Authentication in access network sharing environment

Abstract

The embodiment of the invention relates to authentication in an access network sharing environment. Techniques for user equipment authentication in a shared access network environment are disclosed. In one example, a method includes establishing, via a first access management entity in a first communication network having a radio access network associated therewith, a secure connection with a second access management entity in a second communication network subscribed by a user equipment, and facilitating authentication of the user equipment via the first access management entity in conjunction with the second access management entity over the secure connection to enable the user equipment to access the second communication network using a radio access network of the first communication network.

Description

Technical Field

[0001] The field relates generally to communication networks and, more particularly, but not exclusively, to security management in such communication networks. Background Art

[0002] This section introduces aspects that may help to better understand the present invention. Therefore, the statements in this section should be read from this perspective and should not be understood as an admission of what is or is not prior art.

[0003] The fourth generation (4G) of wireless mobile telecommunication technology, also known as Long Term Evolution (LTE) technology, is designed to provide high capacity mobile multimedia with high data rates, particularly for human-machine interaction. The next or fifth generation (5G) technology is intended not only for human-machine interaction, but also for machine-type communications in so-called Internet of Things (IoT) networks.

[0004] While 5G networks are designed to enable massive IoT services (e.g., very large numbers of limited-capacity devices) and mission-critical IoT services (e.g., requiring high reliability), improvements to traditional mobile communication services are supported in the form of enhanced mobile broadband (eMBB) services that provide improved wireless Internet access to mobile devices.

[0005] In an example communication system, a user equipment (5G UE in a 5G network, or more broadly, UE) such as a mobile terminal (subscriber) communicates over an air interface with a base station or access point of an access network, referred to as a 5G AN, in the 5G network. An access point (e.g., gNB) is illustratively part of the access network of the communication system.

[0006] For example, in a 5G network, an access network referred to as a 5G AN is described in 5G Technical Specification (TS) 23.501 entitled "Technical Specification Group Services and System Aspects; System Architecture for 5G Systems" and TS 23.502 entitled "Technical Specification Group Services and System Aspects; Procedures for 5G Systems (5GS)", the disclosures of which are incorporated herein by reference in their entirety. Typically, an access point (e.g., a gNB) provides a UE with access to a core network (CN or 5GC), which then provides the UE with access to other UEs and / or data networks such as packet data networks (e.g., the Internet).

[0007] TS23.501 goes on to define a 5G service-based architecture (SBA), which models services as network functions (NFs) that communicate with each other using representational state transfer application programming interfaces (Restful APIs).

[0008] In addition, 5G Technical Specification (TS) 33.501, entitled "Technical Specification Group Services and System Aspects; Security Architecture and Procedures for 5G Systems," further describes security management details associated with 5G networks, the disclosure of which is incorporated herein by reference in its entirety.

[0009] Security management is an important consideration in any communication system. However, as attempts continue to improve the architecture and protocols associated with 5G networks in order to increase network efficiency and / or subscriber convenience, security management issues associated with user equipment may present significant challenges. For example, implementing security protocols in an access network sharing environment is a technical challenge. Summary of the invention

[0010] The illustrative embodiments provide techniques for user device authentication in an access network sharing environment.

[0011] In one illustrative embodiment, a method includes establishing, via a first access management entity in a first communication network having a radio access network associated therewith, a secure connection with a second access management entity in a second communication network to which a user equipment subscribes, and facilitating, via the first access management entity through the secure connection, authentication of the user equipment in conjunction with the second access management entity to enable the user equipment to access the second communication network using the radio access network of the first communication network.

[0012] In another illustrative embodiment, a method includes establishing, via a first access management entity in a first communication network to which a user device is subscribed, a secure connection with a second access management entity in a second communication network, wherein the second communication network has a radio access network associated therewith, and facilitating, via the first access management entity, authentication of the user device in conjunction with the second access management entity over the secure connection to enable the user device to access the first communication network using the radio access network associated with the second communication network.

[0013] Additional illustrative embodiments are provided in the form of a non-transitory computer-readable storage medium having an executable program code embodied therein, which, when executed by a processor, causes the processor to perform the above steps. Other additional illustrative embodiments include an apparatus having a processor and a memory, which is configured to perform the above steps.

[0014] Advantageously, the illustrative embodiments provide a user equipment authentication process in an access network sharing environment with an indirect connection between a core network of a participating operator and a shared access network operated by another participating operator.

[0015] These and other features and advantages of the embodiments described herein will become more apparent from the accompanying drawings and the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A communication system is shown with which one or more illustrative embodiments may be implemented.

[0017] Figure 2 User equipment and entities are shown with which one or more illustrative embodiments may be implemented.

[0018] Figure 3 A shared access network environment is shown in which one or more illustrative embodiments may be implemented.

[0019] Figure 4 An architecture for access network sharing with indirect connections is shown in accordance with an illustrative embodiment.

[0020] Figure 5A A protocol stack configuration for access network sharing with indirect connections is shown in accordance with an illustrative embodiment.

[0021] Figure 5B A protocol stack configuration for access network sharing with indirect connections is shown according to another illustrative embodiment.

[0022] Fig. 6A A process for access network sharing with indirect connections is shown in accordance with an illustrative embodiment.

[0023] Figure 6B A process for access network sharing with indirect connections is shown in accordance with another illustrative embodiment. DETAILED DESCRIPTION

[0024] Embodiments will be described herein in conjunction with example communication systems and associated techniques for security management in communication systems. However, it should be understood that the scope of the claims is not limited to the specific type of communication system and / or process disclosed. Embodiments may be implemented in various other types of communication systems using alternative processes and operations. For example, although described in the context of a wireless cellular system utilizing a third generation partnership project (3GPP) system element such as a 3GPP next generation system (5G), the disclosed embodiments may be adapted in a simple manner to various other types of communication systems, such as a 6G communication system.

[0025] According to an illustrative embodiment implemented in a 5G communication system environment, one or more 3GPP Technical Specifications (TS) and Technical Reports (TR) may provide further explanation of network elements / functions and / or operations that may interact with parts of the present invention solution, such as 3GPP TS23.501, TS23.502 and TS 33.501 referenced above.

[0026] Other 3GPP TS / TR documents may provide additional details that a person of ordinary skill in the art will appreciate, for example, TS 22.261 entitled "3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Service Requirements for 5G Systems; Phase 1" and TR 22.851 entitled "3rd Generation Partnership Project; Technical Specification Group TSG SA; Feasibility Study on Network Sharing Aspects", the disclosures of which are incorporated herein by reference in their entirety.

[0027] Note that 3GPP TS / TR documents are non-limiting examples of communication network standards (e.g., specifications, procedures, reports, requirements, recommendations, etc.) However, while well suited to 5G-related 3GPP standards, embodiments are not necessarily intended to be limited to any particular standard.

[0028] It should be understood that in some illustrative embodiments, the terms 5G network, etc. (e.g., 5G system, 5G communication system, 5G environment, 5G communication environment, etc.) may be understood to include all or part of the access network and all or part of the core network. However, the terms 5G network, etc. may occasionally be used interchangeably with the terms 5GC network, etc. herein without loss of generality, as those of ordinary skill in the art understand any distinction.

[0029] Before describing an illustrative embodiment focusing on an access network sharing environment, in which multiple core networks (operators) share one or more access networks, the following will be described in detail. Figure 1 A general description of some of the main components of a typical 5G network is described in the context of .

[0030] Figure 1 A communication system 100 is shown within which an illustrative embodiment is implemented. It should be understood that the elements shown in the communication system 100 are intended to represent some of the main functions provided within the system, such as control plane functions, user plane functions, etc. Figure 1 The blocks shown in refer to specific elements in a 5G network that provide some of these primary functions. However, other network elements may be used to implement some or all of the primary functions represented. Furthermore, it should be understood that in Figure 1 Not all functions of a 5G network are depicted in the figures. Rather, at least some functions that facilitate explanation of the illustrative embodiments are depicted. Subsequent figures may depict some additional elements / functions (i.e., network entities).

[0031] Thus, as shown, the communication system 100 includes a user equipment (UE) 102 that communicates with an access point 104 via an air interface 103. It should be understood that the UE 102 can use one or more other types of access points (e.g., access functions, networks, etc.) to communicate with a 5GC network other than a gNB. By way of example only, the access point 104 can be any 5G access network (gNB), an untrusted non-3GPP access network using a non-3GPP interworking function (N3IWF), a trusted non-3GPP network using a trusted non-3GPP gateway function (TNGF), or a wired access using a wired access gateway function (W-AGF), or can correspond to a traditional access point (e.g., an eNB). In addition, the access point 104 can be a wireless local area network (WLAN) access point, as will be further explained in the illustrative embodiments described herein.

[0032] UE 102 may be a mobile station, and such a mobile station may include, for example, a mobile phone, a computer, an IoT device, or any other type of communication device. Thus, the term "user equipment" as used herein is intended to be interpreted broadly, thereby covering various different types of mobile stations, subscriber stations, or more generally, communication devices, including examples of combinations of data cards inserted into laptops or other devices such as smart phones. Such communication devices are also intended to cover devices commonly referred to as access terminals.

[0033] In one illustrative embodiment, the UE 102 consists of a Universal Integrated Circuit Card (UICC) portion and a Mobile Equipment (ME) portion. The UICC is the user-related portion of the UE and contains at least one Universal Subscriber Identity Module (USIM) and appropriate application software. The USIM securely stores a permanent subscription identifier and its associated keys, which are used to uniquely identify and authenticate the subscriber to access the network. The ME is the user-independent portion of the UE and contains the Terminal Equipment (TE) functionality and various Mobile Terminal (MT) functionality. Alternative illustrative embodiments may not use UICC-based authentication, such as non-public (private) networks (NPNs).

[0034] Note that in one example, the permanent subscription identifier is the UE's unique International Mobile Subscriber Identity (IMSI). In one embodiment, the IMSI is a fixed 15-digit length and consists of a 3-digit Mobile Country Code (MCC), a 3-digit Mobile Network Code (MNC), and a 9-digit Mobile Station Identification Number (MSIN). In 5G communication systems, the IMSI is called a Subscription Permanent Identifier (SUPI). In the case where the IMSI is used as the SUPI, the MSIN provides a subscriber identity. Therefore, it is usually only necessary to encrypt the MSIN part of the IMSI. The MNC and MCC parts of the IMSI provide routing information, which is used by the service network to route to the correct home network. When the MSIN of the SUPI is encrypted, it is called a Subscription Hidden Identifier (SUCI). Another example of SUPI uses a Network Access Identifier (NAI). NAI is commonly used for IoT communications.

[0035] Access point 104 is illustratively part of a radio access network or RAN of communication system 100. Such a radio access network may include, for example, a 5G system having multiple base stations. Components of a radio access network may be more generally viewed as "radio access entities."

[0036] In addition, the access point 104 in the present illustrative embodiment is operably coupled to an access and mobility management function (AMF / SEAF) 106. In a 5G network, the AMF / SEAF supports, among other things, mobility management (MM) and security anchor (SEAF) functions.

[0037] The AMF / SEAF 106 in this illustrative embodiment is operably coupled to other network functions 108 (e.g., using their services). As shown, some of these other network functions 108 include, but are not limited to, authentication server functions (AUSF) and unified data management (UDM) functions. These listed network function examples are typically implemented in the home network of the UE subscriber, which will be further explained below. Note that in a 5GC network, the 4G functionality of the HSS (Home Subscriber Server) is split into AUSF, UDM, and Unified Data Repository (UDR, not explicitly shown) functions. Typically, the AUSF authenticates the UE and provides any required encryption keys, while the UDR stores user data and the UDM manages user data.

[0038] Other network functions 108 may include network functions that may act as service producers (NFp) and / or service consumers (NFc). Note that any network function may be a service producer for one service and a service consumer for another service. Furthermore, when the provided service includes data, the NFp that provides the data is referred to as a data producer, and the NFc that requests the data is referred to as a data consumer. A data producer may also be a NF that generates data by modifying or otherwise processing data generated by another NF. Note that a NF may be more generally viewed as a "network entity".

[0039] Note that a UE such as UE 102 is typically subscribed to a so-called home public land mobile network (HPLMN) in which some or all of the functions 106 and 108 reside. Alternatively, a UE such as UE 102 may receive services from an NPN in which these functions may reside. The HPLMN is also referred to as a home environment (HE) or a home network (HN). If the UE is roaming (not in the HPLMN), it is typically connected to a visited public land mobile network (VPLMN) (also referred to as a visited network), while the network currently serving the UE is also referred to as a serving network. In a roaming situation, some of the network functions 106 and 108 may reside in the VPLMN, in which case the functions in the VPLMN communicate with the functions in the HPLMN as needed. However, in a non-roaming scenario, the mobility management function 106 and other network functions 108 reside in the same communication network (i.e., the HPLMN). Unless otherwise specified, the embodiments described herein are not necessarily limited to which functions reside in which PLMN (i.e., the HPLMN or the VPLMN).

[0040] Access point 104 is also operatively coupled (via one or more of functions 106 and / or 108) to a session management function (SMF) 110, which is operatively coupled to a user plane function (UPF) 112. UPF 112 is operatively coupled to a packet data network, such as the Internet 114. Note that the thicker solid lines in the figure represent the user plane (UP) of the communication network, as compared to the thinner solid lines representing the control plane (CP) of the communication network. It should be appreciated that Figure 1 The network (e.g., the Internet) 114 in the example may additionally or alternatively represent other network infrastructures, including, but not limited to, cloud computing infrastructures and / or edge computing infrastructures. Other typical operations and functions of such network elements are not described here, as they are not the focus of the illustrative embodiments and can be found in appropriate 3GPP 5G documents. Note that the functions shown in 106, 108, 110, and 112 are examples of network functions (NFs).

[0041] It should be appreciated that this particular arrangement of system elements is merely an example, and in other embodiments, additional or alternative elements of other types and arrangements may be used to implement the communication system. For example, in other embodiments, the communication system 100 may include other elements / functions not explicitly shown herein.

[0042] therefore, Figure 1 The arrangement of is only one example configuration of a wireless cellular system, and many alternative configurations of system elements may be used. For example, although in Figure 1 Only a single element / function is shown in the embodiments, but this is only for simplicity and clarity of description. A given alternative embodiment may of course include a greater number of such system elements, as well as additional or alternative elements of the type normally associated with conventional system implementations.

[0043] It should also be noted that although Figure 1 The system elements are illustrated as single functional blocks, but the various subnetworks that make up the 5G network are divided into so-called network slices. A network slice (network partition) is a logical network that provides specific network functions and network characteristics, which can support corresponding service types, optionally using network function virtualization (NFV) on a common physical infrastructure. Using NFV, network slices can be instantiated according to the needs of a given service (such as eMBB services, large-scale IoT services, and mission-critical IoT services). Therefore, when an instance of this network slice or function is created, the network slice or function is instantiated. In some embodiments, this involves installing or otherwise running the network slice or function on one or more host devices of the underlying physical infrastructure. UE 102 is configured to access one or more of these services via access point 104.

[0044] Figure 2 2 is a block diagram illustrating the computing architecture of various participants in the method according to the illustrative embodiment. More specifically, a system 200 is shown, which includes a user equipment (UE) 202 and a plurality of entities 204-1, ..., 204-N. For example, in the illustrative embodiment and with reference back to Figure 1 , UE 202 may represent UE 102, and entities 204-1, ..., 204-N may represent functions 106 and 108 (i.e., network entities), and access point 104 (i.e., radio access entity). It should be appreciated that UE 202 and entities 204-1, ..., 204-N are configured to interact to provide security management and other techniques described herein.

[0045] The user device 202 includes a processor 212 coupled to a memory 216 and an interface circuit 210. The processor 212 of the user device 202 includes a security management processing module 214, which can be implemented at least in part in the form of software executed by the processor. The security management processing module 214 performs security management described in conjunction with subsequent figures and otherwise herein. The memory 216 of the user device 202 includes a security management storage module 218, which stores data generated or otherwise used during security management operations.

[0046] Each entity (individually or collectively referred to herein as 204) includes a processor 222 (222-1, ..., 222-N) that is coupled to a memory 226 (226-1, ..., 226-N) and an interface circuit 220 (220-1, ..., 220-N). Each processor 222 of each entity 204 includes a security management processing module 224 (224-1, ..., 224-N), which may be implemented at least in part in the form of software executed by the processor 222. The security management processing module 224 performs security management operations described in conjunction with subsequent figures and otherwise herein. Each memory 226 of each entity 204 includes a security management storage module 228 (228-1, ..., 228-N) that stores data generated or otherwise used during security management operations.

[0047] Processors 212 and 222 may include, for example, a microprocessor such as a central processing unit (CPU), an application specific integrated circuit (ASIC), a digital signal processor (DSP), or other types of processing devices, as well as portions or combinations of these elements.

[0048] The memories 216 and 226 may be used to store one or more software programs that are executed by the respective processors 212 and 222 to implement at least a portion of the functionality described herein. For example, security management operations and other functionality as described in connection with subsequent figures and otherwise herein may be implemented in a simple manner using software code executed by the processors 212 and 222.

[0049] Thus, a given one of memories 216 and 226 may be considered to be an example of what is more generally referred to herein as a computer program product, or more generally as an example of a processor-readable storage medium having executable program code embodied therein. Other examples of processor-readable storage media may include disks or other types of magnetic or optical media in any combination. Illustrative embodiments may include an article of manufacture that includes such a computer program product or other processor-readable storage medium.

[0050] Furthermore, memories 216 and 226 may more specifically include, for example, electronic random access memories (RAMs), such as static RAMs (SRAMs), dynamic RAMs (DRAMs), or other types of volatile or non-volatile electronic memories. The latter may include, for example, non-volatile memories, such as flash memories, magnetic RAMs (MRAMs), phase change RAMs (PC-RAMs), or ferroelectric RAMs (FRAMs). The term "memory" as used herein is intended to be interpreted broadly and may additionally or alternatively encompass, for example, read-only memories (ROMs), disk-based memories, or other types of storage devices, as well as portions or combinations of such devices.

[0051] Interface circuits 210 and 220 illustratively include transceivers or other communications hardware or firmware that allow associated system elements to communicate with each other in the manner described herein.

[0052] from Figure 2 As is apparent from the diagram, the user device 202 and the plurality of entities 204 are configured to communicate with each other as security management participants via their respective interface circuits 210 and 220. The communication involves each participant sending data to and / or receiving data from one or more other participants. The term "data" as used herein is intended to be interpreted broadly to cover any type of information that may be sent between participants, including but not limited to identification data, key pairs, key indicators, tokens, secrets, security management messages, registration request / response messages and data, request / response messages, authentication request / response messages and data, metadata, control data, audio, video, multimedia, consent data, other messages, and the like.

[0053] It should be recognized that Figure 2 The specific arrangement of components shown in the is only an example, and multiple alternative configurations may be used in other embodiments. For example, any given network element / function and / or access point may be configured to incorporate additional or alternative components and support other communication protocols.

[0054] Other system elements such as access point 104, SMF 110, and UPF 112 may each be configured to include components such as processors, memory, and network interfaces. These elements need not be implemented on separate independent processing platforms, but may instead represent different functional parts of a single common processing platform, for example.

[0055] More generally, Figure 2 It can be regarded as representing processing devices that are configured to provide corresponding security management functions and are operably coupled to each other in a communication system.

[0056] As mentioned above, 3GPP TS23.501 defines the 5GC network architecture as service-based, such as a service-based architecture (SBA). It is recognized herein that when deploying different NFs, there may be situations in which many of the NFs may need to interact with entities external to the SBA-based 5GC network (e.g., including corresponding (multiple) PLMNs, such as HPLMN and VPLMN). Therefore, the term "internal" as used herein illustratively refers to operations and / or communications within the SBA-based 5GC network (e.g., SBA-based interfaces), and the term "external" illustratively refers to operations and / or communications external to the SBA-based 5GC network (non-SBA interfaces).

[0057] In view of the above general description of some features of the 5GC network, the problems with existing security methods in the context of access network sharing and the solutions proposed according to the illustrative embodiments will now be described below.

[0058] As stated in TS 22.261 cited above, access nodes (e.g., where such as Figure 1 The increased density of access points 104 in the access network is a non-limiting example of an access node) poses considerable challenges in terms of deployment and acquisition of spectrum and antenna locations. Access network (radio access network or RAN) sharing is seen as a technical solution to these problems.

[0059] Shared access networks and network infrastructure have become an increasingly important part of 3GPP systems. When two or more operators have deployed or plan to deploy 5G access networks and core networks, respectively, a multi-operator core network (MOCN) configuration may be considered for network sharing between these operators. For example, an MOCN may include multiple core network (CN) nodes (e.g., 5GC network entities) connected to the same radio access network, while the CN nodes are operated by different operators.

[0060] One of the challenges for network operators of shared access networks is the maintenance of the interconnections (eg, number of network interfaces) between the shared RAN and two or more core networks, especially for a large number of shared base stations.

[0061] It is therefore appreciated that other types of network sharing configurations should be considered, such as, for example, where the 5G RAN is shared between multiple operators without necessarily assuming a direct connection between the shared access network and the core networks of the participating operators.

[0062] For example, assume that two (or more) operators provide coverage of their respective radio access networks in different parts of the country, but together cover the entire country. Further assume that there is a consensus among all operators to work together and build a shared network (e.g., MOCN), but at the same time appropriately utilize the allocated spectrum of different operators in different parts of the coverage area (e.g., low traffic area (LTA) and high traffic area (HTA)).

[0063] exist Figure 3 An example of a shared access network environment 300 is shown in FIG. More specifically, as shown, the core networks of multiple operators (e.g., OP1, OP2, OP3, and OP4) share a NG-RAN owned and operated by OP1 (thus OP1 can be referred to as a "hosted RAN operator"). With or without a direct connection between the shared access network and the core network of the OP, other OPs can share the NG-RAN of OP1. For example, as shown, in addition to the core network of OP1 using a direct connection to its own NG-RAN (i.e., via the N2 interface), the core network of OP4 also utilizes a direct (N2) connection. OP4 is considered to have an MOCN arrangement with OP1. In contrast, the core networks of OP2 and OP3 respectively utilize an indirect connection to the NG-RAN via the core network of OP1, as will be further explained. Therefore, each UE subscribed to a specific core network operator, for example, as shown, UE1 of OP1, UE2 of OP2, UE3 of OP3, and UE4 of OP4, accesses their corresponding core network via the shared NG-RAN of OP1. In addition to the above assumptions, in this example, it is further assumed that NG-RAN is shared under certain conditions, for example, within a specific 5G frequency band or within a specific area.

[0064] Given Figure 3In a shared access network environment 300 in FIG. 3 , the following service flows may occur. UE1 may be successfully attached to the NG-RAN, and the display of the network operator name is the name of OP1. UE2 may be successfully attached to the NG-RAN, and the display of the network operator name is the name of OP2. UE3 may be successfully attached to the NG-RAN, and the display of the network operator name is the name of OP3. UE4 may be successfully attached to the NG-RAN, and the display of the network operator name is the name of OP4. The service provider of UE1 is OP1. The service provider of UE2 is OP2. The service provider of UE3 is OP3. The service provider of UE4 is OP4. For UEs accessing the shared RAN, the network of the hosting operator (e.g., OP1) needs to know which participating operator the UE is registered with, and what type of network sharing (e.g., MOCN or otherwise) is adopted for the participating operator. In this type of network sharing, the UE is unaware of the type and details of network sharing, i.e., the UE process is transparent to the network sharing. The UE connects and registers as if it were connected to a single network belonging to its home operator.

[0065] Therefore, in Figure 3 In certain scenarios as shown in the example of , the 5G system wishes to support access network sharing with indirect connectivity between the shared access network (e.g., NG-RAN of OP1) and the core networks of one or more participating operators (e.g., OP2 and OP3).

[0066] However, it is appreciated herein that for network sharing via an indirect connection, there is currently no authentication procedure available, in particular an authentication procedure that does not affect the UE.

[0067] The illustrative embodiments overcome the above-mentioned and other technical deficiencies associated with existing access network sharing approaches by providing a UE authentication procedure in an access network sharing environment with an indirect connection between a participating operator's core network and a shared access network operated by another participating operator.

[0068] In access network sharing with indirect connectivity, it is recognized herein that the UE should be transparent to the network configuration and participation of two or more PLMNs in providing services. However, the UE assumes that it is connected to a single PLMN while performing non-access stratum (NAS) and access stratum (AS) procedures.

[0069] In order to preserve such homogeneity of serving PLMNs in access network sharing and to keep access network sharing transparent to UEs, one or more illustrative embodiments adjust network behaviors and one or more protocol stacks in the network. More specifically, one or more illustrative embodiments extend the traditional authentication process to support indirect connections between a shared RAN and the core networks of participating operators.

[0070] For example, Figure 4 An architecture 400 according to an illustrative embodiment is shown. As shown, operator 402-A (operator A) has UE 404-A (UE1) associated therewith, AMF 406-A, HN 408-A, SMF 410-A, UPF 412-A and (shared) RAN 420-A. It should be understood that HN 408-A includes one or more network entities (e.g., AUSF, UDM, UDR, etc.), which are part of the core network of operator 402-A to which UE 404-A subscribes. As further shown, operator 402-B (operator B) has UE 404-B (UE2) associated therewith, AMF 406-B and HN 408-B. It should be understood that HN408-B includes one or more network entities (e.g., AUSF, UDM, UDR, etc.), which are part of the core network of operator 402-B to which UE 404-B subscribes.

[0071] The AMF 406-A from the core network of the operator 402-A, which has a direct connection with the (shared) RAN 420-A, can be regarded as a "hosted AMF". The AMF 406-B from the core network of the operator 402-B, which has an indirect connection with the (shared) RAN 420-A, can be regarded as a "consumer AMF". Therefore, in a direct connection scenario, the UE 404-A is served by the (shared) RAN 420-A, AMF 406-A, SMF 410-A, UPF 412-A and HN 408-A of the operator 402-A. In an indirect connection scenario, the UE 404-B is served by the (shared) RAN 420-A, the hosted AMF 406-A, the SMF 410-A and the UPF 412-A, which support the core network entities of the operator 402-B, such as AMF 406-B and HN 408-B. Advantageously, as will be further explained herein, the illustrative embodiments provide for communication between the hosting AMF and the consumer AMF to extend the traditional authentication process to support indirect connections based on the (shared) RAN 420-A. The AMF may also be referred to herein as an "access management entity".

[0072] Furthermore, with respect to the protocol stack according to one illustrative embodiment, the hosting AMF acts as the primary AMF (also referred to herein as the "primary access management entity") that holds the UE context, while the consumer AMF coordinates between the HN network entity and the hosting AMF to obtain keys and configurations. Figure 5AThe protocol stack configuration 500 shows a protocol stack 502 for UE 404-B, a protocol stack 504 for the (shared) RAN 420-A (5G-RAN), a protocol stack 506 for the hosted AMF 406-A, and a protocol stack 508 for the consumer AMF 406-B.

[0073] In another illustrative embodiment, the hosting AMF acts as a relay AMF, where all NAS messages are relayed to the consumer AMF or home network AMF acting as the primary AMF (also referred to herein as the "primary access management entity") that holds the UE context. Figure 5B The protocol stack configuration 510 shows a protocol stack 512 for UE 404-B, a protocol stack 514 for the (shared) RAN 420-A (5G-RAN), a protocol stack 516 for the hosted AMF 406-A, and a protocol stack 518 for the consumer AMF 406-B.

[0074] Thus, with respect to authentication, one AMF acts as a hosting AMF, while the other AMF acts as a consumer AMF. In one illustrative embodiment, the hosting AMF acts as a relay AMF, which will be described below in Fig. 6A (and Figure 5A In the context of the protocol stack configuration 500 consistent with the protocol stack configuration 500 of FIG. 1 , and in another illustrative embodiment, the hosted AMF acts as the primary AMF, which will be described below in Figure 6B (and Figure 5B The UE context is further described in the context of the protocol stack configuration 510 consistent with the protocol stack configuration 510 of the embodiment of the present invention. According to the supported embodiments, the UE context is maintained in the AMF (hosting AMF or consumer AMF). The mapping of the UE identifier (ID) and the consumer AMF is completed by the hosting AMF for future relay messages. The hosting AMF and the consumer AMF may each be collectively referred to as an "access management entity" in this document.

[0075] Reference now Fig. 6A , according to an illustrative embodiment, a process 600 for authenticating a user device in an access network sharing environment is depicted. The process 600 corresponds to Figure 5A 500. As shown, the process 600 involves a UE 602, a shared radio access network (shared RAN) 604 and a hosted AMF 606 of a network operator 608, and a consumer AMF 610 and a home network (HN) 612 of a network operator 614 to which the UE 602 subscribes.

[0076] Step 0 (a. and b.). The hosting AMF 606 and the consumer AMF 610 are pre-configured to route messages between them. In addition, a transport layer security (TLS) connection is established between the hosting AMF 606 and the consumer AMF 610.

[0077] Steps 1 and 2 (a. and b.): The UE 602 performs SUPI to SUCI hiding and sends a Registration Request message together with the SUCI or 5G Globally Unique Temporary Identifier (5G-GUTI) from the UE 602 to the hosting AMF 606 via the shared RAN.

[0078] Step 3: The hosting AMF 606 sends a new Service Based Interface (SBI) message, namely, Namf_IndirectCommunication_Registration request message, along with the SUCI or 5G-GUTI, to the consumer AMF 610.

[0079] Steps 4 and 5: Perform an authentication process including authentication and key management challenges as described in TS 33.501 referenced above (e.g., see Figure 6.1.3.1-1 or 6.1.3.2-1, steps 3 to 12 of TS 33.501, which describes 5G Authentication and Key Agreement (5G AKA) and Extensible Authentication Protocol AKA (EAP-AKA')).

[0080] Step 6: Generate key K in consumer AMF 610 AMF .

[0081] Step 7 (a. and b.): The consumer AMF 610 uses the generated key K AMF Responds with a Namf_IndirectCommunication_Registration response. The communication occurs over a secure TLS connection between the hosting AMF 606 and the consumer AMF 610. The consumer AMF 610 maintains the UE Lite security context with the Key ID and the hosting AMF ID.

[0082] Step 8 (a., b. and c.): The hosting AMF 606 is the master AMF that maintains the consumer AMF (610) ID and key K AMF The NAS security mode procedure is performed between the UE 602 and the hosting AMF 606. The hosting AMF 606 uses the K AMF Generate gNB key K gNB and sends it to the gNB of the shared RAN 604.

[0083] Steps 9, 10 and 11: Utilize the received K provided by the hosting AMF 606 gNB The key performs the AS security mode procedure. The NAS message is terminated at the hosting AMF 606 and the remaining message is forwarded to the HN 612 via the consumer AMF 610.

[0084] Reference now Figure 6B , depicts a process 620 for user device authentication in an access network sharing environment according to an illustrative embodiment. Process 620 corresponds to Figure 5B 510. As shown, process 620 involves UE 622, shared radio access network (shared RAN) 624 and hosted AMF 626 of network operator 628, and consumer AMF 630 and home network (HN) 632 of network operator 634 to which UE 622 subscribes.

[0085] Step 0 (a. and b.): The hosting AMF 626 and the consumer AMF 630 are pre-configured for routing messages between them.

[0086] Steps 1 and 2 (a., b. and c.): UE 622 performs SUPI to SUCI hiding. A Registration Request message is sent from UE 622 to the hosting AMF 626 along with the SUCI or 5G-GUTI. The hosting AMF 626 maintains or generates the UE (622) ID for relaying to the consumer AMF 630.

[0087] Step 3: The hosting AMF 626 sends a Relay Registration Request message to the consumer AMF 630 along with the SUCI or 5G-GUTI.

[0088] Steps 4 and 5: Perform an authentication process including authentication and key management challenges as described in TS 33.501 referenced above (e.g., see Figure 6.1.3.1-1 or 6.1.3.2-1, steps 3 to 12 of TS 33.501, which describes the 5G Authentication and Key Agreement (5G Authentication and Key Agreement) (5G AKA) and Extensible Authentication Protocol AKA (EAP-AKA')).

[0089] Step 6: Generate key K in consumer AMF 630 AMF .

[0090] Step 7 (ab and c.): The consumer AMF 630 responds with a relayed registration response over a secure TLS connection between the hosting AMF 626 and the consumer AMF 630. The consumer AMF 630 maintains the UE full NAS security context with the key ID and the hosting AMF (626) ID. The hosting AMF 626 does not maintain any UE security context, but maintains a mapping between the UE (622) ID and the consumer AMF (630) ID.

[0091] Step 8 (ab and c.). Perform NAS security mode procedures between UE 622 and consumer AMF 630. Consumer AMF 630 uses the key K of consumer AMF 630 AMF Generate gNB key K gNB , and the generated key K gNB The escrow AMF 626 sends the generated key K gNB Relay to the gNB of the shared RAN 624.

[0092] Steps 9, 10 and 11: Utilize the received K provided by the hosting AMF 626 gNB The key performs the AS security mode procedure. The NAS message is terminated at the hosting AMF 626 and the remaining message is forwarded to the HN 632 via the consumer AMF 630.

[0093] Advantageously, as illustratively explained herein, the illustrative embodiments provide an authentication solution in an access network sharing environment for an indirect connection scenario. Furthermore, as an advantage, the illustrative embodiments leverage the AMF (hosting and consumer AMF) to enable communication between them. Thus, the gNB and UE can retain legacy procedures (as in the current RAN sharing scenario) and do not need to be modified to implement the authentication solution described herein to support direct or indirect network sharing.

[0094] For example, in some embodiments, from the perspective of a hosted AMF, a device includes at least one processor and at least one memory, the at least one memory storing instructions, which, when executed by the at least one processor, causes the device to be configured as a first access management entity in a first communication network, wherein the first communication network has a radio access network associated therewith. The first access management entity is configured to: establish a secure connection with a second access management entity in a second communication network subscribed by a user equipment; and facilitate authentication of the user equipment in conjunction with the second access management entity through the secure connection, so that the user equipment can access the second communication network using the radio access network associated with the first communication network.

[0095] The hosted AMF may serve as a primary (main) AMF. For example, when facilitating authentication of a user device, the first access management entity may also be configured as the primary access management entity that maintains the security context of the user device. Thus, the first access management entity may also be configured to: receive a first key from a second access management entity; perform one or more non-access layer security procedures with the user device; generate a second key based on the first key received from the second access management entity; and send the second key to the radio access network to enable the radio access network and the user device to perform one or more access layer security procedures.

[0096] The hosting AMF may be used as a relay AMF. For example, when facilitating authentication of a user equipment, the first access management entity may also be configured as a relay access management entity, which relays a message to a second access management entity, which is configured as a primary access management entity that maintains a security context for the user equipment. Thus, the first access management entity may also be configured to: maintain a mapping between an identifier of the user equipment and an identifier of the second access management entity; receive a key from the second access management entity; and send a key to the radio access network to enable the radio access network and the user equipment to perform one or more access layer security procedures.

[0097] For example, in some embodiments, from the perspective of a consumer AMF, a device includes at least one processor and at least one memory, the at least one memory storing instructions, which, when executed by the at least one processor, causes the device to be configured as a first access management entity in a first communication network to which a user equipment subscribes. The first access management entity is configured to: establish a secure connection with a second access management entity in a second communication network, wherein the second communication network has a radio access network associated therewith; and facilitate authentication of the user equipment in conjunction with the second access management entity through the secure connection, so that the user equipment can access the first communication network using the radio access network associated with the second communication network.

[0098] The consumer AMF may serve as a primary (main) AMF. For example, when facilitating authentication of a user equipment, the first access management entity may also be configured as the primary access management entity that maintains the security context of the user equipment. Thus, the first access management entity may also be configured to perform one or more of the following: perform one or more non-access stratum security procedures with the user equipment; generate keys to enable the radio access network and the user equipment to perform one or more access stratum security procedures; and send the keys to the second access management entity for forwarding to the radio access network.

[0099] The consumer AMF may be used as a secondary AMF. For example, when facilitating authentication of a user device, the first access management entity may also be configured to assist in key management for a second access management entity that is configured as a primary access management entity that maintains a security context for the user device. Thus, the first access management entity may also be configured to: generate a first key; and send the first key to the second access management entity to enable the second access management entity to generate a second key based on the first key, wherein the second key may be used to enable the radio access network and the user device to perform one or more access layer security procedures.

[0100] For example, in some embodiments, from the perspective of a user equipment, an apparatus includes at least one processor and at least one memory, the at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus to perform one or more processes using one of: (i) a first access management entity in a first communication network having a radio access network associated therewith; and (ii) a second access management entity in a second communication network to which the apparatus subscribes, so that the apparatus can access the second communication network using the radio access network associated with the first communication network. The apparatus acts as if it is communicating with a single communication network without distinguishing between the first communication network and the second communication network while performing one or more processes using the first access management entity, the second access management entity network, or any other network entity belonging to the first communication network or the second communication network.

[0101] For example, in some embodiments, from the perspective of a shared radio access network, an apparatus includes at least one processor and at least one memory, the at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus to participate in one or more processes involving: (i) a first access management entity in a first communication network with which the apparatus is associated; and (ii) a second access management entity in a second communication network to which a user equipment subscribes, so that the user equipment can utilize the apparatus to access the second communication network.

[0102] As used herein, it should be understood that the term "communication network" may include two or more separate communication networks in some embodiments. In addition, the specific processing operations and other system functions described in conjunction with the figures described herein are presented only in an illustrative example manner and should not be interpreted as limiting the scope of the present disclosure in any way. Alternative embodiments may use other types of processing operations and messaging protocols. For example, the order of steps may be changed in other embodiments, or some steps may be performed at least partially concurrently with each other rather than sequentially. In addition, one or more of the steps may be repeated periodically, or multiple instances of the method may be performed in parallel with each other.

[0103] It should be emphasized again that the various embodiments described herein are presented by way of illustrative examples only and should not be construed as limiting the scope of the claims. For example, alternative embodiments may utilize communication system configurations, user equipment configurations, base station configurations, configuration and use procedures, messaging protocols, and message formats that are different from those described above in the context of the illustrative embodiments. These and many other alternative embodiments within the scope of the appended claims will become apparent to those of ordinary skill in the art.

Claims

1. A device for communication, comprising: at least one processor; as well as at least one memory storing instructions which, when executed by the at least one processor, cause the apparatus to be configured as a first access management entity in a first communication network, wherein the first communication network has a radio access network associated therewith, the first access management entity being configured to: Establishing a secure connection with a second access management entity in a second communication network to which the user equipment subscribes; as well as Authentication of the user equipment is facilitated in conjunction with the second access management entity over the secure connection to enable the user equipment to access the second communication network using the radio access network associated with the first communication network. 2 . The apparatus of claim 1 , wherein when facilitating authentication of the user equipment, the first access management entity is further configured as a primary access management entity that maintains a security context for the user equipment.

3. The apparatus of claim 2, wherein when facilitating authentication of the user equipment, the first access management entity is further configured to receive a first key from the second access management entity. 4 . The apparatus of claim 3 , wherein when facilitating authentication of the user equipment, the first access management entity is further configured to perform one or more non-access stratum security procedures with the user equipment.

5. The apparatus of claim 3, wherein when facilitating authentication of the user equipment, the first access management entity is further configured to generate a second key based on the first key received from the second access management entity.

6. The apparatus of claim 5, wherein when facilitating authentication of the user equipment, the first access management entity is further configured to send the second key to the radio access network to enable the radio access network and the user equipment to perform one or more access stratum security procedures.

7. The apparatus of claim 1, wherein when facilitating authentication of the user equipment, the first access management entity is further configured as a relay access management entity, which relays messages to the second access management entity, and the second access management entity is configured as a primary access management entity that maintains a security context of the user equipment.

8. The apparatus of claim 7, wherein when facilitating authentication of the user equipment, the first access management entity is further configured to maintain a mapping between an identifier of the user equipment and an identifier of the second access management entity.

9. The apparatus of claim 8, wherein when facilitating authentication of the user equipment, the first access management entity is further configured to: receiving a key from the second access management entity; and The key is sent to the radio access network to enable the radio access network and the user equipment to perform one or more access stratum security procedures.

10. An apparatus for communication, comprising: at least one processor; as well as At least one memory, wherein the at least one memory stores instructions, and when the instructions are executed by the at least one processor, the apparatus is configured as a first access management entity in a first communication network subscribed by a user equipment, and the first access management entity is configured to: establishing a secure connection with a second access management entity in a second communication network, wherein the second communication network has a radio access network associated therewith; and Authentication of the user equipment is facilitated in conjunction with the second access management entity over the secure connection to enable the user equipment to access the first communication network using the radio access network associated with the second communication network.

Images