Use of authentication agents in application authentication and key management

Abstract

The present disclosure relates to techniques for using an authentication agent in application authentication and key management in a wireless communication system. An authentication agent in a cellular network may receive a request from a wireless device to establish an application session. Authentication of the wireless device may be performed using an authentication anchor function associated with the cellular network to obtain an authentication result. The authentication agent may provide an indication of the authentication result to an application server associated with the application session.

Description

Technical Field

[0001] The present application relates to wireless communications, and more particularly to systems, apparatuses, and methods for using an authentication agent in application authentication and key management in wireless communication systems. Background Art

[0002] The use of wireless communication systems is growing rapidly. In recent years, wireless devices such as smart phones and tablet computers have become increasingly sophisticated. In addition to supporting phone calls, many mobile devices (i.e., user equipment devices or UEs) now also provide access to the Internet, email, text messaging, and navigation using a global positioning system (GPS), and are capable of operating complex and sophisticated applications that utilize these functions. In addition, there are many different wireless communication technologies and wireless communication standards. Some examples of wireless communication standards include GSM, UMTS (e.g., associated with WCDMA or TD-SCDMA air interfaces), LTE, Advanced LTE (LTE-A), NR, HSPA, 3GPP2 CDMA2000 (e.g., 1xRTT, 1xEV-DO, HRPD, eHRPD), IEEE 802.11 (WLAN or Wi-Fi), Bluetooth, etc. TM wait.

[0003] The introduction of an ever-increasing number of features and functionalities in wireless communication devices has also created a continuing need for improved wireless communications and improved wireless communication devices. Specifically, it is important to ensure the accuracy of signals sent and received by user equipment (UE) devices (e.g., by wireless devices such as cellular phones, base stations, and relay stations used in wireless cellular communications). In addition, increasing the functionality of UE devices may put a great strain on the battery life of UE devices. Therefore, it is also very important to reduce the power requirements in the design of UE devices while allowing the UE devices to maintain good transmission and reception capabilities to improve communications. In addition, as the connectivity of devices and the diversity of available services increase, it may be very important to provide robust and efficient authentication techniques to protect the privacy and integrity of data communicated in wireless communication systems. Therefore, improvements are expected in this area. Summary of the invention

[0004] Embodiments of apparatus, systems, and methods for using an authentication agent in application authentication and key management in a wireless communication system are presented herein.

[0005] According to the techniques described herein, an authentication agent may perform authentication of a wireless device to support establishment of an application session for the wireless device in a wireless communication system. One aspect of such authentication may include the possibility of conducting multiple application sessions using a shared secure transport tunnel between the authentication agent and the wireless device. For example, either or both of the wireless device and the authentication agent may determine whether to obtain a new application key and establish a new secure transport tunnel for an application session being established, or to share an existing application key and secure transport tunnel with one or more application sessions already established for the wireless device.

[0006] The authentication agent may use a protocol for communicating with the application server that is protected by confidentiality and supports authentication between the authentication agent and the application server, so that the wireless device can rely on the authentication agent to effectively authenticate the wireless device with which the application session is established to the application server. The authentication agent may also be able to provide the application server with an authentication result for the wireless device (e.g., when establishing the application session with the application server, or upon request of the application server) to effectively authenticate the wireless device with which the application session is established to the application server.

[0007] Thus, at least according to some embodiments, an authentication agent may provide authentication of a wireless device to an application server, as well as provide authentication of an application server to a wireless device, which may reduce the authentication and security task burden on one or both of the wireless device and the application server between which an application session is established via the authentication agent.

[0008] It should be noted that the techniques described herein may be implemented in and / or used with a number of different types of devices, including but not limited to base stations, access points, cellular telephones, portable media players, tablet computers, wearable devices, unmanned aerial vehicles, unmanned flight controllers, automobiles and / or motor vehicles, and various other computing devices.

[0009] This disclosure is intended to provide a brief overview of some of the topics described in this document. Therefore, it should be understood that the above features are only examples and should not be construed as narrowing the scope or essence of the topics described herein in any way. Other features, aspects, and advantages of the topics described herein will become apparent through the following detailed description, drawings, and claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] A better understanding of the present subject matter may be obtained when the following detailed description of various embodiments is considered in conjunction with the following drawings, in which:

[0011] Figure 1 illustrates an exemplary (and simplified) wireless communication system according to some embodiments;

[0012] Figure 2 illustrates an exemplary base station in communication with an exemplary wireless user equipment (UE) device according to some embodiments;

[0013] Figure 3 illustrates an exemplary block diagram of a UE according to some embodiments;

[0014] Figure 4 illustrates an exemplary block diagram of a base station according to some embodiments;

[0015] Figure 5 illustrates an exemplary block diagram of a cellular network element according to some embodiments;

[0016] Figure 6 is a flow chart illustrating aspects of an exemplary possible method for using an authentication agent for application authentication and key management in a wireless communication system according to some embodiments;

[0017] Figures 7 and 8 illustrates examples of possible application authentication and key management architecture schemes in reference point representations of internal and external application functions, respectively, according to some embodiments;

[0018] Fig. 9 illustrates an example basic network model scheme for application authentication and key management according to some embodiments;

[0019] Figure 10 to Figure 11 is a signal flow diagram illustrating possible signaling that may be used for key generation and authentication utilizing an application authentication and key management framework in a cellular communication system according to various embodiments;

[0020] Fig.12 illustrates one possible architectural view of an authentication agent and its environment and reference points according to various embodiments;

[0021] Fig.13 illustrates one possible high-level reference model of network application functionality using bootstrapping services according to some embodiments; and

[0022] Fig.14 An example of one possible application authentication and key management architecture that may include authentication proxy functionality according to some embodiments is illustrated.

[0023] Although the features described herein are susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and described in detail herein. However, it should be understood that the drawings and detailed description thereof are not intended to be limited to the specific forms disclosed, but on the contrary, are intended to cover all modifications, equivalents, and alternatives falling within the spirit and scope of the subject matter as defined by the appended claims. DETAILED DESCRIPTION

[0024] Acronyms

[0025] Various acronyms are used throughout this disclosure. Definitions of the most commonly used acronyms that may appear throughout this disclosure are provided below:

[0026] UE: User Equipment

[0027] RF: Radio Frequency

[0028] BS: Base Station

[0029] GSM: Global System for Mobile Communications

[0030] UMTS: Universal Mobile Telecommunications System

[0031] LTE: Long Term Evolution

[0032] NR: New Radio

[0033] TX: Send

[0034] RX: Receive

[0035] RAT: Radio Access Technology

[0036] TRP: Transmit Receive Point

[0037] DCI: Downlink Control Information

[0038] AKMA: Application Authentication and Key Management

[0039] AAnF: AKMA Anchor Function

[0040] AF: Application Function

[0041] AUSF: Authentication server function

[0042] AP: Authentication Agent

[0043] AS: Application Server

[0044] TLS: TLS transport layer information

[0045] the term

[0046] The following is a glossary of terms that will appear in this disclosure:

[0047] Memory medium—any of various types of non-transitory memory devices or storage devices. The term "memory medium" is intended to include installation media, such as CD-ROM, floppy disk, or tape devices; computer system memory or random access memory, such as DRAM, DDR RAM, SRAM, EDO RAM, Rambus RAM, etc.; non-volatile memory, such as flash memory, magnetic media, such as hard disk drives or optical storage devices; registers or other similar types of memory elements, etc. The memory medium may also include other types of non-transitory memory or combinations thereof. In addition, the memory medium may be located in a first computer system executing a program, or may be located in a different second computer system connected to the first computer system via a network such as the Internet. In the latter example, the second computer system may provide program instructions to the first computer system for execution. The term "memory medium" may include two or more memory media, which may reside in different locations in different computer systems connected, for example, via a network. The memory medium may store program instructions (e.g., embodied as a computer program) that may be executed by one or more processors.

[0048] Carrier Media—Memory media as described above, as well as physical transmission media such as a bus, network, and / or other physical transmission media that convey signals such as electrical, electromagnetic, or digital signals.

[0049] Computer system (or computer)—any of various types of computing or processing systems, including a personal computer system (PC), a mainframe computer system, a workstation, a network appliance, an Internet appliance, a personal digital assistant (PDA), a television system, a grid computing system, or other devices or combinations of devices. In general, the term "computer system" may be broadly defined as any device (or combination of devices) that includes at least one processor that executes instructions from a memory medium.

[0050] User Equipment (UE) (or "UE device") - any of various types of computer systems or devices that are mobile or portable and that perform wireless communications. Examples of UE devices include mobile phones or smart phones (e.g., iPhone TM , based on Android TM phones), tablet computers (e.g., iPad TM 、Samsung Galaxy TM ), portable gaming devices (e.g., Nintendo DS TM , PlayStation Portable TM 、Gameboy Advance TM , iPhone TM), wearable devices (e.g., smart watches, smart glasses), laptops, PDAs, portable Internet devices, music players, data storage devices, other handheld devices, automobiles and / or motor vehicles, unmanned aerial vehicles (UAVs) (e.g., drones), UAV controllers (UACs), etc. In general, the term "UE" or "UE device" can be broadly defined to cover any electronic device, computing device, and / or telecommunication device (or a combination of these devices) that is easily transportable by a user and capable of wireless communication.

[0051] Wireless Device—Any of various types of computer systems or devices that perform wireless communications. A wireless device may be portable (or mobile), or may be stationary or fixed at a location. A UE is an example of a wireless device.

[0052] Communication device - any of various types of computer systems or devices that perform communication, where the communication may be wired or wireless. A communication device may be portable (or mobile), or may be stationary or fixed at a location. A wireless device is an example of a communication device. A UE is another example of a communication device.

[0053] Base Station (BS)—The term "base station" has the full breadth of its ordinary meaning and includes at least a wireless communication station installed at a fixed location and used to communicate as part of a wireless telephone system or radio system.

[0054] Processing element (or processor) - refers to various elements or combinations of elements that are capable of performing functions in a device (e.g., a user equipment device or a cellular network device). Processing elements may include, for example, processors and associated memory, portions or circuits of individual processor cores, entire processor cores, processor arrays, circuits such as ASICs (application specific integrated circuits), programmable hardware elements such as field programmable gate arrays (FPGAs), and any of the above combinations.

[0055] Wi-Fi—The term "Wi-Fi" has the full scope of its usual meaning and includes at least wireless communication networks or RATs that are served by wireless LAN (WLAN) access points and provide connectivity to the Internet through these access points. Most modern Wi-Fi networks (or WLAN networks) are based on the IEEE 802.11 standard and are marketed under the name "Wi-Fi". Wi-Fi (WLAN) networks are distinct from cellular networks.

[0056] Automatic—refers to an action or operation being performed by a computer system (e.g., software executed by a computer system) or a device (e.g., a circuit, a programmable hardware element, an ASIC, etc.) without the action or operation being directly specified or performed by a user input. Thus, the term "automatic" is in contrast to an operation being manually performed or specified by a user, where the user provides input to directly perform the operation. An automatic process may be initiated by input provided by a user, but subsequent actions performed "automatically" are not specified by the user, i.e., are not performed "manually," where the user specifies each action to be performed. For example, a user filling out an electronic form by selecting each field and providing input specifying information (e.g., by typing in information, selecting checkboxes, radio selections, etc.) is manually filling out the form, even though the computer system must update the form in response to the user action. The form may be automatically filled out by a computer system, where the computer system (e.g., software executed on the computer system) analyzes the fields of the form and fills out the form without any user input specifying the answers to the fields. As indicated above, a user may invoke automatic filling out of a form, but not participate in the actual filling out of the form (e.g., the user does not manually specify the answers to the fields but rather they are automatically completed). This specification provides various examples of operations that are automatically performed in response to actions that a user has taken.

[0057] Configured to—Various components may be described as being “configured to” perform one or more tasks. In such contexts, “configured to” is a broad statement that generally means “having a structure” that performs one or more tasks during operation. Thus, a component may be configured to perform a task even when the component is not currently performing the task (e.g., a set of electrical conductors may be configured to electrically connect a module to another module even when the two modules are not connected). In some contexts, “configured to” may be a broad statement that generally means “having a circuit system” that performs one or more tasks during operation. Thus, a component may be configured to perform a task even when the component is not currently turned on. Typically, the circuit system that forms the structure corresponding to “configured to” may include hardware circuits.

[0058] For ease of description, various components may be described as performing one or more tasks. Such descriptions should be interpreted as including the phrase "configured to". The description of a component being configured to perform one or more tasks is expressly intended not to invoke the sixth paragraph of Section 112 of Title 35 of the United States Code on that component.

[0059] Figure 1 and Figure 2 -Exemplary Communication System

[0060] Figure 1 An exemplary (and simplified) wireless communication system that can implement various aspects of the present disclosure according to some embodiments is illustrated. Note that Figure 1 The system is only one example of a possible system, and the embodiments may be implemented in any of a variety of systems as desired.

[0061] As shown, the exemplary wireless communication system includes a base station 102, which communicates with one or more (e.g., any number) user equipment 106A, 106B, etc. to 106N through a transmission medium. Each user equipment may be referred to as a "user equipment" (UE) or a UE device in this document. Therefore, the user equipment 106 is referred to as a UE or a UE device.

[0062] The base station 102 may be a base transceiver station (BTS) or a cell site, and may include hardware and / or software that implements wireless communication with UEs 106A to 106N. If the base station 102 is implemented in the context of LTE, it may be referred to as an "eNodeB" or "eNB". If the base station 102 is implemented in the context of 5G NR, it may alternatively be referred to as a "gNodeB" or "gNB". The base station 102 may also be equipped to communicate with a network 100 (e.g., a core network of a cellular service provider, a telecommunications network such as a public switched telephone network (PSTN), and / or the Internet, and various possible networks). Therefore, the base station 102 may facilitate communication between user devices and / or between user devices and the network 100. The communication area (or coverage area) of a base station may be referred to as a "cell". Also as used herein, with respect to a UE, sometimes a base station may be considered to represent a network in consideration of the uplink and downlink communications of the UE. Therefore, a UE communicating with one or more base stations in a network may also be understood as a UE communicating with a network.

[0063] The base station 102 and the user equipment may be configured to communicate over a transmission medium using any of a variety of radio access technologies (RATs), also referred to as wireless communication technologies or telecommunication standards, such as GSM, UMTS (WCDMA), LTE, Advanced LTE (LTE-A), LAA / LTE-U, 5G NR, 3GPP2 CDMA2000 (e.g., 1xRTT, 1xEV-DO, HRPD, eHRPD), Wi-Fi, etc.

[0064] Base station 102 and other similar base stations operating according to the same or different cellular communication standards may thus be provided as one or more cell networks that may provide continuous or nearly continuous overlapping service to UE 106 and similar devices over a geographic area via one or more cellular communication standards.

[0065] Note that UE 106 is capable of communicating using multiple wireless communication standards. For example, UE 106 may be configured to communicate using either or both of the 3GPP cellular communication standard or the 3GPP2 cellular communication standard. In some embodiments, UE 106 may be configured to perform techniques for using an authentication agent for application authentication and key management in a wireless communication system, such as according to the various methods described herein. UE 106 may also or alternatively be configured to use WLAN, Bluetooth, or other wireless communication standards. TM , one or more global navigation satellite systems (GNSS, such as GPS or GLONASS), one and / or more mobile television broadcast standards (e.g., ATSC-M / H), etc. Other combinations of wireless communication standards (including more than two wireless communication standards) are also possible.

[0066] Figure 2 An exemplary user equipment 106 (e.g., one of devices 106A to 106N) communicating with a base station 102 according to some embodiments is illustrated. UE 106 may be a device with wireless network connectivity, such as a mobile phone, a handheld device, a wearable device, a computer or tablet computer, an unmanned aerial vehicle (UAV), an unmanned flight controller (UAC), a car, or almost any type of wireless device. UE 106 may include a processor (processing element) configured to execute program instructions stored in a memory. UE 106 may perform any method implementation in the method implementation scheme described herein by executing such stored instructions. Alternatively or in addition, UE 106 may include a programmable hardware element, such as an FPGA (field programmable gate array) configured to perform (e.g., individually or in combination) any method implementation in the method implementation scheme described herein or any part of any method implementation in the method implementation scheme described herein, an integrated circuit, and / or any of various other possible hardware components. UE 106 may be configured to communicate using any of a plurality of wireless communication protocols. For example, UE 106 may be configured to communicate using two or more of CDMA2000, LTE, LTE-A, 5G NR, WLAN, or GNSS. Other combinations of wireless communication standards are also possible.

[0067] UE 106 may include one or more antennas for communicating using one or more wireless communication protocols according to one or more RAT standards. In some embodiments, UE 106 may share one or more parts of a receive chain and / or a transmit chain between multiple wireless communication standards. The shared radio component may include a single antenna, or may include multiple antennas (e.g., for a multiple-input, multiple-output or "MIMO" antenna system) for performing wireless communications. Typically, the radio component may include any combination of a baseband processor, an analog RF signal processing circuit system (e.g., including filters, mixers, oscillators, amplifiers, etc.), or a digital processing circuit system (e.g., for digital modulation and other digital processing). Similarly, the radio component may use the aforementioned hardware to implement one or more receive chains and transmit chains. For example, UE 106 may share one or more parts of a receive chain and / or a transmit chain between multiple wireless communication technologies such as those discussed above.

[0068] In some embodiments, UE 106 may include any number of antennas and may be configured to use the antennas to send and / or receive directional wireless signals (e.g., beams). Similarly, BS 102 may also include any number of antennas and may be configured to use the antennas to send and / or receive directional wireless signals (e.g., beams). In order to receive and / or send such directional signals, the antennas of UE 106 and / or BS 102 may be configured to apply different "weights" to different antennas. The process of applying these different weights may be referred to as "pre-coding".

[0069] In some embodiments, UE 106 may include a separate transmit chain and / or receive chain (e.g., including separate antennas and other radio components) for each wireless communication protocol with which it is configured to communicate. As another possibility, UE 106 may include one or more radio components shared between multiple wireless communication protocols, and one or more radio components used uniquely by a single wireless communication protocol. For example, UE 106 may include shared radio components for communicating using any of LTE or CDMA2000 1xRTT (or LTE or NR, or LTE or GSM), and shared radio components for communicating using Wi-Fi and Bluetooth. TM Each of the independent radio components for communication. Other configurations are also possible.

[0070] Figure 3 - Block diagram of an exemplary UE device

[0071] Figure 3A block diagram of an exemplary UE 106 according to some embodiments is illustrated. As shown, the UE 106 may include a system on chip (SOC) 300, which may include parts for various purposes. For example, as shown, the SOC 300 may include a processor 302 that can execute program instructions for the UE 106, and a display circuit system 304 that can perform graphics processing and provide display signals to a display 360. The SOC 300 may also include a sensor circuit system 370, which may include components for sensing or measuring any of various possible characteristics or parameters of the UE 106. For example, the sensor circuit system 370 may include a motion sensing circuit system, which is configured to detect the motion of the UE 106, for example, using a gyroscope, an accelerometer, and / or any of various other motion sensing components. As another possibility, the sensor circuit system 370 may include one or more temperature sensing components, which are used, for example, to measure the temperature of each of one or more antenna panels and / or other components of the UE 106. Any of a variety of other possible types of sensor circuitry may also or alternatively be included in the UE 106, as desired. The processor 302 may also be coupled to a memory management unit (MMU) 340, which may be configured to receive addresses from the processor 302 and translate those addresses into locations in memory (e.g., memory 306, read-only memory (ROM) 350, NAND flash memory 310) and / or other circuits or devices, such as display circuitry 304, radio 330, connector I / F 320, and / or display 360. The MMU 340 may be configured to perform memory protection and page table translation or setup. In some embodiments, the MMU 340 may be included as part of the processor 302.

[0072] As shown, SOC 300 can be coupled to various other circuits of UE 106. For example, UE 106 may include various types of memory (e.g., including NAND flash memory 310), connector interface 320 (e.g., for coupling to a computer system, a docking station, a charging station, etc.), display 360, and wireless communication circuitry 330 (e.g., for LTE, LTE-A, NR, CDMA2000, Bluetooth TM, Wi-Fi, GPS, etc.). The UE device 106 may include or be coupled to at least one antenna (e.g., 335a), and may include multiple antennas (e.g., illustrated by antennas 335a and 335b) for performing wireless communications with base stations and / or other devices. Antennas 335a and 335b are shown by way of example, and the UE device 106 may include fewer or more antennas. In general, one or more antennas are collectively referred to as antennas 335. For example, the UE device 106 may use antenna 335 with the aid of radio circuitry 330 to perform wireless communications. The wireless communication circuitry may include multiple receive chains and / or multiple transmit chains for receiving and / or transmitting multiple spatial streams, such as in a multiple-input multiple-output (MIMO) configuration. As mentioned above, in some embodiments, the UE may be configured to perform wireless communications using multiple wireless communication standards.

[0073] UE 106 may include hardware and software components for implementing methods for UE 106 to perform techniques such as those described further below herein for using an authentication agent in application authentication and key management in a wireless communication system. The processor 302 of the UE device 106 may be configured to implement part or all of the methods described herein, for example, by executing program instructions stored on a memory medium (e.g., a non-transitory computer-readable memory medium). In other embodiments, the processor 302 may be configured as a programmable hardware element, such as an FPGA (field programmable gate array) or as an ASIC (application-specific integrated circuit). In addition, as Figure 3 As shown, the processor 302 may be coupled to other components and / or may interoperate with other components to perform techniques for using an authentication agent for application authentication and key management in a wireless communication system according to various embodiments disclosed herein. The processor 302 may also implement various other applications and / or end-user applications running on the UE 106.

[0074] In some embodiments, radio 330 may include a separate controller dedicated to controlling communications for each corresponding RAT standard. Figure 3 As shown, the radio component 330 may include a Wi-Fi controller 352, a cellular controller (eg, an LTE and / or LTE-A controller) 354, and a BLUETOOTH controller. TM Controller 356, and in at least some embodiments, one or more or all of these controllers may be implemented as respective integrated circuits (referred to as ICs or chips) that communicate with each other and with SOC 300 (and more specifically, with processor 302). For example, Wi-Fi controller 352 may communicate with cellular controller 354 via a cell-ISM link or WCI interface, and / or Bluetooth controller 355 may communicate with cellular controller 354 via a cell-ISM link or WCI interface.TM The controller 356 may communicate with the cellular controller 354 via a cell-ISM link, etc. Although three separate controllers are illustrated within the radio 330, other embodiments may be implemented in the UE device 106 having fewer or more similar controllers for various different RATs.

[0075] Additionally, embodiments are contemplated in which the controller may implement functionality associated with multiple radio access technologies. For example, according to some embodiments, in addition to hardware and / or software components for performing cellular communications, the cellular controller 354 may also include hardware and / or software components for performing one or more activities associated with Wi-Fi, such as Wi-Fi preamble detection, and / or generation and transmission of Wi-Fi physical layer preamble signals.

[0076] Figure 4 - Block diagram of an exemplary base station

[0077] Figure 4 1 illustrates a block diagram of an exemplary base station 102 according to some embodiments. Note that Figure 4 The base station of is only one example of a possible base station. As shown, the base station 102 may include a processor 404 that may execute program instructions for the base station 102. The processor 404 may also be coupled to a memory management unit (MMU) 440 or other circuit or device, which may be configured to receive addresses from the processor 404 and convert these addresses to locations in memory (e.g., memory 460 and read-only memory (ROM) 450).

[0078] Base station 102 may include at least one network port 470. Network port 470 may be configured to couple to a telephone network and provide access to the telephone network described above. Figure 1 and Figure 2 106. The network port 470 (or an additional network port) may also or alternatively be configured to couple to a cellular network, such as a core network of a cellular service provider. The core network may provide mobility-related services and / or other services to multiple devices, such as the UE device 106. In some cases, the network port 470 may be coupled to the telephone network via the core network, and / or the core network may provide the telephone network (e.g., in other UE devices served by the cellular service provider).

[0079] In some embodiments, base station 102 may be a next generation base station, e.g., a 5G New Radio (5G NR) base station, or "gNB". In such embodiments, base station 102 may be connected to a legacy evolved packet core (EPC) network and / or to an NR core (NRC) network. Furthermore, base station 102 may be considered a 5G NR cell and may include one or more transmit and receive points (TRPs). Furthermore, a UE capable of operating in accordance with 5G NR may be connected to one or more TRPs within one or more gNBs.

[0080] The base station 102 may include at least one antenna 434 and possibly multiple antennas. One or more antennas 434 may be configured to operate as a wireless transceiver and may be further configured to communicate with the UE device 106 via the radio component 430. The antenna 434 communicates with the radio component 430 via a communication chain 432. The communication chain 432 may be a receive chain, a transmit chain, or both. The radio component 430 may be designed to communicate via various wireless telecommunication standards, including but not limited to 5G NR, 5G NR SAT, LTE, LTE-A, GSM, UMTS, CDMA2000, Wi-Fi, etc.

[0081] The base station 102 may be configured to perform wireless communications using multiple wireless communication standards. In some cases, the base station 102 may include multiple radio components that enable the base station 102 to communicate according to multiple wireless communication technologies. For example, as one possibility, the base station 102 may include an LTE radio component for performing communications according to LTE and a 5GNR radio component for performing communications according to 5G NR. In this case, the base station 102 may be able to operate as both an LTE base station and a 5GNR base station. As another possibility, the base station 102 may include a multimode radio component that can perform communications according to any one of a plurality of wireless communication technologies (e.g., 5G NR and Wi-Fi, 5G NR SAT and Wi-Fi, LTE and Wi-Fi, LTE and UMTS, LTE and CDMA2000, UMTS and GSM, etc.).

[0082] As further described later herein, BS 102 may include hardware and software components for implementing or supporting a specific implementation of the features described herein. The processor 404 of the base station 102 may be configured to implement and / or support a specific implementation of part or all of the methods described herein, for example, by executing program instructions stored on a memory medium (e.g., a non-transitory computer-readable memory medium). Alternatively, the processor 404 may be configured as a programmable hardware element such as an FPGA (field programmable gate array), or as an ASIC (application-specific integrated circuit) or a combination thereof. In the case of certain RATs (e.g., Wi-Fi), the base station 102 may be designed as an access point (AP), in which case the network port 470 may be implemented to provide access to a wide area network and / or one or more local area networks, for example, it may include at least one Ethernet port, and the radio component 430 may be designed to communicate according to the Wi-Fi standard.

[0083] Furthermore, as described herein, the one or more processors 404 may include one or more processing elements. Thus, the processor 404 may include one or more integrated circuits (ICs) configured to perform the functions of the processor 404. Furthermore, each integrated circuit may include circuitry (e.g., a first circuitry, a second circuitry, etc.) configured to perform the functions of the one or more processors 404.

[0084] Additionally, as described herein, radio 430 may include one or more processing elements. Thus, radio 430 may include one or more integrated circuits (ICs) configured to perform the functions of radio 430. Additionally, each integrated circuit may include circuitry (e.g., first circuitry, second circuitry, etc.) configured to perform the functions of radio 430.

[0085] Figure 5 - Example block diagram of network elements

[0086] Figure 5 An exemplary block diagram of a network element 500 according to some embodiments is shown. According to some embodiments, the network element 500 may implement one or more logical functions / entities of a cellular core network, such as a mobility management entity (MME), a serving gateway (S-GW), an access and management function (AMF), a session management function (SMF), an authentication server function (AUSF), an application function (AF), an authentication agent (AP), an application server (AS), etc. Note that, Figure 5The network element 500 is only one example of a possible network element 500. As shown, the core network element 500 may include a processor 504 that may execute program instructions of the core network element 500. The processor 504 may also be coupled to a memory management unit (MMU) 540 or other circuit or device that may be configured to receive addresses from the processor 504 and translate those addresses into locations in memory (e.g., memory 560 and read-only memory (ROM) 550).

[0087] The network element 500 may include at least one network port 570. The network port 570 may be configured to couple to one or more base stations and / or other cellular network entities and / or devices. The network element 500 may communicate with a base station (e.g., eNB / gNB) and / or other network entities / devices by means of any of a variety of communication protocols and / or interfaces.

[0088] As further described later herein, network element 500 may include hardware and software components for implementing or supporting implementations of the features described herein. Processor 504 of core network element 500 may be configured to implement or support implementations of part or all of the methods described herein, for example, by executing program instructions stored on a memory medium (e.g., a non-transitory computer-readable memory medium). Alternatively, processor 504 may be configured as a programmable hardware element such as an FPGA (field programmable gate array), or as an ASIC (application-specific integrated circuit), or a combination thereof.

[0089] Figure 6 -Use of authentication agents in application authentication and key management

[0090] As the potential connectivity options and possible service range available to wireless devices increase, the importance of providing robust and efficient authentication techniques in wireless communication systems also increases in order to effectively protect the privacy and integrity of data communicated within and outside such systems. Introducing authentication proxy functionality within the Application Authentication and Key Management (AKMA) framework may be one possible technique for providing efficient and effective authentication support in cellular communication systems.

[0091] Therefore, it may be beneficial to specify techniques for utilizing authentication agents in the AKMA framework. To illustrate a set of such possible techniques, Figure 6 is a flow chart illustrating a method for using an authentication agent for application authentication and key management in a wireless communication system according to some embodiments.

[0092] Figure 6Aspects of the method may be implemented by a wireless device and / or an "authentication proxy" cellular network element, for example in conjunction with one or more cellular base stations and / or other cellular network elements (such as UE 106, BS 102, and cellular network element 500 shown and described with respect to the various figures herein), or more generally, in conjunction with any of the computer circuits, systems, devices, elements, or components shown in the above figures, etc., as desired. For example, a processor (and / or other hardware) of such a device may be configured to cause the device to perform any combination of the illustrated method elements and / or other method elements.

[0093] Note that although described in a manner involving the use of communication techniques and / or features associated with 3GPP and / or NR specification documents, Figure 6 However, this description is not intended to limit the present disclosure and may be used in any suitable wireless communication system as needed. Figure 6 In various embodiments, some of the elements of the method shown may be performed simultaneously in an order different from that shown, may be replaced by other method elements, or may be omitted. Additional method elements may also be performed as needed. As shown in the figure, Figure 6 The method can be operated as follows.

[0094] The wireless device may establish a wireless link with a cellular base station. According to some embodiments, the wireless link may include a cellular link according to 5G NR. For example, the wireless device may establish a session with an AMF entity of a cellular network through one or more gNBs that provide radio access to the cellular network. As another possibility, the wireless link may include a cellular link according to LTE. For example, the wireless device may establish a session with a mobility management entity of a cellular network through an eNB that provides radio access to the cellular network. According to various embodiments, other types of cellular links are also possible, and the cellular network may also or alternatively operate according to another cellular communication technology (e.g., UMTS, CDMA2000, GSM, etc.).

[0095] Establishing a wireless link may include establishing an RRC connection with a serving cellular base station according to at least some embodiments. Establishing a first RRC connection may include configuring various parameters for communication between the wireless device and the cellular base station, establishing environmental information of the wireless device, and / or any of a variety of other possible features, for example, involving establishing an air interface of the wireless device for cellular communication with a cellular network associated with the cellular base station. After establishing the RRC connection, the wireless device may operate in an RRC connected state. In some instances, the RRC connection may also be released (e.g., after a certain period of inactivity relative to data communication), in which case the wireless device may operate in an RRC idle state or an RRC inactive state. In some instances, the wireless device may perform a handover (e.g., when in an RRC connected mode) or a cell reselection (e.g., when in an RRC idle mode or an RRC inactive mode) to a new serving cell, for example, due to wireless device mobility, changes in wireless medium conditions, and / or any of a variety of other possible reasons.

[0096] According to at least some embodiments, a wireless device may establish multiple wireless links according to a multi-TRP configuration, for example, with multiple TRPs of a cellular network. In this case, the wireless device may be configured (e.g., via RRC signaling) with one or more transmit control indicators (TCIs), for example, which may correspond to various beams that may be used to communicate with the TRPs. In addition, there may be situations where one or more configured TCI states may be activated by a medium access control (MAC) control element (CE) of the wireless device at a particular time.

[0097] In at least some instances, establishing the wireless link may include the wireless device providing capability information of the wireless device. Such capability information may include information related to any of a plurality of types of wireless device capabilities.

[0098] The wireless link between the wireless device and the cellular base station may provide at least a portion of a physical interface over which the wireless device may communicate information with other elements of the cellular network and / or entities external to the cellular network (e.g., at higher protocol layers). For example, according to some embodiments, the wireless device may perform primary authentication and / or further authentication activities with one or more cellular network elements in accordance with an Application Authentication and Key Management (AKMA) service framework.

[0099] According to some embodiments, a master authentication may be performed between a wireless device and an authentication server function (AUSF) associated with a cellular network. Such authentication may include a signaling exchange between the wireless device and the AUSF to generate a master key (“K AUSF”) and provide the master key to the wireless device. The wireless device and / or AUSF may also generate AKMA key information (e.g., AKMA key or “K AKMA ” and AKMA key identifier or “A-KID”). Some authentications (e.g., A-KID) may be registered by the AUSF using an AKMA anchor function (AAnF) associated with a cellular network, for example to support further authentication activities for the wireless device without risking exposure of the wireless device's master key or AKMA keys through further communications. It should be noted that variations or alternatives to various aspects of the master authentication process described herein are possible and should be considered within the scope of the present disclosure.

[0100] In 602, the wireless device may provide an application session establishment request to an authentication agent (AP) associated with a cellular network, and the AP may receive the application session establishment request from the wireless device. The application session establishment request may request, for example, to establish an application session between the wireless device and an application server (AS) via the AP.

[0101] In 604, the authentication agent may perform authentication of the wireless device using the AAnF to obtain an authentication result for the wireless device. To support such authentication, the wireless device may AKMA The AF may provide the A-KID of the wireless device to the AP, which in turn may provide the A-KID to the AAnF as part of a request for an application key. Based on this request, the AAnF may derive the application key (“K AF ”) and provides an indication of the applied key (e.g., along with key expiration time information) back to the AP. According to at least some embodiments, if this process is successful and the AP is able to obtain this authentication verification information for the wireless device, the authentication result can be considered positive or successful, otherwise the authentication result can be considered negative or failed.

[0102] As one possibility, authentication of the wireless device with AAnF may be performed based on the application session establishment request, e.g., to obtain an application key for the application session being established. As another possibility, if the AP has previously successfully authenticated the wireless device with AAnF and has the application key (or multiple application keys) of the wireless device, it may be possible that the existing application key of the wireless device may be used for multiple application sessions and the AP does not perform authentication of the wireless device with AAnF for each application session establishment request. As a further possibility, it may be possible that the AP may perform authentication of the wireless device with AAnF to obtain a new application key even if the AP has previously successfully authenticated the wireless device with AAnF and has the application key of the wireless device.

[0103] The application key of the application session can be used to support the establishment of a transport layer security (TLS) tunnel between the AP and the wireless device, and the TLS tunnel can be used to communicate data for the application session. At least according to some embodiments, if the same application key is used for multiple application sessions, these application sessions can use a shared TLS tunnel.

[0104] Either or both of the AP or the wireless device may be able to influence whether new application keys are generated and whether a TLS tunnel is established for the application session being established. For example, as one possibility, the wireless device may determine whether to request a new TLS tunnel for the application session, and may provide an indication to the AP whether to request a new TLS tunnel for the application session. According to various embodiments, such an indication may be included in the application session establishment request or may be provided separately from the application session establishment request. For example, according to various embodiments, a wireless device policy regarding sharing or establishing independent TLS tunnels for different application sessions may be determined and indicated as a static preference for all application sessions, or may be dynamically determined on a per-session basis and indicated separately for each application session establishment request. Additionally or alternatively, the AP may determine whether to establish a new TLS tunnel for the application session based at least in part on a local AP policy.

[0105] This determination may be based on any of a variety of possible considerations. As one possibility, the determination may be based at least in part on whether an existing TLS tunnel between the wireless device and the authentication agent has been established. For example, it may be the case that if an existing TLS tunnel between the wireless device and the authentication agent has not been established, the AP and / or the wireless device determines to establish (or requests to have established) a new TLS tunnel, and if an existing TLS tunnel between the wireless device and the authentication agent has been established, the AP and / or the wireless device determines not to establish (or requests to have established) a new TLS tunnel. In other words, in such a scenario, there may not be a limit on the number of application sessions that can share a TLS tunnel, and as long as an existing TLS tunnel has been established, there may be no need to perform additional authentication to obtain a new application key for the wireless device and establish a new TLS tunnel, because the existing application key and TLS tunnel can serve the new application session as well as any previously established application sessions.

[0106] As another possibility, the wireless device and / or the AP may limit the number of application sessions that can share a TLS tunnel. Thus, whether to request a new TLS tunnel for an application session may be determined based at least in part on the number of application sessions served by one or more existing TLS tunnels between the wireless device and the authentication agent, such that, for example, if an existing TLS tunnel between the wireless device and the authentication agent serves less than a threshold / limited number of application sessions for the TLS tunnel (e.g., in which case the application sessions being established can share an existing TLS tunnel), then a new TLS tunnel is not requested, and if each of the existing TLS tunnels between the wireless device and the authentication agent serves at least the threshold / limited number of application sessions for those TLS tunnels (in other words, if all existing TLS tunnels are "full" based on a configured or preferred limit on the number of application sessions that can share those existing TLS tunnels), then a new TLS tunnel is requested.

[0107] Note that it is also possible that the AP and / or wireless device may determine whether to establish a new TLS tunnel for an application session or share an existing TLS tunnel based on characteristics of the application session itself (e.g., as one possibility, based on services associated with the application session) and / or based on application session establishment policy information (e.g., as one possibility, at one or more layers, such as the access stratum (AS) layer of the wireless device). For example, for an application session, the AP and / or wireless device may prefer to establish a separate application key and a separate TLS tunnel for the application session, even if the existing TLS tunnel serves fewer application sessions than the configured or preferred limit of the TLS tunnel, and / or sets a lower limit on the number of application sessions that can be served by the TLS tunnel of the application session than one or more other TLS tunnels (e.g., as one possibility). As another example, for another application session, the AP and / or wireless device may prefer that the application session share an existing TLS tunnel as long as at least one existing TLS tunnel serves fewer application sessions than the configured or preferred limit of the TLS tunnel, and / or sets a higher limit on the number of application sessions that can be served by the TLS tunnel of the application session than one or more other TLS tunnels.

[0108] In 606, the authentication agent may provide an indication of the authentication result of the wireless device to an application server associated with the application session. The authentication result indication may be provided based at least in part on the request to establish the application session; for example, the AP may forward the authentication result indication to the AS associated with the application session in direct response to the request to establish the application session. In some embodiments, the authentication result indication may be provided in response to a request for the authentication result of the wireless device from the AS (e.g., alone or as part of a request for the authentication result of a group of multiple wireless devices). For example, the AP may receive a request for the authentication result from the AS associated with the application session, and may provide the authentication result to the AS in response to the request for the authentication result. In at least some embodiments, the indication of the authentication result may include wireless device identification information and an indication of whether the wireless device is authenticated. The wireless device identification information may include a general public subscription identifier (GPSI), a subscription permanent identifier (SUPI), and / or other types of wireless device identification information.

[0109] According to at least some embodiments, the AP may store relationship mapping information between application servers and wireless devices authenticated to these application servers. For example, the AP may store information indicating an AS host name and a list of wireless devices authenticated for the AS host name for each of a plurality of ASs. Therefore, in such a scenario, when the AP provides an authentication result indication for a wireless device to the AS, the AP may store information indicating the authentication relationship accordingly.

[0110] As mentioned herein, it may be the case that the AP-wireless device interface may include the use of a TLS tunnel to ensure security and confidentiality. At least according to some embodiments, the AP-AS interface may also be protected for confidentiality and integrity. For example, the AP-AS interface for communication between the AP and the AS may include the use of one or more of Hypertext Transfer Protocol (HTTP), HTTP Secure (HTTPS), Internet Protocol Security (IPSec), or Internet Key Exchange Version 2 (IKEv2), and may support authentication between the AP and the AS (e.g., the AP may be able to authenticate the AS).

[0111] Thus, at least according to some embodiments, Figure 6 The method can be used to provide a framework according to which, at least in some cases, authentication proxy functionality can be used in conjunction with an application authentication and key management architecture in a cellular communication system. At least according to some embodiments, such a framework can be used to reduce consumption of authentication vectors, reduce the likelihood of sequence number synchronization failures, and / or relieve application servers of at least some security responsibilities, among other possible benefits.

[0112] Figures 7 to 14 and additional information

[0113] Figures 7 to 14 This example shows that if necessary, you can combine Figure 6 However, it should be noted that in Figures 7 to 14 The exemplary details illustrated in and described with respect to these figures are not intended to limit the disclosure as a whole: many variations and alternatives to the details provided herein below are possible and should be considered within the scope of the disclosure.

[0114] Application Authentication and Key Management (AKMA) services may be features provided in at least some cellular communication systems. For example, such features may be provided in 3GPP Release 17, according to some embodiments. In such systems, an AKMA anchor function (AAnF) may be deployed as a standalone function. The deployment may be able to choose to co-locate the AAnF with an authentication server function (AUSF) or with a network exposure function (NEF), for example, depending on the deployment scenario of the network operator. Figures 7 and 8 Examples of such possible AKMA architecture schemes in reference point representations of internal application functions (AF) and external AF according to some embodiments are illustrated respectively. Fig. 9 An example basic network model scheme of AKMA according to various embodiments is illustrated. At least as one possibility, such an architecture may include a key hierarchy with the following keys: K AUSF , K AKMA , K AF In one set of embodiments, K AUSF May be generated by the AUSF as specified in clause 6 of 3GPP 33.501 v.17.5.0.

[0115] Figure 10 to Figure 11 is a signal flow diagram illustrating possible signaling that may be used for key generation and authentication using such an AKMA architecture in a cellular communication system. AKMA may be based on primary authentication, where the UE and AAnF share K AKMA and AKMA Key Identifier (A-KID). Fig.10 Illustrate a method for deriving K after primary authentication according to some embodiments AKMA The exemplary signaling scheme illustrated may include signaling between UE 1002, AMF 1004, AUSF 1006, unified data management (UDM) 1008, and AAnF 1010. As shown, in 1012, UE 1002 and AUSF 806 may perform primary authentication. In 1014, AUSF 1006 may transmit a UE authentication request to UDM 1008, and in 1016, UDM may transmit a UE authentication response back to AUSF 1006. In 1018 and 1022, UE 1002 and AUSF 1006 may each perform a primary authentication for UE according to K AUSF Generate KAKMA Similarly, in 1020 and 1024, the UE 1002 and the AUSF 1006 may each generate an A-KID for the UE, respectively. In 1026, the AUSF 1006 may transmit an AKMA anchor key register request to the AAnF 1010, and in 1028, the AAnF may transmit an AKMA anchor key register response back to the AUSF 1006.

[0116] Fig.11 The example illustrates the case where there is no NEF between AAnF and AF according to K according to some embodiments. AKMA Generate K AF The example signaling scheme illustrated may include signaling between UE 1102, AUSF 1104, AAnF 1106, and AF 1108. As shown in the figure, in 1110, in the example scenario illustrated, primary authentication and K are established for UE 1102. AKMA Maybe it will be a follow-up K AF In 1112, UE 1102 may transmit an application session establishment request to AF 1108. In 1114, AF 1108 may transmit an AKMA application key request to AAnF 1106. In 1116, AAnF 1106 may generate an AKMA application key based on K AKMA Export K AF In 1118, AAnF 1106 may transmit an AKMA application key response back to AF 1108. In 1120, AF 1108 may transmit an application session establishment response back to UE 1102. Note that in such a scenario, the UE may derive the K before or after transmitting the application session establishment request message. AF .

[0117] In Generic Bootstrapping Architecture (GBA), an Authentication Proxy (AP) may be an HTTP proxy that plays the role of a Network Application Function (NAF) of a UE, such as further described in 3GPP TS 33.222 v.17.1.0. The AP may handle the TLS security relationship with the UE and relieve the Application Server (AS) of this task. Based on GBA, the AP may be able to assure the AS that the request is from an authorized user of a Mobile Network Operator (MNO). Fig.12 One possible architectural view of an AP and its environment and reference points is illustrated. Fig.13One possible high-level reference model of a NAF using bootstrapping services (e.g., implementing AP functionality) is illustrated. When an HTTPS request is sent to an AS behind an AP, the AP may terminate the TLS tunnel and perform UE authentication. The AP may proxy HTTP requests received from the UE to one or more application servers. When the AP forwards the request from the UE to the AS, the AP may add an assertion of the subscriber identity for use by the AS. As one possibility, the HTTP protocol may run over the AP-AS reference point. At least as one possibility, confidentiality and integrity protection may be provided for the reference point between the AP and the AS using the NDS / IP mechanism (e.g., in the manner described in 3GPP TS 33.210 v.17.0.0). At least as one possibility, the Ua reference point may operate in the manner described in 3GPP TS 33.220 [3] v.17.2.0.

[0118] In GBA, some possible benefits of using an AP may include reducing consumption of authentication vectors and / or minimizing sequence number (SQN) synchronization failures. Additionally, the AP may relieve the AS of at least some security tasks. Including AP functionality (e.g., as part of or in place of an application function (AF)) in an AKMA architecture (e.g., as one possibility for 3GPP Release 18 AKMA) may provide similar and / or other benefits, at least according to some embodiments. Fig.14 An example of one possible AKMA architecture that may include AP functionality is illustrated, where the AP in the AKMA system plays the role of an AF.

[0119] According to at least some embodiments, such an AP may be able to authenticate a UE via Ua* (e.g., as one possibility, in accordance with 3GPP TS 33.535 v.17.5.0), and typically have full AF functionality at AKMA. In addition to such AF functionality, the AP may also support other functionality, possibly including authenticating the UE against the AS and / or authenticating the AS against the UE. In some instances, the N62 reference point may be used for an interface with the AAnF, e.g., in accordance with 3GPP TS 33.535 v.17.5.0. The Ua* reference point may be used for an interface with the UE, e.g., in accordance with 3GPP TS 33.535 v.17.5.0. The AP-AS reference point may use HTTP or HTTPS, IPSec or IKEv2 (e.g., as described in 3GPP TS 33.220 v.17.2.0 (Network Domain Security: IP Network Layer Security)), among other possibilities. It may be the case that these interfaces are confidentiality protected, e.g., to protect authentication results transmitted over these interfaces.

[0120] As a proxy between the UE and the AS, the AP may perform AF functionality (e.g., as described in 3GPP TS 33.535v.17.5.0), and upon successful authentication, the AP may pass the authentication result for a specific UE ID to the AS. In order to provide such authentication proxy functionality, as a possible first step, the AS may request an authentication result for one or more specific UEs, and the AP may respond with the result. As another possibility, the AP may forward all authentication results based on the UE service request and information for the AS to the AS. The format may include UE ID information and an authentication result indication. The UE ID may include GPSI, SUPI, or other forms of UE identification. The AP may store a mapping relationship between the UE and the AS. As one possibility, the format may be as follows:

[0121] AS host name <-> list of authenticated UEs

[0122] The AP may be able to establish multiple TLS tunnels with the UE; for example, the AF function may run more than one AKMA process to derive more than one KAF (e.g., based on local policy). For example, for a group of ASs, the AP may perform an AKMA process and derive a "K AF1 ”, and for another set of ASs, the AP can run another round of AKMA process and derive “K AF2 ”.

[0123] Using the AP-AS interface, the AP may also be able to authenticate each associated AS. After performing the AKMA process (e.g., described in 3GPP TS 33.535v.17.5.0), the AP and the UE may authenticate each other. For example, when an application in the UE cannot or does not want to share the same TLS tunnel with the AS, the UE may be able to establish more than one TLS tunnel with the AP. As one possibility, the UE may be the entity that decides whether to use an independent tunnel or a shared tunnel. In such a scenario, it may be that the UE indicates its preference to the AP by including an indication of setting up a new TLS tunnel for the service in the request message when initiating AKMA (e.g., as described in clause 6.5 of 3GPP TS33.535v.17.5.0). Such UE preferences may be indicated in step 1 of clause 6.2 of 3GPP TS 33.535v.17.5.0 in addition or alternatively. As another possibility, the AP may be the entity that decides whether to use an independent tunnel or a shared tunnel. In such a scenario, the decision may be based on local policy. For example, as one possibility, the network might AF The number of ASs is limited so that when a service request increases the number of ASs beyond the limit, the AP may decide to establish a new AKMA connection with the UE.

[0124] In the following, further exemplary embodiments are provided.

[0125] A set of embodiments may include a method comprising: by an authentication agent in a cellular network: receiving a request to establish a first application session from a wireless device; performing authentication of the wireless device using an authentication anchor function (AAnF) associated with the cellular network to obtain an authentication result for the wireless device; and providing an indication of the authentication result to a first application server (AS) associated with the first application session.

[0126] According to some embodiments, the indication of the authentication result is provided to the first AS based at least in part on the request to establish the first application session.

[0127] According to some embodiments, the method further comprises: receiving a request for the authentication result from the first AS, wherein the indication of the authentication result is provided to the first AS based at least in part on the request for the authentication result from the first AS.

[0128] According to some embodiments, the indication of the authentication result includes wireless device identification information.

[0129] According to some embodiments, the wireless device identification information includes one or more of: a General Public Subscription Identifier (GPSI); or a Subscription Permanent Identifier (SUPI).

[0130] According to some embodiments, the method further comprises storing relationship mapping information between application servers and wireless devices authenticated to the application servers.

[0131] According to some embodiments, the method also includes: receiving an indication from the wireless device whether to request a new Transport Layer Security (TLS) tunnel for the first application session; if the indication from the wireless device requests a new TLS tunnel for the first application session, determining to establish a new TLS tunnel for the first application session; and if the indication from the wireless device does not request a new TLS tunnel for the first application session, determining to use an existing TLS tunnel for the first application session.

[0132] According to some embodiments, the request to establish the first application session includes an indication of whether to request a new TLS tunnel for the first application session.

[0133] According to some embodiments, the indication of whether to request a new TLS tunnel for the first application session is provided separately from the request to establish the first application session.

[0134] According to some embodiments, the method also includes: determining whether to establish a new Transport Layer Security (TLS) tunnel for the first application session based at least in part on the number of application sessions served by one or more existing TLS tunnels between the wireless device and the authentication agent, wherein if the existing TLS tunnels between the wireless device and the authentication agent serve less than a threshold number of application sessions, no new TLS tunnel is established for the first application session, and if each existing TLS tunnel between the wireless device and the authentication agent serves at least the threshold number of application sessions, a new TLS tunnel is established for the first application session.

[0135] According to some embodiments, the authentication agent-application server interface for communication between the authentication agent and the first AS includes using one or more of: Hypertext Transfer Protocol (HTTP); HTTP Secure (HTTPS); Internet Protocol Security (IPSec); or Internet Key Exchange Protocol Version 2 (IKEv2).

[0136] Another set of embodiments may include a network entity configured to implement authentication agent functionality in a cellular network, the network entity comprising: one or more processors; and a memory having instructions stored thereon that, when executed by the one or more processors, perform the steps of the method described in any of the preceding examples.

[0137] Another set of embodiments may include a method comprising: by a wireless device: establishing a wireless link with a cellular base station, wherein the cellular base station is associated with a cellular network; performing primary authentication using an authentication server function (AUSF) associated with the cellular network; determining whether to request a new transport layer security (TLS) tunnel for an application session; and providing an application session establishment request to an authentication agent associated with the cellular network to establish the application session, wherein the application session establishment request includes authentication information generated at least in part based on the primary authentication using the AUSF.

[0138] According to some embodiments, the method further includes providing an indication to the authentication agent as to whether to request a new TLS tunnel for the application session.

[0139] According to some embodiments, whether to request a new TLS tunnel for the application session is determined at least in part based on whether an existing TLS tunnel between the wireless device and the authentication agent has been established, wherein if the existing TLS tunnel between the wireless device and the authentication agent has been established, the new TLS tunnel is not requested, and if the existing TLS tunnel between the wireless device and the authentication agent has not been established, the new TLS tunnel is requested.

[0140] According to some embodiments, whether to request a new TLS tunnel for the application session is determined based at least in part on the number of application sessions served by one or more existing TLS tunnels between the wireless device and the authentication agent, wherein if the existing TLS tunnels between the wireless device and the authentication agent serve less than a threshold number of application sessions, then no new TLS tunnel is requested, and if each existing TLS tunnel between the wireless device and the authentication agent serves at least the threshold number of application sessions, then a new TLS tunnel is requested.

[0141] According to some embodiments, whether to request a new TLS tunnel for the application session is determined based at least in part on one or more of: a service associated with the application session; or access stratum (AS) layer application session establishment preference information.

[0142] According to some embodiments, the application session establishment request includes an indication of whether to request a new TLS tunnel for the application session.

[0143] According to some embodiments, the indication of whether to request a new TLS tunnel for the application session is provided separately from the application session establishment request.

[0144] Another set of embodiments may include a wireless device comprising: one or more processors; and a memory having instructions stored thereon that, when executed by the one or more processors, perform the steps of the method described in any of the foregoing examples.

[0145] Another set of embodiments may include a computer program product comprising computer instructions that, when executed by one or more processors, perform the steps of the method according to any of the preceding examples.

[0146] Yet another example embodiment may include a method comprising: performing, by a wireless device, any or all of the foregoing examples.

[0147] Another exemplary embodiment may include a device comprising: an antenna; a radio component coupled to the antenna; and a processing element operably coupled to the radio component, wherein the device is configured to implement any or all portions of the foregoing examples.

[0148] Another exemplary set of embodiments may include a non-transitory computer-accessible storage medium including program instructions that, when executed at a device, cause the device to implement any or all portions of any of the foregoing examples.

[0149] Another exemplary set of embodiments may include a computer program comprising instructions for performing any or all portions of any of the foregoing examples.

[0150] Another exemplary set of embodiments may include an apparatus including means for performing any or all of the elements of any of the preceding examples.

[0151] Another exemplary set of embodiments may include an apparatus comprising a processing element configured to cause a wireless device to perform any or all elements of any of the foregoing examples.

[0152] It is understood that the use of personally identifiable information should be subject to privacy policies and practices that are generally recognized to meet or exceed industry or government requirements for maintaining user privacy. Specifically, personally identifiable information data should be managed and processed to minimize the risk of unintentional or unauthorized access or use, and the nature of the authorized use should be clearly stated to users.

[0153] By interpreting each message / signal X received by a user equipment (UE) in the downlink as a message / signal X sent by the base station, and interpreting each message / signal Y sent by the UE in the uplink as a message / signal Y received by the base station, any of the methods for operating a UE described herein may become the basis for the corresponding method for operating a base station.

[0154] The embodiments of the present disclosure may be implemented in any of a variety of forms. For example, in some embodiments, the subject matter may be implemented as a computer-implemented method, a computer-readable storage medium, or a computer system. In other embodiments, one or more custom-designed hardware devices such as ASICs may be used to implement the subject matter. In other embodiments, one or more programmable hardware elements such as FPGAs may be used to implement the subject matter.

[0155] In some embodiments, a non-transitory computer-readable storage medium (e.g., a non-transitory storage element) may be configured to store program instructions and / or data, wherein if the program instructions are executed by a computer system, the computer system is caused to perform a method, such as any method implementation of the method embodiments described herein, or any combination of the method implementations described herein, or any subset of any method implementation of the method embodiments described herein, or any combination of such subsets.

[0156] In some embodiments, a device (e.g., a UE) may be configured to include a processor (or a group of processors) and a memory medium (or a memory element), wherein the memory medium stores program instructions, wherein the processor is configured to read and execute these program instructions from the memory medium, wherein these program instructions are executable to implement any method implementation in the various method implementations described herein (or any combination of the method implementations described herein, or any subset of any method implementation in the method implementations described herein, or any combination of such subsets). The device may be implemented in any of various forms.

[0157] Although the above embodiments have been described in considerable detail, numerous variations and modifications will become apparent to those skilled in the art once the above disclosure is fully appreciated. It is intended that the following claims be interpreted to include all such variations and modifications.

Claims

1. A method, comprising: By the authentication proxy in the cellular network: receiving a request from a wireless device to establish a first application session; performing authentication of the wireless device using an authentication anchor function (AAnF) associated with the cellular network to obtain an authentication result for the wireless device; as well as An indication of the authentication result is provided to a first application server (AS) associated with the first application session.

2. The method according to claim 1, Wherein the indication of the authentication result is provided to the first AS based at least in part on the request to establish the first application session.

3. The method according to claim 1, wherein the method further comprises: receiving a request for the authentication result from the first AS, Wherein the indication of the authentication result is provided to the first AS based at least in part on the request for the authentication result from the first AS.

4. The method according to any one of the preceding claims, Wherein the indication of the authentication result includes wireless device identification information.

5. The method of claim 4, wherein the wireless device identification information comprises one or more of the following: General Public Subscription Identifier (GPSI); or Subscription Persistent Identifier (SUPI).

6. The method according to any one of the preceding claims, wherein the method further comprises: Relationship mapping information between application servers and wireless devices authenticated to the application servers is stored.

7. The method according to any one of the preceding claims, wherein the method further comprises: receiving an indication from the wireless device whether to request a new transport layer security (TLS) tunnel for the first application session; If the indication from the wireless device requests a new TLS tunnel for the first application session, determining to establish a new TLS tunnel for the first application session; as well as If the indication from the wireless device does not request a new TLS tunnel for the first application session, then a determination is made to use an existing TLS tunnel for the first application session.

8. The method according to claim 7, The request to establish the first application session includes the indication of whether to request a new TLS tunnel for the first application session.

9. The method according to claim 7, Wherein the indication of whether to request a new TLS tunnel for the first application session is provided separately from the request to establish the first application session.

10. The method according to any one of claims 1 to 6, wherein the method further comprises: determining whether to establish a new Transport Layer Security (TLS) tunnel for the first application session based at least in part on a number of application sessions serviced by one or more existing TLS tunnels between the wireless device and the authentication agent, wherein if an existing TLS tunnel between the wireless device and the authentication agent serves less than a threshold number of application sessions, then not establishing a new TLS tunnel for the first application session, Wherein if each existing TLS tunnel between the wireless device and the authentication agent serves at least the threshold number of application sessions, a new TLS tunnel is established for the first application session.

11. The method according to any one of the preceding claims, Wherein the authentication agent-application server interface for communication between the authentication agent and the first AS comprises using one or more of the following: Hypertext Transfer Protocol (HTTP); HTTP Secure (HTTPS); Internet Protocol Security (IPSec); or Internet Key Exchange version 2 (IKEv2).

12. A network entity configured to implement authentication proxy functionality in a cellular network, the network entity comprising: one or more processors; and A memory having stored thereon instructions which, when executed by the one or more processors, perform the steps of a method according to any one of the preceding claims.

13. A method comprising: By wireless device: establishing a wireless link with a cellular base station, wherein the cellular base station is associated with a cellular network; performing primary authentication using an authentication server function (AUSF) associated with the cellular network; determining whether to request a new Transport Layer Security (TLS) tunnel for the application session; as well as An application session establishment request is provided to an authentication agent associated with the cellular network to establish the application session, wherein the application session establishment request includes authentication information generated based at least in part on the primary authentication utilizing the AUSF.

14. The method according to claim 13, wherein the method further comprises: An indication is provided to the authentication agent whether to request a new TLS tunnel for the application session.

15. The method according to any one of claims 13 to 14, wherein determining whether to request a new TLS tunnel for the application session is based at least in part on whether an existing TLS tunnel between the wireless device and the authentication agent is already established, wherein if an existing TLS tunnel between the wireless device and the authentication agent is already established, not requesting a new TLS tunnel, Wherein if an existing TLS tunnel between the wireless device and the authentication agent has not been established, a new TLS tunnel is requested.

16. The method according to any one of claims 13 to 14, wherein determining whether to request a new TLS tunnel for the application session is based at least in part on a number of application sessions serviced by one or more existing TLS tunnels between the wireless device and the authentication agent, wherein if an existing TLS tunnel between the wireless device and the authentication agent serves less than a threshold number of application sessions, then a new TLS tunnel is not requested, Wherein if each existing TLS tunnel between the wireless device and the authentication agent serves at least the threshold number of application sessions, a new TLS tunnel is requested.

17. The method according to any one of claims 13 to 16, Wherein determining whether to request a new TLS tunnel for the application session is based at least in part on one or more of: a service associated with the application session; or The access stratum (AS) layer applies session establishment preference information.

18. The method according to any one of claims 13 to 17, The application session establishment request includes the indication of whether to request a new TLS tunnel for the application session.

19. The method according to any one of claims 13 to 18, The indication of whether to request a new TLS tunnel for the application session is provided separately from the application session establishment request.

20. A wireless device, comprising: one or more processors; and A memory having instructions stored thereon which, when executed by the one or more processors, perform the steps of the method according to any one of claims 13 to 19.

21. A computer program product comprising computer instructions which, when executed by one or more processors, perform the steps of the method according to any one of claims 1 to 11 or 13 to 19.

Images