclosure relate to an HN triggered authentication process. In accordance with an embodiment of the present disclosure, an authentication server function (AUSF) determines to trigger an authentication process. The AUSF then sends a request for the authentication procedure to an access and mobility management function (AMF). Alternatively or in addition, the home network entity determines to trigger an authentication process. The home network entity then sends a request for the authentication procedure to the AMF via the AUSF. The AMF then sends a message to a user equipment (UE), the message including an indication to initiate the authentication procedure. In addition, the UE initiates the authentication procedure. The home network entity includes at least one of a unified data management (UDM) function, an authentication credential repository and processing function (ARPF), or a subscription identifier cancellation hiding function (SIDF).

Description

Technical Field

[0001] Embodiments of the present disclosure relate generally to the field of telecommunications, and in particular to a home network (HN) triggered authentication process. Background Art

[0002] The 5G System (5GS) supports authentication procedures triggered by either the User Equipment (UE) or the Visited Network. The Visited Network may initiate the primary authentication and key agreement procedures based on the Fifth Generation (5G) Authentication and Key Agreement (AKA) for a UE in 5G Mobility Management Connected (5GMM-CONNECTED) mode at any time. However, there are some scenarios where the Home Network is required to control and trigger the authentication procedure. Therefore, how to enable the HN-triggered authentication procedure remains an open question to be solved, in addition to other open questions. Summary of the invention

[0003] Generally speaking, example embodiments of the present disclosure provide a solution for an HN-triggered authentication process.

[0004] In a first aspect, a processor of an authentication server function (AUSF) is provided. The processor is configured to perform operations including: determining to trigger an authentication process; and sending a request for an authentication process to an access and mobility management function (AMF).

[0005] In a second aspect, a processor of a home network entity is provided. The processor is configured to perform operations including: determining to trigger an authentication process; and sending a request for an authentication process to an access and mobility management function (AMF) via an authentication server function (AUSF).

[0006] In a third aspect, a processor of an access and mobility management function (AMF) is provided. The processor is configured to perform operations including: receiving a request for an authentication procedure from an authentication server function (AUSF); and sending a message to a user equipment (UE), the message including an indication of initiating an authentication procedure.

[0007] In a fourth aspect, a processor of a user equipment (UE) is provided. The processor is configured to perform operations including: receiving a message from an access and mobility management function (AMF), the message including an indication to initiate an authentication procedure; and initiating an authentication procedure.

[0008] In a fifth aspect, a processor of a home network entity is provided. The processor is configured to perform operations, the operations including: determining to trigger an authentication process; generating an authentication vector in response to determining to trigger the authentication process; and sending an authentication acquisition response message to an authentication server function (AUSF), the authentication acquisition response message including the authentication vector and an indication indicating that the authentication process is triggered by the home network entity.

[0009] In a sixth aspect, a processor of an authentication server function (AUSF) is provided. The processor is configured to perform operations including: receiving an authentication acquisition response message from a home network entity, the authentication acquisition response message including an authentication vector and an indication indicating that an authentication process is triggered by the home network entity; and determining a current serving network name.

[0010] In a seventh aspect, a processor of an authentication server function (AUSF) is provided. The processor is configured to perform operations: determine to trigger an authentication process; after determining to trigger the authentication process, determine a current serving network name; and send an authentication acquisition request message including the current serving network name to a home network entity.

[0011] In an eighth aspect, a processor of a home network entity is provided. The processor is configured to perform operations, the operations including: receiving an authentication acquisition request message including a current service network name from an authentication server function (AUSF); determining that an authentication process is triggered by the AUSF; generating an authentication vector in response to determining that the authentication process is triggered by the home network; and sending an authentication acquisition response message to the AUSF, the authentication acquisition response message including the authentication vector and a second indication indicating that the authentication process is triggered by the AUSF.

[0012] In a ninth aspect, an authentication server function (AUSF) is provided. The AUSF includes a transceiver and a processor of the first aspect, the sixth aspect, or the seventh aspect. The transceiver is configured to be communicatively coupled to the processor and is configured to communicate with an access and mobility management function (AMF) and a home network entity.

[0013] In a tenth aspect, a home network entity is provided. The home network entity comprises a transceiver and a processor of the second aspect, the fifth aspect or the eighth aspect. The transceiver is configured to be communicatively coupled to the processor and configured to communicate with an authentication server function (AUSF).

[0014] In an eleventh aspect, an access and mobility management function (AMF) is provided. The AMF comprises a transceiver and a processor of the third aspect. The transceiver is configured to be communicatively coupled to the processor and is configured to communicate with a user equipment (UE) and an authentication server function (AUSF).

[0015] In a twelfth aspect, a user equipment (UE) is provided. The UE comprises a transceiver and a processor of the fourth aspect. The transceiver is configured to be communicatively coupled to the processor and configured to communicate with the user equipment (UE) and an authentication server function (AUSF).

[0016] It should be understood that the invention summary is not intended to indicate the key or essential features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The above and other objects, features and advantages of the present disclosure will become more apparent through a more detailed description of some embodiments of the present disclosure in the accompanying drawings, in which:

[0018] Figure 1 A schematic diagram illustrating an example communication environment in which example embodiments of the present disclosure may be implemented;

[0019] Figure 2 A schematic diagram illustrating a first process of an example HN-triggered authentication according to some embodiments of the present disclosure is illustrated;

[0020] Figure 3 A schematic diagram illustrating a second process of an example HN-triggered authentication according to some embodiments of the present disclosure is illustrated;

[0021] Figure 4 A schematic diagram illustrating a third process of an example HN-triggered authentication according to some embodiments of the present disclosure is illustrated;

[0022] Figure 5 A schematic diagram illustrating a fourth process of an example HN-triggered authentication according to some embodiments of the present disclosure;

[0023] Figure 6 A flow chart illustrating an example method of communications implemented at an AUSF during a first process of HN-triggered authentication according to some embodiments of the present disclosure;

[0024] Figure 7 A flow chart illustrating an example method of communication implemented at a home network entity during a first process of HN-triggered authentication according to some embodiments of the present disclosure;

[0025] Figure 8 A flow chart illustrating an example method of communications implemented at an access and mobility management function (AMF) in a first process of HN-triggered authentication according to some embodiments of the present disclosure;

[0026] Fig. 9A flow chart illustrating an example method of communication implemented at a UE in a first process of HN-triggered authentication according to some embodiments of the present disclosure;

[0027] Fig.10 A flow chart illustrating an example method of communication implemented at a home network entity during a second process of HN-triggered authentication according to some embodiments of the present disclosure;

[0028] Fig.11 A flow chart illustrating an example method of communication implemented at an AUSF during a second process of HN-triggered authentication according to some embodiments of the present disclosure;

[0029] Fig.12 A flowchart illustrating an example method of communication implemented at an AUSF in a third process or a fourth process of HN-triggered authentication according to some embodiments of the present disclosure;

[0030] Fig.13 A flowchart illustrating an example method of communication implemented at a home network entity in a fourth process of HN-triggered authentication according to some embodiments of the present disclosure; and

[0031] Fig.14 A simplified block diagram of an apparatus suitable for implementing embodiments of the present disclosure is illustrated.

[0032] Throughout the drawings, the same or similar reference numerals refer to the same or similar elements. DETAILED DESCRIPTION

[0033] The principle of the present disclosure will now be described with reference to some embodiments. It should be understood that these embodiments are described only for the purpose of illustration, and help those skilled in the art to understand and implement the present disclosure, without indicating any limitation to the scope of the present disclosure. In addition to the methods described below, the disclosure described herein can be realized in various ways.

[0034] In the following description and claims, unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs.

[0035] The terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments. For example, as used herein, the singular forms "a", "an", and "the" are intended to include the plural forms as well, unless the context otherwise indicates. The terms "include", "have", "include" when used herein specify the presence of stated features, elements, and / or components, etc., but do not exclude the presence or addition of one or more other features, elements, components, and / or combinations thereof. In addition, when describing specific features, structures, or characteristics in conjunction with some embodiments, it is considered that it is within the knowledge of those skilled in the art to implement such features, structures, or characteristics in conjunction with other embodiments that are explicitly or not explicitly described.

[0036] It should also be understood that, although the terms "first", "second", etc. may be used to describe various elements in this article, these elements should not be limited by these terms. These terms are only used to distinguish one element from another element. For example, the first element can be named as the second element and similarly the second element can be named as the first element without departing from the scope of the example embodiments. As used herein, the term "and / or" includes any combination and all combinations of one or more of the listed terms.

[0037] As mentioned above, 5GS supports authentication procedures triggered by UE or visited network. However, there are some cases where the home network is required to trigger the authentication process. Therefore, it is necessary to support the authentication process triggered by HN. In addition, so far, there is no effective way to implement the authentication process triggered by HN to facilitate more application scenarios.

[0038] Some embodiments of the present disclosure propose a solution for an authentication process triggered by HN. In the solution, a processor of the AUSF is configured to perform an operation. The operation includes determining to trigger the authentication process. The operation also includes sending a request for the authentication process to the AMF. Alternatively or in addition, a processor of a home network entity is configured to perform an operation. The operation includes determining to trigger the authentication process. The operation also includes sending a request for the authentication process to the AMF via the AUSF. Then, the processor of the AMF is configured to send a message to a user equipment (UE), the message including an indication of initiating the authentication process. In addition, the processor of the UE is configured to initiate the authentication process.

[0039] Some other embodiments of the present disclosure propose a solution for an authentication process triggered by a HN. In the solution, a processor of a home network entity is configured to perform an operation. The operation includes determining to trigger an authentication process. The operation also includes generating an authentication vector in response to determining to trigger the authentication process. The operation also includes sending an authentication acquisition response message to the AUSF, the authentication acquisition response message including the authentication vector and an indication indicating that the authentication process is triggered by the home network entity.

[0040] Some other embodiments of the present disclosure propose a solution for an authentication process triggered by a HN. In the solution, a processor of the AUSF is configured to perform an operation. The operation includes determining to trigger an authentication process. The operation also includes determining the current serving network name after determining to trigger the authentication process. The operation also includes sending an authentication acquisition request message including the current SNN to a home network entity.

[0041] Some additional embodiments of the present disclosure propose a solution for an HN-triggered authentication process. In the solution, a processor of a home network entity is configured to perform an operation. The operation includes receiving an authentication acquisition request message including a current SNN from an AUSF. The operation also includes determining that the authentication process is triggered by the AUSF. The operation also includes generating an authentication vector in response to determining that the authentication process is triggered by the home network. In addition, the operation includes sending an authentication acquisition response message to the AUSF, the authentication acquisition response message including an authentication vector and a second indication indicating that the authentication process is triggered by the AUSF.

[0042] According to an embodiment of the present disclosure, the HN may trigger the authentication process. In this way, if the key K for AUSF needs to be refreshed, AUSF Or if UE parameter update (UPU) / guided roaming (SoR) count wraparound occurs, the HN-triggered authentication process can be initiated in time, thereby improving service continuity.

[0043] The following will refer to Figures 1 to 14 The principles and specific implementations of the present disclosure are described in detail.

[0044] Figure 1 An example communication environment 100 is shown in which embodiments of the present disclosure may be implemented. Figure 1 As shown, as part of a communication network, a communication environment 100 includes a UE 101, an AMF 103, and a security anchor function (SEAF) 105 in a service network 106. The first UE 101 can communicate with the AMF 103 and the SEAF 105 via one or more other devices or functions. The connection between the AMF 103 and the SEAF 105 can be direct or indirect. In some embodiments, the SEAF 105 can be physically integrated into the AMF 103. In this case, the SEAF 105 can communicate with the AMF 103 through internal wiring.

[0045] The communication environment 100 also includes an AUSF 107, a unified data management (UDM) function 109, an authentication credential repository and processing function (ARPF) 111, and a subscription identifier unhiding function (SIDF) 113 in a home network 114. The AMF 103 and the SEAF 105 may be directly connected to the AUSF 107 or indirectly via one or more other devices or functions. Similarly, the connection between the AUSF 107, the UDM function 109, the ARPF 111, and the SIDF 113 may be direct or indirect.

[0046] For example, the communication in the communication environment 100 may conform to any suitable standard, including but not limited to Global System for Mobile Communications (GSM), Long Term Evolution (LTE), LTE-Evolution, LTE-Advanced (LTE-A), New Radio (NR), Wideband Code Division Multiple Access (WCDMA), Code Division Multiple Access (CDMA), GSM EDGE Radio Access Network (GERAN), Machine Type Communication (MTC), etc. In addition, the communication may be performed according to any generation of communication protocols currently known or to be developed in the future. The embodiments of the present disclosure may perform communication according to any generation of communication protocols currently known or to be developed in the future. Examples of communication protocols include but are not limited to first generation (1G) communication protocols, second generation (2G) communication protocols, 2.5G communication protocols, 2.75G communication protocols, third generation (3G) communication protocols, fourth generation (4G) communication protocols, 4.5G communication protocols, fifth generation (5G) communication protocols, 5.5G advanced networks, 5G advanced networks, or sixth generation (6G) networks.

[0047] It should be understood that the devices or functions are for illustration purposes only and do not imply any limitation. Environment 100 may include any other suitable devices, elements, or functions suitable for implementing embodiments of the present disclosure.

[0048] Figure 2 A schematic diagram illustrating a first process 200 of an example HN-triggered authentication according to some embodiments of the present disclosure is illustrated. For the purpose of discussion, reference will be made to Figure 1 The process 200 may involve UE 101, AMF 103, SEAF 105, AUSF 107, UDM 109, ARPF 111 and SIDF 113, as shown in FIG. Figure 1 In this case, it is assumed that SEAF 105 is physically integrated into AMF 103. Figure 2The steps and the order of the steps are for illustration only and are not intended to be limiting. In the following, for convenience, the UDM 109 / ARPF 111 / SIDF 113 are collectively referred to as the home network entity 205. The home network entity 205 may include at least one of the UDM 109, the ARPF 111, or the SIDF 113.

[0049] like Figure 2 As shown, AUSF 107 determines (202) to trigger the authentication process. In some embodiments, if it is necessary to refresh K AUSF , the AUSF 107 may determine to trigger an authentication procedure. Alternatively or in addition, if a UPU or SoR count wrap occurs, the AUSF 107 may determine to trigger an authentication procedure. The AUSF 107 then sends (204) a request for an authentication procedure to the AMF 103.

[0050] Alternatively or in addition, the home network entity 205 may determine (206) to trigger an authentication process. In some embodiments, if a refresh of K AUSF , the home network entity 205 may determine to trigger an authentication procedure. Alternatively or in addition, if a UPU or SoR count wrap occurs, the home network entity 205 may determine to trigger an authentication procedure. The home network entity 205 may then send (208) a request for an authentication procedure to the AMF 103 via the AUSF 107.

[0051] Upon receiving the request for the authentication procedure from the AUSF 107, the AMF 103 sends (210) a message to the UE 101, the message including an indication of initiating the authentication procedure. In an embodiment where the authentication procedure is triggered by the AUSF 107, the indication may indicate that the authentication procedure is triggered by the AUSF 107. In an embodiment where the authentication procedure is triggered by the home network entity 205, i.e., at least one of the UDM function 109, the ARPF 111, or the SIDF 113, the indication may indicate that the authentication procedure is triggered by the home network entity 205. For example, the AMF 103 may send a non-access stratum (NAS) message to the UE 101, the non-access stratum (NAS) message including an indication of initiating the authentication procedure. For example, the NAS message may be a UE configuration update or a deregistration procedure, in which the UE is indicated to start registration again.

[0052] Therefore, UE 101 initiates the authentication process. Figure 2As shown, 5G authentication and key agreement (AKA) involves two phrases, referred to as phrase 1 and phrase 2. Phrase 1 performs the initiation of the authentication process. The UE 101 sends (212) an N1 message to the SEAF 105, which includes an identifier such as a subscription hidden identifier (SUCI) or a subscription permanent identifier (SUPI) and an SNN. The SEAF 105 then sends (214) an authentication request to the AUSF 107, for example, the authentication request can be a Nausf_UEAuthentication_Authenticate request message including the SUCI or SUPI and the SNN. The AUSF 107 sends (216) a Nudm_UEAuthentication_Get request message including the SUCI or SUPI and the SNN to the home network entity 205. The home network entity 205 then selects (218) an authentication method.

[0053] At phrase 2, for each Nudm_Authenticate_Get request, the UDM 109 / ARPF 111 generates (220) a 5G Home Environment (HE) Authentication Vector (AV). For example, the UDM 109 / ARPF 111 may then derive the key K for the AUSF 107. AUSF , and calculates the expected user response XRES*. Finally, UDM 109 / ARPF 111 may randomly select the random value (RAND), the authentication token (AUTN), XRES* and K AUSF Create 5G HE AV. The UDM 109 then returns (222) the 5G HE AV to the AUSF 107 in a Nudm_UEAuthentication_Get response message together with an indication that the 5G HE AV will be used for 5G AKA. In the event that SUCI is included in the Nudm_UEAuthentication_Get request, the UDM 109 may include SUPI in the Nudm_UEAuthentication_Get response.

[0054] The AUSF 107 temporarily stores (224) XRES* together with the received SUCI or SUPI. The AUSF 107 also calculates (226) the expected hash HXRES* of RES from XRES*. The AUSF 107 may also calculate (226) the expected hash HXRES* of RES from K AUSF Calculate K SEAF The AUSF 107 can then replace XRES* with HXRES* in 5G HE AV and replace K AUSF Replace with K SEAFto generate a 5G SE AV from the 5G HE AV received from UDM 109 / ARPF 111. The AUSF 107 then sends (228) 5G SE AV (RAND, AUTN, HXRES*) to the SEAF 105 in a Nausf_UEAuthentication_Authenticate response message.

[0055] SEAF 105 sends (230) RAND, AUTN to the UE in a NAS message authentication request. The mobile equipment (ME) of UE 101 may forward the RAND and AUTN received in the NAS message authentication request to the universal subscriber identity module (USIM) of UE 101. Upon receiving the RAND and AUTN, the USIM of UE 101 may verify the freshness of the 5G SEAV by checking whether the AUTN is acceptable. If so, the USIM of UE 101 calculates (232) an authentication response RES. The USIM may return RES, a cipher key (CK), and an integrity key (IK) to the ME. Then, the ME of UE 101 calculates RES* from RES. For example, the ME may calculate K from CK||IK. AUSF ME can be obtained from K AUSF Calculate K SEAF In case of synchronization failure, UE 101 may respond with a Sync_failure indication.

[0056] The UE 101 then sends (234) RES* to the SEAF 105 in a NAS message Authentication Response. The SEAF 105 calculates (236) HRES* from the RES*, and the SEAF 105 compares the HRES* with the HXRES*. If they are consistent, the SEAF may consider the authentication successful from the perspective of the serving network. The SEAF 105 then sends (238) the RES* received from the UE 101 to the AUSF 107 in a Nausf_UEAuthentication_Authenticate request message. When the AUSF 107 receives the Nausf_UEAuthentication_Authenticate request message including the RES* as an authentication confirmation, it may verify whether the AV has expired. If the AV has expired, the AUSF 107 may consider the authentication unsuccessful from the perspective of the home network. Upon successful authentication, the AUSF 107 may store the K AUSFThe AUSF 107 then verifies (240) the received RES* by comparing it with the stored XRES*. If RES* and XRES* are equal, the AUSF 107 may consider the authentication successful from the perspective of the home network. The AUSF 107 may then notify the UDM of the authentication result.

[0057] The AUSF 107 then indicates (242) to the SEAF 105 in a Nausf_UEAuthentication_Authenticate response message whether the authentication was successful from the perspective of the home network. If the authentication was successful, the K may be transmitted to the SEAF 105 in a Nausf_UEAuthentication_Authenticate response message. SEAF Otherwise, if the authentication is successful, the K received in the Nausf_UEAuthentication_Authenticate response message SEAF Then, SEAF 105 can obtain the anchor key from K SEAF , Inter-Architecture Anti-Bidding (ABBA) parameters and SUPI to derive the key K for AMF 103 AMF SEAF 105 may provide AMF 103 with the 5G key set identifier (ngKSI) and K AMF .

[0058] In this way, if an HN-triggered authentication process is required, the HN-triggered authentication process can be initiated in a timely manner, thereby improving service continuity.

[0059] Figure 3 A schematic diagram illustrating a second process 300 of an example HN-triggered authentication according to some embodiments of the present disclosure is illustrated. For the purpose of discussion, reference will be made to Figure 1 The process 300 is described. The process 300 may involve the UE 101, the SEAF 105, the AUSF 107, the UDM 109, the ARPF 111 and the SIDF 113, as shown in FIG. Figure 1 shown. Figure 3 The steps and the order of the steps in are for illustration only and are not intended to be limiting. Hereinafter, for convenience, UDM 109 / ARPF 111 / SIDF 113 are collectively referred to as home network entity 305. Home network entity 305 may include at least one of UDM 109, ARPF 111, or SIDF 113. In this case, phrase 1 is similar to the above reference 1. Figure 2 The phrase 1.

[0060] like Figure 3As shown, the home network entity 305 determines (302) to trigger the authentication process. In some embodiments, if it is necessary to refresh K AUSF , the home network entity 305 may determine to trigger the authentication process. Alternatively or in addition, if a UPU or SoR count wrap occurs, the home network entity 305 may determine to trigger the authentication process. Then, in the absence of a Nudm_Authenticate_Get request message, in response to determining that the authentication process is triggered, the home network entity 305 generates (304) a new 5G HE AV. It should be noted that considering that phrase 2 has been executed before, the 5G HE AV created at this time may be referred to as a new 5G HE AV. For example, UDM 109 / ARPF 111 may then derive a new K AUSF , and calculates the new XRES*. Finally, UDM 109 / ARPF 111 can calculate the new XRES* from RAND, AUTN, the new XRES* and the new K AUSF Create new 5G HE AV.

[0061] The home network entity 305 then sends (306) an authentication get response message to the AUSF 107, the authentication get response message including the 5G HE AV and an indication that the authentication process was triggered by the home network entity 305. For example, the UDM 109 may then return the new 5G HE AV and an indication that the new 5G HE AV will be used for 5G-AKA to the AUSF 107 in a Nudm_UEAuthentication_Get response message. In the case where the SUCI is included in the Nudm_UEAuthentication_Get request message, the UDM 109 may include the SUPI in the Nudm_UEAuthentication_Get response message.

[0062] Upon receiving the indication that the authentication process was triggered by the home network entity 305, the AUSF 107 determines (308) the current SNN. For example, the AUSF 107 may obtain the current SNN from the AMF 107, or the AUSF 107 may already know the current SNN. It should be noted that the AUSF 107 needs to obtain the same K as the UE 101. SEAF , since UE 101 will only use its current SNN to derive K SEAF For example, the AUSF 107 may determine the current SNN by requesting the current SNN from the AMF 103 using the Namf_EventExposure service. For example, the Namf_EventExposure service may be shown in Table 1.

[0063] Table 1: Example of event filters for AMF exposure events

[0064]

[0065] Then, the AUSF 107 temporarily stores (310) the new XRES* together with the received SUCI or SUPI. The AUSF 107 calculates (311) HXRES* from XRES*. In addition, the AUSF 107 calculates (312) HXRES* from K based on the current SNN. AUSF Calculate K SEAF For example, the AUSF 107 can then replace XRES* with HXRES* and K AUSF Replace with K SEAF to generate a new 5G SE AV from the new 5G HE AV received from UDM 107 / ARPF 111. The AUSF 107 then sends (312) the new 5G SE AV (RAND, AUTN, HXRES*) to the SEAF 105 in a Nausf_UEAuthentication_Authenticate response message.

[0066] In addition, SEAF 105 sends (314) new (RAND, AUTN) to UE 101 in a NAS message authentication request message. The ME of UE 101 may forward the new (RAND, AUTN) received in the NAS message authentication request to the USIM of UE 101. Upon receiving the new (RAND, AUTN), the USIM of UE 101 may verify the freshness of the new 5G SE AV by checking whether the AUTN is acceptable. If so, the USIM of UE 101 calculates (316) a new authentication response RES. The USIM may return RES, CK, IK to the ME. The ME may then calculate a new RES* from the new RES. For example, the ME may calculate the new K from CK||IK AUSF ME can be re-K AUSF Calculate the new K SEAF In case of synchronization failure, UE 101 may respond with a Sync_failure indication.

[0067] The UE 101 then sends (318) a new RES* to the SEAF 105 in a NAS message Authentication Response. The SEAF 105 calculates (320) an HRES* from the new RES*, and the SEAF 105 compares the HRES* with the HXRES*. If they are consistent, the SEAF 105 may consider the authentication successful from the perspective of the serving network. In addition, the SEAF 105 sends (322) the new RES* received from the UE 101 to the AUSF 107 in a Nausf_UEAuthentication_Authenticate request message. When the AUSF 107 receives the Nausf_UEAuthentication_Authenticate request message including the RES* as an authentication confirmation, it may verify whether the AV has expired. If the AV has expired, the AUSF 107 may consider the authentication unsuccessful from the perspective of the home network. Upon successful authentication, the AUSF 107 may store the K AUSF The AUSF 107 then verifies (324) the received RES* by comparing it with the stored XRES*. If RES* and XRES* are equal, the AUSF may deem the authentication successful from the perspective of the home network. The AUSF 107 may then notify the UDM 109 of the authentication result.

[0068] The AUSF 107 then indicates (326) to the SEAF 105 in a Nausf_UEAuthentication_Authenticate response message whether the authentication was successful from the perspective of the home network. If the authentication was successful, the K may be transmitted to the SEAF 105 in a Nausf_UEAuthentication_Authenticate response message. SEAF Otherwise, if the authentication is successful, the K received in the Nausf_UEAuthentication_Authenticate response message SEAF Then, SEAF 105 can use the new K SEAF , ABBA parameters and SUPI derived new K AMF SEAF 105 can provide ngKSI and K to AMF 103 AMF .

[0069] In this way, if an HN-triggered authentication process is required, the HN-triggered authentication process can be initiated in a timely manner, thereby improving service continuity.

[0070] Figure 4A schematic diagram illustrating a third process 400 of an example HN-triggered authentication according to some embodiments of the present disclosure is shown. For discussion purposes, reference will be made to Figure 1 The process 400 may involve the UE 101, the SEAF 105, the AUSF 107, the UDM 109, the ARPF 111, and the SIDF 113, as shown in FIG. Figure 1 shown. Figure 4 The steps and the order of the steps in are for illustration only and are not intended to be limiting. Hereinafter, for convenience, UDM 109 / ARPF 111 / SIDF 113 are collectively referred to as home network entity 405. Home network entity 405 may include at least one of UDM 109, ARPF 111, or SIDF 113. In this case, phrase 1 is similar to the phrase 1 described above with reference to Figure 2 The phrase 1.

[0071] like Figure 4 As shown, AUSF 107 determines (402) to trigger the authentication process. In some embodiments, if it is necessary to refresh K AUSF , the AUSF 107 may determine to trigger an authentication procedure. Alternatively or in addition, if a UPU or SoR count wrap occurs, the AUSF 107 may determine to trigger an authentication procedure. Then, after determining to trigger an authentication procedure, the AUSF 107 determines (404) a current SNN. For example, the AUSF 107 may obtain the current SNN from the AMF, or the AUSF 107 may already know the current SNN.

[0072] In addition, the AUSF 107 sends (406) an authentication acquisition request message including the current SNN to the home network entity 405. For example, the AUSF 107 may send a Nudm_UEAuthentication_Get request message to the UDM 109, including the SUCI or SUPI and the current SNN, i.e., the updated SNN. Then, without the Nudm_Authenticate_Get request message, the UDM 109 / ARPF 111 generates (408) a new 5G HE AV. For example, the UDM 109 / ARPF 111 may then derive the new K AUSF , and calculates the new XRES*. Finally, UDM 109 / ARPF 111 can calculate the new XRES* from RAND, AUTN, the new XRES* and the new K AUSF Create new 5G HE AV.

[0073] The UDM 109 then sends (410) the new 5G HE AV to the AUSF 107 in a Nudm_UEAuthentication_Get response message along with an indication that the new 5G HE AV will be used for 5G-AKA. In the event that SUCI was included in the Nudm_UEAuthentication_Get request message, the UDM 109 may include SUPI in the Nudm_UEAuthentication_Get response message. The AUSF 107 temporarily stores (412) the new XRES* along with the received SUCI or SUPI. The AUSF 107 calculates (414) HXRES* from XRES*. In addition, the AUSF 107 calculates (415) HXRES* from K based on the current SNN. AUSF Calculate K SEAF For example, the AUSF 107 can then replace XRES* with HXRES* and K AUSF Replace with K SEAF to generate a new 5G SE AV from the new 5G HE AV received from the UDM 109 / ARPF 111. The AUSF 107 then sends (416) the new 5G SE AV (RAND, AUTN, HXRES*) to the SEAF 105 in a Nausf_UEAuthentication_Authenticate response message.

[0074] In addition, SEAF 105 sends (418) new (RAND, AUTN) to UE 101 in a NAS message authentication request. The ME of UE 101 may forward the new (RAND, AUTN) received in the NAS message authentication request to the USIM of UE 101. Upon receiving the new (RAND, AUTN), the USIM of UE 101 may verify the freshness of the new 5G AV by checking whether the AUTN is acceptable. If so, the USIM of UE 101 calculates (420) an authentication response RES. The USIM may return RES, CK, IK to the ME. The ME may then calculate RES* from RES. For example, the ME may calculate new K from CK||IK AUSF ME can be re-K AUSF Calculate the new K SEAF In case of synchronization failure, UE 101 may respond with a Sync_failure indication.

[0075] The UE 101 then sends (422) a new RES* to the SEAF 105 in a NAS message Authentication Response. The SEAF 105 calculates (424) an HRES* from the new RES*, and the SEAF 105 compares the HRES* with the HXRES*. If they are consistent, the SEAF 105 may consider the authentication successful from the perspective of the serving network. In addition, the SEAF 105 sends (426) the RES* received from the UE 101 to the AUSF 107 in a Nausf_UEAuthentication_Authenticate request message. When the AUSF 107 receives the Nausf_UEAuthentication_Authenticate request message including the RES* as an authentication confirmation, it may verify whether the AV has expired. If the AV has expired, the AUSF 107 may consider the authentication unsuccessful from the perspective of the home network. Upon successful authentication, the AUSF 107 may store the K AUSF The AUSF 107 then verifies (428) the received RES* by comparing it with the stored XRES*. If RES* and XRES* are equal, the AUSF 107 may deem the authentication successful from the perspective of the home network. The AUSF 107 may then notify the UDM of the authentication result.

[0076] The AUSF 107 then indicates (430) to the SEAF 105 in a Nausf_UEAuthentication_Authenticate response message whether the authentication was successful from the perspective of the home network. If the authentication was successful, the K may be transmitted to the SEAF 105 in a Nausf_UEAuthentication_Authenticate response message. SEAF Otherwise, if the authentication is successful, the K received in the Nausf_UEAuthentication_Authenticate response message SEAF Then, SEAF 105 can use the new K SEAF , ABBA parameters and SUPI derived new K AMF SEAF can provide ngKSI and K to AMF 103 AMF .

[0077] In this way, if an HN-triggered authentication process is required, the HN-triggered authentication process can be initiated in a timely manner, thereby improving service continuity.

[0078] Figure 5 A schematic diagram illustrating a fourth process 500 of an example HN-triggered authentication according to some embodiments of the present disclosure is shown. For discussion purposes, reference will be made to Figure 1 The process 500 may involve the UE 101, the SEAF 105, the AUSF 107, the UDM 109, the ARPF 111 and the SIDF 113, as shown in FIG. Figure 1 shown. Figure 5 The steps and the order of the steps in are for illustration only and are not intended to be limiting. Hereinafter, for convenience, UDM 109 / ARPF 111 / SIDF 113 are collectively referred to as home network entity 505. Home network entity 505 may include at least one of UDM 109, ARPF 111, or SIDF 113. In this case, phrase 1 is similar to the above reference 1. Figure 2 The phrase 1.

[0079] like Figure 5 As shown, AUSF 107 determines (502) to trigger the authentication process. In some embodiments, if it is necessary to refresh K AUSF , the AUSF 107 may determine to trigger an authentication procedure. Alternatively or in addition, if a UPU or SoR count wrap occurs, the AUSF 107 may determine to trigger an authentication procedure. Then, after determining to trigger an authentication procedure, the AUSF 107 determines (504) a current SNN. For example, the AUSF 107 may obtain the current SNN from the AMF, or the AUSF 107 may already know the current SNN.

[0080] In addition, the AUSF 107 sends (506) an authentication get request message including the current SNN to the home network entity 505. For example, the AUSF 107 may send a Nudm_UEAuthentication_Get request message to the UDM 109, including the SUCI or SUPI and the current SNN, i.e., the updated SNN. For example, the AUSF 107 may send a first indication to the home network entity 505 indicating that the authentication process is triggered by the AUSF 107. For example, the indication may be included in the authentication get request message. The home network entity 505 then determines (507) that the authentication process is triggered by the AUSF 107. In addition, in the absence of the Nudm_Authenticate_Get request message, in response to determining that the authentication process is triggered by the home network, the UDM 109 / ARPF 111 generates (508) a new 5G HE AV. For example, the UDM 109 / ARPF 111 may then derive a new K AUSF , and calculates the new XRES*. Finally, UDM 109 / ARPF 111 can calculate the new XRES* from RAND, AUTN, the new XRES* and the new K AUSF Create new 5G HE AV.

[0081] The UDM 109 then sends (510) an authentication get response message to the AUSF 107, the authentication get response message including the new 5G HE AV and a second indication indicating that the authentication process is triggered by the AUSF 107. For example, the UDM 109 may send an authentication get response message including the new 5G HE AV and a second indication indicating that the authentication process is triggered by the AUSF 107 to the AUSF 107 in a Nudm_UEAuthentication_Get response message, together with an indication that the new 5G HE AV will be used for 5G-AKA. In the case where SUCI is included in the Nudm_UEAuthentication_Get request message, the UDM 109 may include SUPI in the Nudm_UEAuthentication_Get response message. The AUSF 107 temporarily stores (512) the new XRES* together with the received SUCI or SUPI. The AUSF 107 calculates (514) HXRES* from XRES*. In addition, the AUSF 107 calculates (514) HXRES* from K based on the current SNN. AUSF Calculate K SEAF For example, the AUSF 107 can then replace XRES* with HXRES* and K AUSF Replace with K SEAF to generate a new 5G SE AV from the new 5G HE AV received from UDM 109 / ARPF 111. AUSF 107 then sends (516) the new 5G SE AV (RAND, AUTN, HXRES*) to SEAF 105 in a Nausf_UEAuthentication_Authenticate response message.

[0082] In addition, SEAF 105 sends (518) new (RAND, AUTN) to UE 101 in a NAS message authentication request. The ME of UE 101 may forward the new (RAND, AUTN) received in the NAS message authentication request to the USIM of UE 101. Upon receiving the new (RAND, AUTN), the USIM of UE 101 may verify the freshness of the new 5G AV by checking whether the AUTN is acceptable. If so, the USIM of UE 101 calculates (520) an authentication response RES. The USIM may return RES, CK, IK to the ME. The ME may then calculate RES* from RES. For example, the ME may calculate new K from CK||IK AUSF ME can be re-K AUSF Calculate the new K SEAF In case of synchronization failure, UE 101 may respond with a Sync_failure indication.

[0083] The UE 101 then sends (522) a new RES* to the SEAF 105 in a NAS message Authentication Response. The SEAF 105 calculates (524) an HRES* from the new RES*, and the SEAF 105 compares the HRES* with the HXRES*. If they are consistent, the SEAF 105 may consider the authentication successful from the perspective of the serving network. In addition, the SEAF 105 sends (526) the RES* received from the UE 101 to the AUSF 107 in a Nausf_UEAuthentication_Authenticate request message. When the AUSF 107 receives the Nausf_UEAuthentication_Authenticate request message including the RES* as an authentication confirmation, it may verify whether the AV has expired. If the AV has expired, the AUSF 107 may consider the authentication unsuccessful from the perspective of the home network. Upon successful authentication, the AUSF 107 may store the K AUSF The AUSF 107 then verifies (528) the received RES* by comparing it with the stored XRES*. If RES* and XRES* are equal, the AUSF 107 may deem the authentication successful from the perspective of the home network. The AUSF 107 may then notify the UDM of the authentication result.

[0084] The AUSF 107 then indicates (530) to the SEAF 105 in a Nausf_UEAuthentication_Authenticate response message whether the authentication was successful from the perspective of the home network. If the authentication was successful, the K may be transmitted to the SEAF 105 in a Nausf_UEAuthentication_Authenticate response message. SEAF Otherwise, if the authentication is successful, the K received in the Nausf_UEAuthentication_Authenticate response message SEAF Then, SEAF 105 can use the new K SEAF , ABBA parameters and SUPI derived new K AMF SEAF can provide ngKSI and K to AMF 103 AMF .

[0085] In this way, if an HN-triggered authentication process is required, the HN-triggered authentication process can be initiated in a timely manner, thereby improving service continuity.

[0086] Figure 6A flowchart illustrating an example method 600 of communication implemented at an AUSF during a first process of HN-triggered authentication according to some embodiments of the present disclosure. The method 600 may be implemented at a device, such as Figure 1 The method 600 is implemented at the AUSF 107 as shown. It should be understood that the method 600 may include additional blocks not shown and / or some of the blocks shown may be omitted, and the scope of the present disclosure is not limited in this regard.

[0087] At block 610, the AUSF 107 determines to trigger an authentication procedure. At block 620, the AUSF 107 sends a request for an authentication procedure to an access and mobility management function (AMF) 103.

[0088] In some embodiments, the AUSF 107 may determine that the authentication process is triggered based on a determination that keys for the AUSF are refreshed as needed, or a determination that a UE Parameters Update (UPU) or Steering of Roaming (SoR) count wrap occurs.

[0089] Utilizing the method 600, the HN-triggered authentication process may be initiated in a timely manner, thereby improving service continuity.

[0090] Figure 7 A flowchart illustrating an example method 700 of communication implemented at a home network entity in a first process of HN-triggered authentication according to some embodiments of the present disclosure. The method 700 may be implemented at the home network entity, for example, at least one of the following: Figure 1 The illustrated UDM function 109, ARPF 111, or SIDF 113. It should be understood that the method 700 may include additional blocks not shown and / or some of the illustrated blocks may be omitted, and the scope of the present disclosure is not limited in this regard.

[0091] At block 710 , the home network entity determines to trigger an authentication procedure. At block 720 , the home network entity sends a request for an authentication procedure to the access and mobility management function (AMF) 103 via the authentication server function (AUSF) 107 .

[0092] In some embodiments, the home network entity may determine that the authentication process is triggered based on a determination that keys for the AUSF are refreshed as needed, or a determination that a UE parameter update (UPU) or directed roaming (SoR) count wrap occurs.

[0093] In some embodiments, the home network entity may include at least one of: a unified data management (UDM) function, an authentication credential repository and processing function (ARPF), or a subscription identifier unhiding function (SIDF).

[0094] Utilizing the method 700, the HN-triggered authentication process may be initiated in a timely manner, thereby improving service continuity.

[0095] Figure 8 A flow chart illustrating an example method 800 of communication implemented at an access and mobility management function (AMF) in a first process of HN-triggered authentication according to some embodiments of the present disclosure. The method 800 may be implemented in a device, such as Figure 1 The method 800 is implemented at the AMF 103 shown. It should be understood that the method 800 may include additional blocks not shown and / or some of the shown blocks may be omitted, and the scope of the present disclosure is not limited in this regard.

[0096] At block 810, the AMF 103 receives a request for an authentication procedure from the Authentication Server Function (AUSF) 107. At block 820, the AMF 103 sends a message to the user equipment (UE) 101, the message including an indication to initiate the authentication procedure.

[0097] In some embodiments, the indication may indicate that the authentication process was triggered by at least one of: an authentication server function (AUSF), a unified data management (UDM) function, an authentication credential repository and processing function (ARPF), or a subscription identifier unhiding function (SIDF).

[0098] In some embodiments, the message may be a non-access stratum (NAS) message.

[0099] Utilizing the method 800, the HN-triggered authentication process may be initiated in a timely manner, thereby improving service continuity.

[0100] Fig. 9 A flow chart illustrating an example method 900 of communication implemented at a UE in a first process of HN-triggered authentication according to some embodiments of the present disclosure. The method 900 may be implemented in a device, such as Figure 1 The method 900 is implemented at the UE 101 shown. It should be understood that the method 900 may include additional blocks not shown and / or some of the blocks shown may be omitted, and the scope of the present disclosure is not limited in this regard.

[0101] At block 910, the UE 101 receives a message from the access and mobility management function (AMF) 103, the message including an indication to initiate an authentication procedure. At block 920, the UE 101 initiates the authentication procedure.

[0102] In some embodiments, the indication may indicate that the authentication process was triggered by at least one of: an authentication server function (AUSF), a unified data management (UDM) function, an authentication credential repository and processing function (ARPF), or a subscription identifier unhiding function (SIDF).

[0103] In some embodiments, the message may be a non-access stratum (NAS) message.

[0104] Utilizing the method 900 , the HN-triggered authentication process may be initiated in a timely manner, thereby improving service continuity.

[0105] Fig.10 A flowchart illustrating an example method 1000 of communication implemented at a home network entity in a second process of HN-triggered authentication according to some embodiments of the present disclosure. The method 1000 may be implemented at the home network entity, for example, at least one of the following: Figure 1 The illustrated UDM function 109, ARPF 111, or SIDF 113. It should be understood that the method 1000 may include additional blocks not shown and / or some of the illustrated blocks may be omitted, and the scope of the present disclosure is not limited in this regard.

[0106] At block 1010, the home network entity determines to trigger an authentication process. At block 1020, in response to determining to trigger an authentication process, the home network entity generates an authentication vector. At block 1030, the home network entity sends an authentication acquisition response message to an authentication server function (AUSF) 107, the authentication acquisition response message including the authentication vector and an indication that the authentication process was triggered by the home network entity.

[0107] In some embodiments, the home network entity may determine that the authentication process is triggered based on a determination that keys for the AUSF are refreshed as needed, or a determination that a UE Parameters Update (UPU) or Steering of Roaming (SoR) count wrap occurs.

[0108] In some embodiments, the home network entity may include at least one of: a unified data management (UDM) function, an authentication credential repository and processing function (ARPF), or a subscription identifier unhiding function (SIDF).

[0109] Utilizing the method 1000, the HN-triggered authentication process may be initiated in a timely manner, thereby improving service continuity.

[0110] Fig.11 A flowchart illustrating an example method 1100 of communication implemented at an AUSF during a second process of HN-triggered authentication according to some embodiments of the present disclosure. The method 1100 may be implemented at a device, such as Figure 1 The method 1100 is implemented at the AUSF 107 shown. It should be understood that the method 1100 may include additional blocks not shown and / or some of the blocks shown may be omitted, and the scope of the present disclosure is not limited in this regard.

[0111] At block 1110, the AUSF 107 receives an authentication acquisition response message from the home network entity, the authentication acquisition response message including an authentication vector and an indication indicating that the authentication process is triggered by the home network entity. At block 1120, the AUSF 107 determines the current serving network name in response to the indication.

[0112] In some embodiments, the AUSF 107 may obtain the current serving network name from the Access and Mobility Management Function (AMF).

[0113] In some embodiments, the home network entity may include at least one of: a unified data management (UDM) function, an authentication credential repository and processing function (ARPF), or a subscription identifier unhiding function (SIDF).

[0114] Utilizing the method 1100 , the HN-triggered authentication process may be initiated in a timely manner, thereby improving service continuity.

[0115] Fig.12 A flowchart illustrating an example method 1200 of communication implemented at an AUSF in a third process or a fourth process of an HN-triggered authentication according to some embodiments of the present disclosure is provided. The method 1200 may be implemented in a device, such as Figure 1 The method 1200 is implemented at the AUSF 107 shown. It should be understood that the method 1200 may include additional blocks not shown and / or some of the blocks shown may be omitted, and the scope of the present disclosure is not limited in this regard.

[0116] At block 1210, the AUSF 107 determines to trigger an authentication procedure. At block 1220, after determining to trigger an authentication procedure, the AUSF 107 determines a current serving network name. At block 1230, the AUSF 107 sends an authentication acquisition request message including the current serving network name to the home network entity.

[0117] In some embodiments, the AUSF 107 may obtain the current serving network name from the Access and Mobility Management Function (AMF).

[0118] In some embodiments, the AUSF 107 may determine that the authentication process is triggered based on a determination that keys for the AUSF are refreshed as needed, or a determination that a UE Parameters Update (UPU) or Steering of Roaming (SoR) count wrap occurs.

[0119] In some embodiments, the AUSF 107 may send a first indication to the home network entity indicating that the authentication process was triggered by the AUSF.

[0120] In some embodiments, the indication may be included in the authentication acquisition request message.

[0121] In some embodiments, the AUSF 107 may receive an authentication acquisition response message from the home network entity, the authentication acquisition response message including an authentication vector and a second indication indicating that the authentication process was triggered by the AUSF.

[0122] In some embodiments, the home network entity may include at least one of: a unified data management (UDM) function, an authentication credential repository and processing function (ARPF), or a subscription identifier unhiding function (SIDF).

[0123] Utilizing the method 1200 , the HN-triggered authentication process may be initiated in a timely manner, thereby improving service continuity.

[0124] Fig.13 A flowchart illustrating an example method 1300 of communication implemented at a home network entity in a fourth process of HN-triggered authentication according to some embodiments of the present disclosure. The method 1300 may be implemented at the home network entity, for example, by at least one of the following: Figure 1 The illustrated UDM function 109, ARPF 111, or SIDF 113. It should be appreciated that the method 1300 may include additional blocks not shown and / or some of the illustrated blocks may be omitted, and the scope of the present disclosure is not limited in this regard.

[0125] At block 1310, the home network entity receives an authentication acquisition request message including a current serving network name from an authentication server function (AUSF) 107. At block 1320, the home network entity determines that the authentication process is triggered by the AUSF 107. At block 1330, the home network entity generates an authentication vector in response to determining that the authentication process is triggered by the home network. At block 1340, the home network entity sends an authentication acquisition response message to the AUSF 107, the authentication acquisition response message including the authentication vector and a second indication indicating that the authentication process is triggered by the AUSF.

[0126] In some embodiments, the home network entity may receive a first indication from the AUSF 107 indicating that the authentication process was triggered by the home network.

[0127] In some embodiments, the first indication may be included in an authentication acquisition request message.

[0128] In some embodiments, the home network entity may include at least one of: a unified data management (UDM) function, an authentication credential repository and processing function (ARPF), or a subscription identifier unhiding function (SIDF).

[0129] Utilizing the method 1300 , the HN-triggered authentication process may be initiated in a timely manner, thereby improving service continuity.

[0130] Fig.14 1 is a simplified block diagram of a device 1400 suitable for implementing embodiments of the present disclosure. For example, UE 101, AMF 103, SEAF 105, AUSF 107, UDM 109, ARPF 111, and SIDF 113 may be implemented by device 1400. As shown, device 1400 includes a processor 1410, a memory 1420 coupled to processor 1410, and a transceiver 1440 coupled to processor 1410.

[0131] The transceiver 1440 is configured for bidirectional communication. The transceiver 1440 is coupled to at least one antenna to facilitate communication. The transceiver 1440 may include a transmitter circuit (e.g., associated with one or more transmit chains) and / or a receiver circuit (e.g., associated with one or more receive chains). The transmitter circuit and the receiver circuit may employ common circuit elements, different circuit elements, or a combination thereof.

[0132] Processor 1410 may be of any type suitable for the local technology network and may include one or more of the following: as non-limiting examples, a general purpose computer, a special purpose computer, a microprocessor, a digital signal processor (DSP), and a processor based on a multi-core processor architecture. Device 1400 may have multiple processors, such as application specific integrated circuit chips, which are time-constrained by a clock that synchronizes a main processor.

[0133] The memory 1420 may include one or more non-volatile memories and one or more volatile memories. Examples of non-volatile memories include, but are not limited to, read-only memory (ROM) 1424, electrically programmable read-only memory (EPROM), flash memory, hard disk, compact disk (CD), digital video disk (DVD), and other magnetic storage devices and / or optical storage devices. Examples of volatile memories include, but are not limited to, random access memory (RAM) 1422 and other volatile memories that do not persist during power-off time.

[0134] Computer program 1430 includes computer executable instructions that are executed by associated processor 1410. Program 1430 may be stored in ROM 1424. Processor 1410 may perform any suitable actions and processes by loading program 1430 into RAM 1422.

[0135] The embodiments of the present disclosure can be implemented with the aid of program 1430, so that the device 1400 can execute the following steps: Figures 2 to 5 Any process of the present disclosure discussed. The embodiments of the present disclosure may also be implemented by hardware or by a combination of software and hardware.

[0136] The present disclosure also provides at least one computer program product tangibly stored on a non-transitory computer readable storage medium. The computer program product includes computer executable instructions, such as those included in a program module, which are executed in a device on a target real or virtual processor to perform the above-referenced Figures 6 to 13 Any of methods 600 to 1300 described above.

[0137] Further, although the operations are shown in a particular order, this should not be understood as requiring such operations to be performed in a sequential order or in the particular order shown, or requiring the execution of all the operations shown to achieve the desired result. In some cases, multitasking and parallel processing may be advantageous. Although the above discussion includes several specific implementation details, these details should not be understood as limitations on the scope of the present disclosure, but should be considered as descriptions of features that may be peculiar to a particular embodiment. Certain features described in the context of different embodiments may also be implemented in combination in a single embodiment. On the contrary, the various features described in the context of a single embodiment may also be implemented in multiple embodiments individually or in the form of any suitable sub-combination.

[0138] Although the disclosure has been described in language specific to structural features and / or methodological acts, it should be understood that the disclosure defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.

[0139] Various example implementations of the technology have been described. In addition to or as an alternative to the above, the following examples are described. Features described in any of the following examples may be utilized with any of the other examples described herein.

[0140] In some aspects, a processor of an authentication server function (AUSF) is configured to perform operations including: determining to trigger an authentication procedure; and sending a request for an authentication procedure to an access and mobility management function (AMF).

[0141] In some embodiments, determining to trigger the authentication process includes determining to trigger the authentication process based on a determination that a key for the AUSF is refreshed as needed, or a determination that a UE parameter update (UPU) or a roaming guidance (SoR) count wrap occurs.

[0142] In some aspects, the processor of the home network entity is configured to perform operations including: determining to trigger an authentication process; and sending a request for the authentication process to an access and mobility management function (AMF) via an authentication server function (AUSF).

[0143] In some embodiments, determining to trigger the authentication process includes determining to trigger the authentication process based on a determination that a key for the AUSF is refreshed as needed, or a determination that a UE parameter update (UPU) or a roaming guidance (SoR) count wrap occurs.

[0144] In some embodiments, the home network entity includes at least one of: a unified data management (UDM) function, an authentication credential repository and processing function (ARPF), or a subscription identifier unhiding function (SIDF).

[0145] In some aspects, a processor of an access and mobility management function (AMF) is configured to perform operations including: receiving a request for an authentication procedure from an authentication server function (AUSF); and sending a message to a user equipment (UE) including an indication to initiate an authentication procedure.

[0146] In some embodiments, the indication indicates that the authentication process was triggered by at least one of: an authentication server function (AUSF), a unified data management (UDM) function, an authentication credential repository and processing function (ARPF), or a subscription identifier unhiding function (SIDF).

[0147] In some embodiments, the message is a non-access stratum (NAS) message.

[0148] In some aspects, a processor of a user equipment (UE) is configured to perform operations including: receiving a message from an access and mobility management function (AMF), the message including an indication to initiate an authentication procedure; and initiating an authentication procedure.

[0149] In some embodiments, the indication indicates that the authentication process was triggered by at least one of: an authentication server function (AUSF), a unified data management (UDM) function, an authentication credential repository and processing function (ARPF), or a subscription identifier unhiding function (SIDF).

[0150] In some embodiments, the message is a non-access stratum (NAS) message.

[0151] In some aspects, the processor of the home network entity is configured to perform operations including: determining to trigger an authentication process; generating an authentication vector in response to determining to trigger the authentication process; and sending an authentication acquisition response message to an authentication server function (AUSF), the authentication acquisition response message including the authentication vector and an indication that the authentication process was triggered by the home network entity.

[0152] In some embodiments, determining to trigger the authentication process includes determining to trigger the authentication process based on a determination that a key for the AUSF is refreshed as needed, or a determination that a UE parameter update (UPU) or a roaming guidance (SoR) count wrap occurs.

[0153] In some embodiments, the home network entity includes at least one of: a unified data management (UDM) function, an authentication credential repository and processing function (ARPF), or a subscription identifier unhiding function (SIDF).

[0154] In some aspects, a processor of an authentication server function (AUSF) is configured to perform operations including: receiving an authentication acquisition response message from a home network entity, the authentication acquisition response message including an authentication vector and an indication that an authentication process is triggered by the home network entity; and determining a current serving network name in response to the indication.

[0155] In some embodiments, determining the current serving network name includes obtaining the current serving network name from an access and mobility management function (AMF).

[0156] In some embodiments, the home network entity includes at least one of: a unified data management (UDM) function, an authentication credential repository and processing function (ARPF), or a subscription identifier unhiding function (SIDF).

[0157] In some aspects, a processor of an authentication server function (AUSF) is configured to perform operations including: determining to trigger an authentication process; after determining to trigger the authentication process, determining a current serving network name; and sending an authentication acquisition request message including the current serving network name to a home network entity.

[0158] In some embodiments, determining the current serving network name includes obtaining the current serving network name from an access and mobility management function (AMF).

[0159] In some embodiments, determining to trigger the authentication process includes determining to trigger the authentication process based on a determination that a key for the AUSF is refreshed as needed, or a determination that a UE parameter update (UPU) or a roaming guidance (SoR) count wrap occurs.

[0160] In some embodiments, the operation also includes: sending a first indication to the home network entity indicating that the authentication process is triggered by the AUSF.

[0161] In some embodiments, the indication is included in an authentication acquisition request message.

[0162] In some embodiments, the operation further includes: receiving an authentication acquisition response message from the home network entity, the authentication acquisition response message including an authentication vector and a second indication indicating that the authentication process is triggered by the AUSF.

[0163] In some embodiments, the home network entity includes at least one of: a unified data management (UDM) function, an authentication credential repository and processing function (ARPF), or a subscription identifier unhiding function (SIDF).

[0164] In some aspects, the processor of the home network entity is configured to perform operations including: receiving an authentication acquisition request message including a current service network name from an authentication server function (AUSF); determining that the authentication process is triggered by the AUSF; generating an authentication vector in response to determining that the authentication process is triggered by the home network; and sending an authentication acquisition response message to the AUSF, the authentication acquisition response message including the authentication vector and a second indication indicating that the authentication process is triggered by the AUSF.

[0165] In some embodiments, the operations also include: receiving a first indication from the AUSF indicating that the authentication process was triggered by the home network.

[0166] In some embodiments, the first indication is included in an authentication acquisition request message.

[0167] In some embodiments, the home network entity includes at least one of: a unified data management (UDM) function, an authentication credential repository and processing function (ARPF), or a subscription identifier unhiding function (SIDF).

[0168] In some aspects, an authentication server function (AUSF) includes: a processor configured to perform operations according to some example embodiments of the present disclosure; and a transceiver communicatively coupled to the processor and configured to communicate with an access and mobility management function (AMF) and a home network entity.

[0169] In some aspects, a home network entity includes: a processor configured to perform operations according to some example embodiments of the present disclosure; and a transceiver communicatively coupled to the processor and configured to communicate with an authentication server function (AUSF).

[0170] In some aspects, an access and mobility management function (AMF) includes: a processor configured to perform operations according to some example embodiments of the present disclosure; and a transceiver communicatively coupled to the processor and configured to communicate with a user equipment (UE) and an authentication server function (AUSF).

[0171] In some aspects, a user equipment (UE) includes: a processor configured to perform operations according to some example embodiments of the present disclosure; and a transceiver communicatively coupled to the processor and configured to communicate with an access and mobility management function (AMF).

Claims

1. A processor of an authentication server function (AUSF), the processor being configured to perform operations, the operations include: Determine triggering authentication process; as well as A request for the authentication procedure is sent to an Access and Mobility Management Function (AMF).

2. The processor of claim 1 , wherein determining triggers the authentication process include: The authentication process is triggered by a determination that a key for the AUSF is refreshed as needed, or a determination that a UE parameter update (UPU) or a roaming directed (SoR) count wrap occurs.

3. A processor of a home network entity, the processor being configured to perform an operation, the operation include: Determine triggering authentication process; as well as A request for the authentication process is sent to the Access and Mobility Management Function (AMF) via the Authentication Server Function (AUSF).

4. The processor of claim 3, wherein determining triggers the authentication process include: The authentication process is triggered by a determination that a key for the AUSF is refreshed as needed, or a determination that a UE parameter update (UPU) or a roaming directed (SoR) count wrap occurs.

5. The processor of claim 3 or 4, wherein the home network entity comprises at least one of the following: a unified data management (UDM) function, an authentication credential repository and processing function (ARPF), or a subscription identifier unhiding function (SIDF).

6. A processor of an access and mobility management function (AMF), the processor being configured to perform operations, the operations include: receiving a request for an authentication process from an authentication server function (AUSF); as well as A message is sent to a user equipment (UE), the message including an indication to initiate the authentication process.

7. The processor of claim 6, wherein the indication indicates that the authentication process is triggered by at least one of: an authentication server function (AUSF), a unified data management (UDM) function, an authentication credential repository and processing function (ARPF), or a subscription identifier unhiding function (SIDF).

8. The processor of claim 6 or 7, wherein the message is a Non-Access Stratum (NAS) message.

9. A processor of a user equipment (UE), the processor being configured to perform operations, the operations include: receiving a message from an access and mobility management function (AMF), the message comprising an indication to initiate an authentication procedure; as well as The authentication process is initiated.

10. The processor of claim 9, wherein the indication indicates that the authentication process is triggered by at least one of: an authentication server function (AUSF), a unified data management (UDM) function, an authentication credential repository and processing function (ARPF), or a subscription identifier unhiding function (SIDF).

11. The processor of claim 9 or 10, wherein the message is a Non-Access Stratum (NAS) message.

12. A processor of a home network entity, the processor being configured to perform an operation, the operation include: Determine triggering authentication process; In response to determining that the authentication process is triggered, generating an authentication vector; as well as An authentication acquisition response message is sent to an authentication server function (AUSF), wherein the authentication acquisition response message includes the authentication vector and an indication indicating that the authentication process is triggered by the home network entity.

13. The processor of claim 12, wherein determining triggers the authentication process include: The authentication process is triggered by a determination that a key for the AUSF is refreshed as needed, or a determination that a UE parameter update (UPU) or a roaming directed (SoR) count wrap occurs.

14. The processor of claim 12 or 13, wherein the home network entity comprises at least one of: a unified data management (UDM) function, an authentication credential repository and processing function (ARPF), or a subscription identifier unhiding function (SIDF).

15. A processor of an authentication server function (AUSF), the processor being configured to perform operations, the operations include: receiving an authentication acquisition response message from a home network entity, the authentication acquisition response message including an authentication vector and an indication indicating that an authentication process is triggered by the home network entity; as well as In response to the indication, a current serving network name is determined.

16. The processor of claim 15, wherein determining the current serving network name include: The current serving network name is obtained from an access and mobility management function (AMF).

17. The processor of claim 15 or 16, wherein the home network entity comprises at least one of: a unified data management (UDM) function, an authentication credential repository and processing function (ARPF), or a subscription identifier unhiding function (SIDF).

18. A processor of an authentication server function (AUSF), the processor being configured to perform operations, the operations include: Determine triggering authentication process; After determining that the authentication process is triggered, determining the current serving network name; as well as An authentication acquisition request message including the current service network name is sent to a home network entity.

19. The processor of claim 18, wherein determining the current serving network name include: The current serving network name is obtained from an access and mobility management function (AMF).

20. A processor according to claim 18 or 19, wherein determining triggers the authentication process include: The authentication process is triggered by a determination that a key for the AUSF is refreshed as needed, or a determination that a UE parameter update (UPU) or a roaming directed (SoR) count wrap occurs.

21. A processor according to any one of claims 18 to 20, wherein the operation further include: A first indication is sent to the home network entity, indicating that the authentication process is triggered by the AUSF.

22. The processor of claim 21, wherein the indication is included in the authentication acquisition request message.

23. A processor according to any one of claims 18 to 22, wherein the operation further include: An authentication acquisition response message is received from the home network entity, the authentication acquisition response message including an authentication vector and a second indication indicating that the authentication process is triggered by the AUSF.

24. The processor of any one of claims 18 to 23, wherein the home network entity comprises at least one of: a unified data management (UDM) function, an authentication credential repository and processing function (ARPF), or a subscription identifier unhiding function (SIDF).

25. A processor of a home network entity, the processor being configured to perform an operation, the operation include: receiving an authentication acquisition request message including a current serving network name from an authentication server function (AUSF); Determining that the authentication process is triggered by the AUSF; generating an authentication vector in response to determining that the authentication process is triggered by the home network; as well as An authentication acquisition response message is sent to the AUSF, wherein the authentication acquisition response message includes the authentication vector and a second indication indicating that the authentication process is triggered by the AUSF.

26. The processor of claim 25, wherein the operation further include: A first indication is received from the AUSF indicating that the authentication process is triggered by the home network.

27. The processor of claim 26, wherein the first indication is included in the authentication acquisition request message.

28. The processor of any one of claims 25 to 27, wherein the home network entity comprises at least one of: a unified data management (UDM) function, an authentication credential repository and processing function (ARPF), or a subscription identifier unhiding function (SIDF).

29. An authentication server function (AUSF), include: A processor according to any one of claims 1 to 2 and 15 to 24, and a transceiver communicatively coupled to the processor and configured to communicate with an Access and Mobility Management Function (AMF) and a home network entity.

30. A home network entity, include: A processor according to any one of claims 3 to 5, 12 to 14 and 25 to 28, and A transceiver is communicatively coupled to the processor and configured to communicate with an authentication server function (AUSF).

31. An access and mobility management function (AMF), include: A processor according to any one of claims 6 to 8, and A transceiver is communicatively coupled to the processor and configured to communicate with a user equipment (UE) and an authentication server function (AUSF).

32. A user equipment (UE), include: A processor according to any one of claims 9 to 11, and A transceiver is communicatively coupled to the processor and is configured to communicate with an access and mobility management function (AMF).

Images