Authentication and key management enabling application services for roaming users

Abstract

Methods, apparatuses, and systems related to authentication and key management for enabling application services for roaming users are disclosed. In one example aspect, a method for wireless communication includes receiving, by a network device in a first network from a network device in a second network, a signal indicating an authentication result associated with the wireless device, where the signal includes a first key and an indication if the first network is different from the second network; and generating, by the network device, key-related information based on the signal.

Description

Technical Field

[0001] This patent document relates to wireless communications. Background Art

[0002] Mobile communication technology is driving the world towards an increasingly connected and networked society. Compared with existing wireless networks, next-generation systems and communication technologies will need to support a wider range of use case features and provide more complex and sophisticated access requirements and flexibility.

[0003] Long Term Evolution (LTE) is a wireless communication standard for mobile devices and data terminals developed by the Third Generation Partnership Project (3GPP). LTE Evolution (LTE-A) is a wireless communication standard that is an enhanced version of the LTE standard. The fifth-generation wireless system, known as 5G, advances the LTE and LTE-A wireless standards and is committed to supporting higher data rates, a large number of connections, ultra-low latency, high reliability, and other emerging business requirements. Summary of the invention

[0004] This patent document discloses, inter alia, techniques related to authentication and key management for enabling application services for roaming users in a wireless communication network.

[0005] In one example aspect, a wireless communication method is disclosed. The method includes: receiving, by a network device in a first network, a signal indicating an authentication result related to a wireless device from a network device in a second network, wherein the signal includes a first key and an indication that the first network is different from the second network; and generating, by the network device, key-related information based on the signal.

[0006] In another example aspect, another wireless communication method is disclosed. The method includes: sending, by a network device in a second network, a signal from a first network indicating an authentication result associated with a wireless device, wherein the signal includes a first key and an indication that the first network is different from the second network.

[0007] In another example aspect, another wireless communication method is disclosed. The method includes generating, by a wireless device in the first network, key-related information based on a first key and an indication related to the second network when the first network is different from the second network.

[0008] In another example aspect, a wireless communication device is disclosed, the wireless communication device comprising a process configured or operable to perform the above method.

[0009] In another exemplary aspect, a computer-readable storage medium is disclosed. The computer-readable storage medium stores codes, which, when executed by a processor, cause the processor to implement the above method. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1 A diagram showing the service-based architecture (SBA) architecture of 5GS for roaming UE access application functionality.

[0011] Figure 2 An example of enabling application authentication and key management (AKMA) services for roaming users is shown.

[0012] Figure 3 Another example of enabling AKMA service for a roaming user is shown.

[0013] Figure 4 A block diagram illustrating an example of a hardware platform that may be part of a network device or communications device.

[0014] Figure 5 An example of network communication including a base station (BS) and a user equipment (UE) based on some embodiments of the disclosed technology is shown.

[0015] Figures 6 to 8 is a flowchart representation of a method for wireless communication in accordance with one or more embodiments of the present technology. DETAILED DESCRIPTION

[0016] The section headings used in this document are for ease of understanding and do not limit the scope of the disclosed technology to a particular section. In addition, certain terms related to 5G and the 3rd Generation Partnership Project (3GPP) protocol are used as illustrative examples, and the disclosed technology is also applicable to other wireless protocols.

[0017] In 5G networks, a roaming UE in a visited public land mobile network (VPLMN) may need to access internal application functions of the VPLMN or the home public land mobile network (HPLMN).

[0018] Figure 1 It is the SBA architecture of 5GS for roaming UE to access application functions in VPLMN and HPLMN. The functions of related components are described as follows.

[0019] The 5G system architecture consists of the following network functions (NFs):

[0020] The access and mobility management function (AMF) includes the following functions: UE mobility management, reachability management, connection management, etc.

[0021] The Security Anchor Function (SEAF) in the Serving Network stores the K provided by the Authentication Server Function (AUSF) in the Home Network. SEAF The anchor key K SEAF It is derived from the key material generated by the master authentication and key agreement process.

[0022] The Authentication Server Function (AUSF) supports authentication for both 3GPP accesses and untrusted non-3GPP accesses. In the AKMA architecture, the AUSF provides the UE’s Subscription Permanent Identifier (SUPI) and AKMA key material (A-KID, K AKMA ). AUSF also performs AAnF selection.

[0023] The AKMA Anchor Function (AAnF) stores the AKMA Anchor Key (K AKMA ) and SUPI, which are received from the AUSF after the UE successfully completes 5G Primary Authentication. AAnF also generates key material to be used between the UE and the Application Function (AF) and maintains the UE AKMA context. AAnF sends the UE's SUPI to the AF located within the operator's network upon AF request, or sends it to the NEF.

[0024] Unified Data Management (UDM) stores subscription profiles for UEs. In the AKMA architecture, UDM stores the AKMA subscription data of subscribers.

[0025] AKMA roaming scenarios depend on UE and AF locations. There are different scenarios to be solved for AKMA roaming:

[0026] • Case 1: The UE is in a VPLMN and accesses an internal HPLMN AF.

[0027] Case 2: The UE is in a VPLMN and accesses an intra-VPLMN AF.

[0028] • Case 3: The UE is in a VPLMN and accesses an external AF in a data network (Internet).

[0029] The AKMA roaming solution should comply with the LI requirements. It requires that either decrypted traffic should be provided to the VPLMN, or the VPLMN should be provided with a means to decrypt traffic for the VPLMN or law enforcement (e.g., provision of keys). The LI requirement for access keys only applies to encryption, and in the case of AKMA, when the Ua* protocol is encrypted. Regarding the means to decrypt traffic for the VPLMN or law enforcement (e.g., provision of keys), for cases 1 and 2, the encryption keys (not necessarily K) to decrypt the user traffic need to be provided from the AF to the VPLMN. AF , unless K AF For case 3, it is only necessary to provide the VPLMN with the key and the corresponding information known to the HPLMN and used to establish the encryption key.

[0030] The above are three scenarios of AKMA roaming described in 3GPP S3-224109.

[0031] However, under the existing standards for Case 1 and Case 2, there is no way for the VPLMN function or the UE to accurately generate the required key-related information. This is partly due to the lack of information about the encryption key from the HPLMN. This patent application aims to solve this problem. Specifically, this patent application proposes two mechanisms for enabling AKMA services for roaming Case 1 and Case 2 that are consistent with the existing standards.

[0032] Example 1

[0033] This section also discloses, among other things, another mechanism for enabling AKMA services for roaming cases 1 and 2.

[0034] Figure 2 The proposed mechanism for enabling AKMA service for roaming users and providing supervision information to the VPLMN is shown.

[0035] Steps 1-4: Steps 1 to 4 are defined in TS 33.535 clause 6.1.

[0036] Step 5: Perform the rest of the main authentication process as defined in TS 33.501 Section 6.1.3. Here, Step 5 is a general concept, such as Figure 1 As shown in the box in , it includes multiple steps, including step 6.

[0037] Step 6: During the primary authentication, the AUSF responds to the SEAF in the VPLMN with information about the authentication result via Nausf_UE Authentication_AuthenticationResponse. If the UE is from another serving network based on the SN name, the AUSF includes the K to the SEAF in the VPLMN in the response. SEAF and AKMA instructions.

[0038] Step 7: If AUSF receives an AKMA indication from UDM, it will generate AKMA key material.

[0039] A roaming UE in a VPLMN shall generate a K before initiating communication with the AKMA application function. vAKMA and A-vKID. UE calculates:

[0040] K as shown in TS 33.535 Appendix A.2 vAKMA , using K SEAF Replace K AUSF .

[0041] A vKID that is the A-KID in clause 6.1 of TS 33.535, but the domain part of the A-vKID shall include the serving network identifier and the 5G-GUTI.

[0042] SEAF in VPLMN generates K calculated in the same way as above vAKMA and A-vKID, and sends the AKMA key material to vAAnF.

[0043] Step 8: The UE sends an application session establishment request with A-vKID to the vAF.

[0044] Step 9: vAF discovers vAAnF and sends a Naanf_AKMA_ApplicationKey_Get request with A-vKID and AF_ID to vAAnF. vAKMA Export the application key K AF .

[0045] Step 10: vAAnF to include K AF , K AF This response is responded with a Naanf_AKMA_ApplicationKey_Get response with the expiration time and the registered SN ID.

[0046] Step 11: vAF sends an application session establishment response to the UE. If the information in step 10 indicates failure of the AKMA key request, the AF shall reject the application session establishment by including the failure reason.

[0047] Step 12: If necessary, the AMF / SEAF in the VPLMN may request additional security information from the vAF for supervision purposes, such as Ua* protocols, security algorithms, etc.

[0048] Step 13: The vAF passes any additional security information for supervisory purposes when available or requested.

[0049] Steps 14-20: Steps 14-20 are similar to steps 7-13, except that:

[0050] The application function is the hAF in the HPLMN.

[0051] • The AKMA anchor function is hAAnF in the HPLMN.

[0052] Roaming UE generates K AKMA and A-KID.

[0053] AUSF generation K in HPLMN AKMA and A-KID, and sends the AKMA key material to hAAnF.

[0054] According to TS 33.535 Appendix A.2, use K AUSF Calculate K AKMA .

[0055] The KID is calculated in the same way as the A-KID in clause 6.1 of TS 33.535, but the domain part in the A-KID shall include the serving network identifier and the 5G-GUTI.

[0056] Example 2

[0057] This section also discloses, among other things, another mechanism for enabling AKMA services for roaming cases 1 and 2.

[0058] Figure 3 Another proposed mechanism for enabling AKMA service for roaming users and providing supervision information to the VPLMN is shown.

[0059] Steps: 1-4: Steps 1 to 4 are defined in TS 33.535 clause 6.1.

[0060] Step 5: Perform the remainder of the main authentication process as defined in TS 33.501 clause 6.1.3.

[0061] Step 6: During the primary authentication, the AUSF responds with information about the authentication result to the SEAF in the VPLMN via the Nausf_UEAuthentication_Authentication response.

[0062] If the UE is from another serving network based on the SN name, the AUSF includes the K for the SEAF in the VPLMN in the response. SEAF and AKMA instructions.

[0063] Step 7: If AUSF receives an AKMA indication from UDM, it will generate AKMA key material.

[0064] Sub-step 7a: The roaming UE in the VPLMN shall generate K before initiating communication with the AKMA application function vAKMA and A-vKID. UE calculates:

[0065] K as shown in Appendix A.2 of TS 33.535 [2] vAKMA , using K SEAF Replace K AUSF .

[0066] A vKID that is the same as the A-KID in clause 6.1 of TS 33.535 [2], except that the domain part of the A-vKID shall include the serving network identifier and the 5G-GUTI.

[0067] Sub-step 7b: If the application function is in the VPLMN, the SEAF in the VPLMN generates K calculated in the same way as above vAKMA and A-vKID, and sends the AKMA key material to vAAnF.

[0068] If the application function is in the HPLMN, the AUSF in the HPLMN generates K calculated in the same way as above vAKMA and A-vKID, and sends the AKMA key material to hAAnF.

[0069] Step 8: The UE sends an application session establishment request with A-vKID to the vAF.

[0070] Step 9: vAF discovers vAAnF and sends a Naanf_AKMA_ApplicationKey_Get request with A-vKID and AF_ID to vAAnF. vAKMA Export the application key K AF .

[0071] Step 10: vAAnF to include K AF , K AF The SN ID of the registered SN will be responded to with a Naanf_AKMA_ApplicationKey_Get response with the expiration time and the registered SN ID.

[0072] Step 11: vAF sends an application session establishment response to the UE. If the information in step 10 indicates failure of the AKMA key request, the AF shall reject the application session establishment by including the failure reason.

[0073] Step 12-15: Step 12-15 is the same as step 8-11, except that the application function is the hAF in the HPLMN.

[0074] Steps 16-17: If necessary, the AMF / SEAF in the VPLMN may request additional security information from the vAF and / or hAF for supervision purposes, such as Ua* protocols, security algorithms, etc.

[0075] Steps 18-19: The vAF and / or hAF communicate any additional safety information for supervisory purposes as available or required.

[0076] Figure 4An exemplary block diagram of a hardware platform 400 is shown, which may be part of a network device (e.g., a base station) or a communication device (e.g., a user equipment (UE)). The hardware platform 400 includes at least one processor 410 and a memory 405 having instructions stored thereon. The instructions executed by the processor 410 configure the hardware platform 400 to perform Figure 4 The operations described in the foregoing and the operations of various embodiments described in this patent application document. Transmitter 415 transmits or sends information or data to another device. For example, a network device transmitter can send a message to a user device. Receiver 420 receives information or data transmitted or sent by another device. For example, a user device can receive a message from a network device.

[0077] The embodiments discussed above will apply to network communications. Figure 5 An example of a communication system (e.g., a 6G or NR cellular network) including a base station 520 and one or more user equipment (UE) 511, 512, and 513 is shown. In some embodiments, the UE uses a communication link to the network (sometimes referred to as an uplink direction, as depicted by dashed arrows 531, 532, 533) to access the BS (e.g., the network), which then enables subsequent communication from the BS to the UE (e.g., shown in the direction from the network to the UE, sometimes referred to as a downlink direction, as shown by arrows 541, 542, 543). In some embodiments, the BS sends information to the UE (sometimes referred to as a downlink direction, as depicted by arrows 541, 542, 543), which then enables subsequent communication from the UE to the BS (e.g., shown in the direction from the UE to the BS, sometimes referred to as an uplink direction, as shown by dashed arrows 531, 532, 533). The UE can be, for example, a smartphone, a tablet, a mobile computer, a machine-to-machine (M2M) device, an Internet of Things (IoT) device, etc.

[0078] In one example aspect (e.g., Figure 6 A wireless communication method is disclosed. The method includes: receiving (602) a signal indicating an authentication result related to a wireless device from a network device in a second network by a network device in a first network, wherein the signal includes a first key and an indication when the first network is different from the second network; and generating (604) key-related information by the network device based on the signal.

[0079] In another example aspect (e.g., Figure 7As depicted), another wireless communication method is disclosed. The method includes: a network device in a second network sends (702) a signal indicating an authentication result related to a wireless device from a first network, wherein the signal includes a first key and an indication that the first network is different from the second network.

[0080] In another example aspect (e.g., Figure 8 As depicted, another wireless communication method is disclosed. The method includes: when the first network is different from the second network, a wireless device in the first network generates (802) key-related information based on a first key and an indication related to the second network.

[0081] In some embodiments, the key-related information includes the second key and identification information of the second key.

[0082] In some embodiments, the second key is generated based on the first key.

[0083] In some embodiments, the identification information of the second key includes a network identifier and a user temporary identifier.

[0084] In some embodiments, the user temporary identifier is a 5G Globally Unique Temporary Identifier (5G-GUTI).

[0085] In some embodiments, the above method further includes sending, by the network device, information related to the key to another device in the network that is a communication device associated therewith.

[0086] In some embodiments, the network device is an Authentication Server Function (AUSF).

[0087] In some embodiments, the network device includes at least one of: 1) a security anchor function (SEAF) or 2) an access and mobility management function (AMF).

[0088] In some embodiments, the wireless device is a user equipment (UE).

[0089] In some embodiments, the above method further includes sending, by the second communication device in the second network, information related to the key to another device in the second network.

[0090] In some embodiments, the second communication device is an Authentication Server Function (AUSF).

[0091] It should be understood that this document discloses methods and devices related to enabling AKMA services for roaming users in a wireless communication system. There are three scenarios for AKMA roaming. Under the current standards, under the existing standards for Case 1 and Case 2, there is no way for the VPLMN function or UE to accurately generate the required key-related information. None of the existing methods or solutions solves this problem. This patent application aims to solve this problem by proposing two mechanisms for enabling AKMA services for roaming cases 1 and 2 that are consistent with the existing standards.

[0092] Figures 6 to 8 Various preferred embodiments and additional features of the above method are as follows. Further examples are described with reference to embodiments 1 to 2.

[0093] The disclosed and other embodiments, modules and functional operations described in this document can be implemented in digital electronic circuits, computer software, firmware or hardware, including the structures disclosed in this document and their structural equivalents, or a combination of one or more thereof. The disclosed embodiments and other embodiments can be implemented as one or more computer program products (i.e., modules of one or more computer program instructions encoded on a computer-readable medium for execution by a data processing device or controlling the operation of the data processing device). The computer-readable medium can be a machine-readable storage device, a machine-readable storage substrate, a memory device, a composition of matter that affects a machine-readable propagation signal, or one or more combinations thereof. The term "data processing device" covers all devices, equipment and machines for processing data, including, for example, a programmable processor, a computer or multiple processors or multiple computers. In addition to hardware, the device can also include code that creates an execution environment for the computer program in question, for example, code that constitutes a processor firmware, a protocol stack, a database management system, an operating system, or a combination of one or more thereof. A propagation signal is an artificially generated signal, for example, a machine-generated electrical, optical or electromagnetic signal, which is generated to encode information for transmission to a suitable receiver device.

[0094] A computer program (also referred to as a program, software, software application, script, or code) can be written in any form of programming language (including compiled or interpreted languages), and it can be deployed in any form, including as a stand-alone program or as a module, component, subroutine, or other unit suitable for a computing environment. A computer program does not necessarily correspond to a file in a file system. A program can be stored in a portion of a file that holds other programs or data (e.g., one or more scripts stored in a markup language document), in a single file dedicated to the program in question, or in multiple coordinated files (e.g., files storing one or more modules, subroutines, or code portions). A computer program can be deployed to execute on one computer, or on multiple computers located at one site or distributed across multiple sites and interconnected by a communications network.

[0095] The processes and logic flows described in this document can be performed by one or more programmable processors executing one or more computer programs to perform functions by operating on input data and generating output. The processes and logic flows can also be performed by special purpose logic circuits, and the apparatus can also be implemented as special purpose logic circuits (e.g., FPGA (field programmable gate array) or ASIC (application specific integrated circuit)).

[0096] For example, processors suitable for executing computer programs include general and special purpose microprocessors, and any one or more processors of any type of digital computer. Typically, the processor will receive instructions and data from a read-only memory or a random access memory or both. The basic elements of a computer are a processor for executing instructions and one or more memory devices for storing instructions and data. Typically, a computer will also include or be operably coupled to one or more mass storage devices (such as magnetic disks, magneto-optical disks, or optical disks) for storing data to receive data from the mass storage device or to transfer data to the mass storage device, or both. However, a computer is not required to have such a device. Computer-readable media suitable for storing computer program instructions and data include all forms of non-volatile memory, media, and memory devices, including, for example, semiconductor memory devices, such as EPROM, EEPROM, and flash memory devices; magnetic disks, such as internal hard disks or removable disks; magneto-optical disks; and CD-ROM and DVD-ROM optical disks. The processor and memory may be supplemented by or incorporated into a dedicated logic circuit.

[0097] Although this document contains many details, these details should not be interpreted as limitations on the scope of the claimed invention or the content that may be claimed, but should be interpreted as descriptions of specific features of specific embodiments. Certain features described in the context of separate embodiments in this document are also implemented in combination in a single embodiment. On the contrary, the various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments. In addition, although the above-mentioned features may be described as working in the form of certain combinations, or even initially claimed as such, in some cases, one or more features in the claimed combination may be deleted from the combination, and the claimed combination may point to a sub-combination or a variant of a sub-combination. Similarly, although the operations are depicted in a particular order in the drawings, this should not be understood as requiring the operations to be performed in the particular order shown or in the order of precedence, or requiring the execution of all illustrated operations to achieve the desired result.

[0098] Only a few examples and implementations are disclosed herein. Variations, modifications and enhancements may be made to the described examples and implementations and other implementations based on what is disclosed.

Claims

1. A method for wireless communication, the method comprising: Receiving, by a network device in a first network, a signal indicating an authentication result associated with a wireless device from a network device in a second network, wherein the signal includes a first key and an indication that the first network is different from the second network; and The network device generates key-related information based on the signal.

2. A method for wireless communication, the method comprising: A signal indicating an authentication result associated with the wireless device is sent from the first network by a network device in the second network, wherein the signal includes a first key and an indication when the first network is different from the second network.

3. A method for wireless communication, the method comprising: In a case where the first network is different from the second network, key-related information is generated by a wireless device in the first network based on the first key and an indication related to the second network.

4. The method according to claim 1 or 3, wherein: The key-related information includes a second key and identification information of the second key.

5. The method according to claim 4, wherein: The second key is generated based on the first key.

6. The method according to claim 4, wherein: The identification information of the second key includes a network identifier and a user temporary identifier.

7. The method according to claim 6, wherein: The user temporary identifier is a 5G globally unique temporary identifier (5G-GUTI).

8. The method according to claim 1, further comprising: the network device sending the key-related information to another device in the network that is a communication device associated therewith.

9. The method according to claim 1 or 2, wherein: The network device is an Authentication Server Function (AUSF).

10. The method according to claim 1 or 2, wherein: The network device is at least one of: 1) a security anchor function (SEAF) or 2) an access and mobility management function (AMF).

11. The method according to claim 3, wherein: The wireless device is a user equipment (UE). 12 . The method according to claim 11 , further comprising: sending, by a second communication device in the second network, the key-related information to another device in the second network.

13. The method according to claim 12, wherein: The second communication device is an Authentication Server Function (AUSF).

14. An apparatus for a communication network, the apparatus comprising: A processor configured to implement the method according to any one of claims 1 to 13.

15. A computer-readable storage medium having stored thereon codes which, when executed by a processor, cause the processor to implement the method according to any one of claims 1 to 13.

Images