Configuration of terminal devices in radio communication network

Abstract

The invention relates to a method for configuring a terminal (1) in a radio communication network (2), in which a network address of a configuration server (3) and password information for authenticating the configuration server (3) are provided to the terminal (1) by the radio communication network (2) when the terminal (1) is initially connected to the radio communication network (2). The invention also relates to an associated system comprising a terminal device (1), a radio network (2) and a configuration server (3).

Description

Technical Field

[0001] The invention relates to a method and a system for configuring a terminal device in a radio communication network, wherein specific data are exchanged when the terminal device initially connects to the radio communication network. Background Art

[0002] In the future, 5G-based mobile radio networks will also be used in industrial networks, such as in factories or in plant / campus networks. In order to support this new deployment scenario from a telecommunications perspective, dedicated security methods have been standardized. These security methods can be used as an alternative or supplement to solutions based on SIM cards (USIM / UICC).

[0003] However, for this purpose the required credentials must be set up (provisioned) on the mobile device (also called UE or industrial 5G device). Since different protocols and methods for "credential provisioning" are used in industrial environments, it does not make sense to standardize a single or dedicated provisioning method for industrial use cases.

[0004] 3GPP TS23.501, Section 5.30.2.10 Onboarding of UEs for SNPNs specifies network support for credential configuration. In this document, configuration is performed via the user plane. Different ways of enabling the UE to obtain the address of the configuration server PVS (pre-configured by the discovery process when establishing the PDP context) are described in this document.

[0005] It is also known to identify a public key by means of a so-called fingerprint value (public key fingerprint), as described, for example, at https: / / en.wikipedia.org / wiki / Public_key_fingerprint. In this document, a user can manually authenticate a communication partner by checking the public key fingerprint used by the user with an expected value, without requiring a digital certificate (for example according to X.509) for this purpose. This approach is supported, for example, by the protocol ssh (secure shell).

[0006] Also known as an extension of X.509 certificates is a SubjectKeyIdentifier (Subject Key Identifier, SKID, see also https: / / datatracker.ietf.org / doc / html / rfc5280#section-4.2.1.2). The SubjectKeyIdentifier contains a hash of the public key, so that the value does not change when the certificate is renewed for the same key pair.

[0007] Registration protocols such as EST (RFC 7030), CMP (RFC 4210), CMC (RFC 5272), SCEP (RFC 8894) are also known, which enable requesting fields (attributes) to be occupied by the requester in the authentication request. Certificate templates or individual fields (attributes) can be provided here.

[0008] Finally, it is also known from the CMP update draft (https: / / www.ietf.org / archive / id / draft-ietf-lamps-cmp-updates-13.html#name-new-section-531916-certific) to provide values ​​for pre-empting a certification request. In this case, it is possible to request values ​​for fields (attributes) that should be contained in the certification request (CertReqTemplateContent). Summary of the invention

[0009] The object of the present invention is to specify a solution which improves and simplifies the configuration of terminal devices in radio communication networks (also referred to as “radio networks” for short), in particular in mobile radio networks (e.g. 5G) used in the context of industrial applications, compared to the prior art.

[0010] The invention is characterized by the features of the independent claims. Advantageous developments and embodiments are the subject matter of the dependent claims. Further features, possible applications and advantages of the invention are apparent from the following description.

[0011] The basic problem of provisioning is that the configuration on the client (UE, terminal device) must also be set first. For example, in 3GPP, a solution is specified to make the address of the configuration server PVS known to the UE. However, the configuration process itself must also be protected here. For this purpose, it is known to use the user plane protection methods available in 5G. However, these methods do not protect the communication with the configuration server end-to-end, and the protection is under the control of the 5G network, but the PVS can also be managed and operated independently (for example at the workshop level).

[0012] Therefore, in one aspect of the present invention, it is proposed that when connecting to a radio communication network (for example, when registering / associating with a mobile phone network / WLAN network or when establishing a data transmission session / PDP context), in addition to providing the address of the configuration server, cryptographic information for authenticating the configuration server (for example, a public key or a SubjectKeyIdentifier (SKID) or a certificate of the configuration server, or a check value formed based on the certificate, in particular a cryptographic hash value) is provided to the client (here: terminal device).

[0013] This enables the end device to authenticate the configuration server without the need for matching verification credentials to be pre-existing on the end device. This is particularly advantageous when configuring in closed environments (e.g. in OT factory networks, corporate networks, non-public 5G networks or campus networks) because no public global PKI infrastructure (OT = Operational Technology) is used there.

[0014] The present invention claims a method for configuring a terminal device in a radio communication network, wherein the radio communication network provides the terminal device with a configuration message when the terminal device initially connects to the radio communication network.

[0015] - the network address of the configuration server, and

[0016] - Password information used to authenticate the configuration server.

[0017] "Initial connection" for example in 3GGP signals to a mobile device (=terminal device) that this is a bootstrap network access, "initial" does not necessarily mean "first time", but can also mean "first time".

[0018] The advantage of the present invention is that the configuration of (industrial) IoT devices / 5G devices can be better automated. The automated configuration can also be performed in different industrial environments where different configuration protocols are applied.

[0019] There is no need to adapt the OT security infrastructure specifically for 5G devices for automated configuration. Password-protected configuration is possible without the configuration server authenticating itself with digital certificates from the global public PKI infrastructure. This supports configuration in closed OT / enterprise networks in particular. Even self-signed certificates can be used to authenticate the configuration server.

[0020] In an extension of the method, the cryptographic information may include a public key of the configuration server, a subject key identifier (SKID) of the configuration server, a certificate of the configuration server or a check value formed from the certificate, in particular a cryptographic hash value.

[0021] In one development of the method, an identifier can be provided to the terminal via the radio communication network during the initial connection, wherein the identifier specifies which configuration protocol or which configuration method is to be used.

[0022] In addition, a security protocol identifier may be provided to the terminal device via the radio communication network at the time of initial connection, wherein the security protocol identifier indicates which security protocol or which security method the terminal device is to use to protect the configuration protocol. An identifier for indicating the configuration protocol or the configuration method and a security protocol identifier may be provided to the terminal device at the time of initial connection. The security protocol identifier may indicate the security protocol by which the terminal device authenticates the configuration server with the aid of the provided cryptographic information. In addition, a cryptographic algorithm identifier may be provided to the terminal device via the radio communication network at the time of initial connection, wherein the cryptographic algorithm identifier indicates which cryptographic algorithm the terminal device is to use when authenticating the configuration server with the aid of the cryptographic information provided by the radio communication network. In addition, the provision of the cryptographic information for authenticating the configuration server may be cryptographically protected by a user plane protection method of the radio communication network or an alternative control plane protection method.

[0023] In one development of the method, configuration parameters can be provided to the terminal via the radio communication network during the initial connection, wherein the configuration parameters specify how the terminal should adapt a configuration protocol or a configuration method to a predefined application context of the terminal.

[0024] In one development of the method, first information can be provided to the terminal via the radio communication network during the initial connection, wherein the first information specifies which authentication credentials or which authentication method the terminal is to use to authenticate itself to the configuration server.

[0025] In one development of the method, second information can be provided to the terminal via the radio communication network during the initial connection, wherein the second information specifies what is to be configured in the terminal.

[0026] In an extension of the method, third information can be provided to the terminal device via the radio communication network during the initial connection, wherein the third information describes how to perform multiple configuration processes. For example, the terminal device can be informed which credentials should be set and in what order these credentials should be set.

[0027] In one development of the method, the radio communications network may be a 5G network and the terminal device may initially connect to a node of the 5G network.

[0028] The present invention also claims a system for configuring a terminal device in a radio communication network, comprising at least one terminal device and a radio communication network, wherein the radio network is arranged to provide the terminal device with a

[0029] - the network address of the configuration server, and

[0030] - Password information used to authenticate the configuration server.

[0031] In an extension of the system, the cryptographic information may include a public key of the configuration server, a subject key identifier (SKID) of the configuration server, a certificate of the configuration server or a check value formed from the certificate, in particular a cryptographic hash value.

[0032] In a development of the system, the radio communication network can be configured to provide an identifier (=identifier) ​​to the terminal during the initial connection, wherein the identifier specifies which configuration protocol or which configuration method is to be used.

[0033] In a development of the system, the radio communication network can be configured to provide configuration parameters to the terminal upon initial connection, wherein the configuration parameters specify how the terminal should adapt a configuration protocol or a configuration method to a predefined application context of the terminal.

[0034] In a development of the system, the radio communication network can be configured to provide first information to the terminal device during an initial connection, wherein the first information specifies which authentication credentials or which authentication method the terminal device is to use to authenticate itself to the configuration server.

[0035] In a development of the system, the radio communication network can be configured to provide second information to the terminal during the initial connection, wherein the second information specifies what is to be configured in the terminal.

[0036] In a development of the system, the radio communication network can be configured to provide third information to the terminal during an initial connection, wherein the third information specifies how a plurality of configuration processes are to be carried out.

[0037] In an extension of the system, the radio communication network may be a 5G network, wherein the 5G network has a node and wherein the terminal device is arranged to initially connect to the node.

[0038] Further features and advantages of the invention emerge from the following explanation of an exemplary embodiment based on the schematic drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 shows a block diagram of the system,

[0040] Figure 2 A flowchart showing the method is shown, and

[0041] Figure 3 A flow chart of the modified method is shown. DETAILED DESCRIPTION

[0042] according to Figure 1 The block diagram in discloses that when initially connecting to a radio communication network 2 (for example, when registering / associating with a mobile radio network / WLAN network or when establishing a data transmission session / PDP context), in addition to providing the network address of a configuration server 3, cryptographic information for authenticating the configuration server 3 (for example, a public key or a subject key identifier (SubjectKeyIdentifier, SKID), a certificate of the configuration server 3 or a check value formed based on the certificate, in particular a cryptographic hash value) is provided to a terminal device 1 (for example, a mobile radio device).

[0043] This enables the terminal device 1 to authenticate the configuration server 3 without the need for matching verification credentials to pre-exist on the terminal device 1. This is particularly advantageous when configuring in a closed environment (such as an OT factory network, an enterprise network, a non-public 5G network, or a campus network) where no public global PKI infrastructure is used.

[0044] On the other hand, it is disclosed that an identifier (=identifier) ​​of a configuration protocol or configuration method is provided to the terminal device 1. This is advantageous because a variety of different configuration types can be applied, such as OPC UA, NETCONF, RESTCONF, CMP, SCEP, EST, BRSKI. Thus, the terminal device 1 or an industrial device connected to the terminal device 1 can automatically determine and execute the configuration type.

[0045] Here, the terminal device 1 can provide the obtained configuration information completely or partially to the connected industrial device. As a result, the connected industrial device can be configured via the terminal device 1. In a variant, when the network address of the configuration server 3 and the password information for authenticating the configuration server 3 are transmitted, it can be stated whether they are intended to be configured by the terminal device 1 or by the industrial device connected to the terminal device 1. The first address of the configuration server 3 and the first password information for authenticating the configuration server 3 can be provided to the terminal device, and the terminal device uses the first address and the first password information for configuration, and the second address of the second configuration server 3 and the second password information for authenticating the second configuration server 3 are provided to the terminal device, and the terminal device uses the second address and the second password information for the connected industrial device to be configured by the industrial device. This has the following advantages: both the terminal device 1 and the industrial device connected to the terminal device 1 are configured together and therefore configured consistently.

[0046] Additionally, configuration parameters may be transmitted to adapt the selected configuration type. Thus, for example for NETCONF or RESTCONF reference may be made to the YANG data model that should be used for configuration. This is advantageous because a large number of YANG models are defined in NETCONF / RESTCONF, which are partly standardized and partly manufacturer-specific. For certificate management protocols such as CMP, SCEP, EST, hints may be given about the certificate profile and / or the cryptographic algorithms / cipher suites to be used for the certificates (e.g. whether to use RSA or EGG, key length).

[0047] This enables the terminal device to automatically adapt to the configuration variant used specifically in a specific application context. The transmission of certificate profiles in the enrollment protocol is known (e.g. in the case of EST and CMP), but it presupposes that the terminal device 1 is configured accordingly in advance or obtains these values ​​in the context of the enrollment protocol (CMP).

[0048] This enables the terminal device 1 to directly transmit in the registration / configuration protocol a certificate profile including predefined values ​​suitable for the specific environment in which the registration / configuration is to be carried out. To this end, information about the certificate profile to be used (including the expected values) is signaled to the terminal device via the radio network. This has the advantage that corresponding information does not have to be preconfigured on the terminal device 1 or additional data exchanges have to be performed in order to be able to perform the registration / configuration for the target environment.

[0049] Furthermore, it is disclosed that first information about the authentication credentials or authentication method or the cryptographic algorithm to be used for authentication to the configuration server 3 is provided to the terminal device 1. It is advantageous if multiple authentication credentials or authentication methods can be used on the terminal device 1.

[0050] Furthermore, second information about what exactly should be configured (eg, credentials for primary authentication, credentials for secondary authentication, credentials for slice access authentication, or network access configuration) may be provided to the terminal device 1 .

[0051] Furthermore, third information about the plurality of configuration processes to be performed can be transmitted to the terminal device 1. In particular, information about which credentials should be set and in what order they should be set can be transmitted to the terminal device 1. It can also be transmitted whether there are dependencies in the application (e.g. registration of a generic certificate which is then used to apply for further certificates).

[0052] The information provided to the terminal device 1 can, for example, be stored in a node 2 of the 5G core, such as in UDM (Unified Date Management) or AUSF (Authentication Server Function) or in an authentication server (AAA server, Default Credential Server, DCS) connected to the 5G core.

[0053] Furthermore, it is possible that information in the 5G core can be set via a network-exposed interface of the 5G core. This has the advantage that the OT operator can simply store corresponding information in the 5G core about how the terminal device 1 should be configured via the 5G network.

[0054] Any digital certificate can be used to authenticate the configuration server 3, and the terminal device 1 does not have to be able to verify this in advance. Thus, for example, a self-signed certificate or a certificate issued by a local PKI infrastructure can also be used to authenticate the configuration server 3. It is also possible to issue a certificate that is only valid for a short time or a certificate that is only valid for a single configuration process to authenticate the configuration server 3. A dedicated configuration server certificate can be issued for a single terminal device 1 or a group of terminal devices 1 and set on the configuration server 3. In this way, the configuration server 3 that is designated to configure a single specific terminal device 1 in a specific terminal device group can be easily authenticated.

[0055] Figure 2 An embodiment of the method is shown based on a flow chart. Here, when establishing a PDP context for onboarding, in addition to the address of the configuration server 3 (as known in the prior art), a (cryptographic) hash value of the configuration server certificate (PVS Cert Hash) is additionally transmitted to the terminal 1. In addition, a first identifier PVP-Id is transmitted to the terminal 1 that specifies the configuration protocol to be used.

[0056] The terminal device 1 checks the authenticity of the TLS client certificate from the configuration server 3 provided by the configuration server 3 within the scope of the TLS handshake, i.e. used by it for authentication, and the PVS Cert hash value provided when establishing the PDP context. If there is no consistency, the configuration process is terminated by the device, i.e. the connection with the configuration server 3 is terminated.

[0057] In addition, the terminal device 1 uses the provided PVP-Id to select one of the multiple configuration protocols or configuration methods it supports. Figure 2In the embodiment of NETCONF, the configuration server PVS establishes a connection with the device. The terminal 1 can verify based on the transmitted PVS Cert hash that only the permitted, configured configuration server 3 can actually establish a TLS connection with the terminal 1 or with the terminal management function of the terminal 1.

[0058] Figure 3 A flow chart of another embodiment is shown, where EST (enrollment over secure transport) is used here. The terminal device 1 is signaled via PVP-Id that EST should be used to set the client certificate. The terminal device establishes a TLS connection with the illustrated configuration server 3 and authenticates the configuration server 3 by checking whether the TLS server certificate used by the configuration server 3 matches the (cryptographic) hash value of the signaled configuration server certificate (PVS Cert hash). Further details can be found in Figure 3 can be found in the flowchart.

[0059] Although the present invention has been illustrated and described in detail by way of embodiments, the present invention is not limited to the disclosed examples and other variations may be derived therefrom by those skilled in the art without departing from the scope of protection of the present invention.

Claims

1. A method for configuring a terminal device (1) in a radio communication network (2), wherein when the terminal device (1) is initially connected to the radio communication network (2), the radio communication network (2) provides the terminal device (1) with a - the network address of the configuration server (3), and - Password information used to authenticate the configuration server (3).

2. The method according to claim 1, wherein the cryptographic information comprises a public key of the configuration server, a subject key identifier (SKID) of the configuration server (3), a certificate of the configuration server, or a check value formed based on the certificate, in particular a cryptographic hash value.

3. The method according to claim 1 or 2, wherein an identifier is provided to the terminal device (1) via the radio communication network (2) during the initial connection, wherein the identifier indicates which configuration protocol or which configuration method is to be used.

4. The method according to claim 3, wherein configuration parameters are provided to the terminal device (1) via the radio communication network (2) during the initial connection, wherein the configuration parameters indicate how the terminal device (1) should adapt the configuration protocol or the configuration method to a predetermined application context of the terminal device (1).

5. A method according to any one of the preceding claims, wherein first information is provided to the terminal device (1) via the radio communication network (2) during the initial connection, wherein the first information indicates which authentication credential or which authentication method the terminal device (1) is to use to authenticate to the configuration server (3).

6. The method according to any of the preceding claims, wherein second information is provided to the terminal device (1) via the radio communication network (2) during the initial connection, wherein the second information specifies what should be configured in the terminal device.

7. The method according to any of the preceding claims, wherein third information is provided to the terminal device (1) via the radio communication network (2) during the initial connection, wherein the third information specifies how a plurality of configuration processes are to be performed.

8. The method according to any of the preceding claims, wherein the radio communications network (2) is a 5G network and the terminal device (1) is initially connected to a node (2.1) of the 5G network.

9. A system for configuring a terminal device (1) in a radio communication network (2), comprising the radio communication network (2) and at least one terminal device (1), The radio communication network (2) is configured to provide the terminal device (1) with a - the network address of the configuration server (3), and - Password information used to authenticate the configuration server (3).

10. The system according to claim 9, wherein the cryptographic information comprises a public key of the configuration server (3), a subject key identifier (SKID) of the configuration server, a certificate of the configuration server (3), or a check value formed based on the certificate, in particular a cryptographic hash value.

11. The system according to claim 9 or 10, wherein the radio communication network (2) is arranged to provide an identifier to the terminal device (1) during the initial connection, wherein the identifier indicates which configuration protocol or which configuration method is to be used.

12. A system according to claim 11, wherein the radio communication network (2) is configured to provide configuration parameters to the terminal device (1) during the initial connection, wherein the configuration parameters indicate how the terminal device (1) should adapt the configuration protocol or the configuration method to a predetermined application context of the terminal device (1).

13. A system according to any one of claims 9 to 12, wherein the radio communication network (2) is configured to provide first information to the terminal device (1) during the initial connection, wherein the first information indicates which authentication credential or authentication method the terminal device (1) is to use to authenticate the configuration server (3).

14. The system according to any one of claims 9 to 13, wherein the radio communication network (2) is arranged to provide second information to the terminal device (1) upon the initial connection, wherein the second information indicates what should be configured in the terminal device (1).

15. The system according to any one of claims 9 to 14, wherein the radio communication network (2) is arranged to provide third information to the terminal device (1) upon the initial connection, wherein the third information describes how to perform a plurality of configuration processes.

16. A system according to any one of claims 9 to 15, wherein the radio communication network (2) is a 5G network, wherein the SG network has a node (2.1), and wherein the terminal device (1) is arranged to initially connect to the node (2.1).

Images