Method, entity, and computer-readable medium for non-3GPP access authentication

Abstract

The present disclosure provides a method, an entity, and a computer-readable medium for non-3GPP access authentication. The method (500A) performed by an AAA entity includes receiving an authentication request message from a non-3GPP access element, the authentication request message including an identity of a UE to be authenticated, the identity of the UE including an anonymized identity of the UE or a first identity of the UE (S501A), detecting the identity of the UE from the received authentication request message (S503A), and sending, to an interworking entity, a first request message for authentication credentials, the first request message including at least the detected identity of the UE (S505A).

Description

[Technical field]

[0001] The present disclosure relates generally to the technical field of communications technology, and more particularly to a method, entity, and computer-readable medium for non-3rd Generation Partnership Project (non-3GPP) access authentication. [Background technology]

[0002] This section is intended to provide background for various embodiments of the technology described in this disclosure. The description in this section may include concepts that may be pursued, but not necessarily have been previously conceived or pursued. Thus, unless otherwise indicated herein, what is described in this section is not prior art to the description and / or claims of this disclosure, and is not admitted to be prior art by mere inclusion in this section.

[0003] In addition to native Third Generation Partnership Project (3GPP) access technologies such as Long Term Evolution (LTE), the Evolved Packet System (EPS) also supports access to data communication services and / or Internet services via non-3GPP accesses, including access through home networks such as Home Public Land Mobile Networks (HPLMNs), in particular via non-3GPP access methods / technologies / networks / standards, such as Worldwide Interoperability for Microwave Access (WiMAX) according to standard IEEE 802.16, Wireless Local Area Networks (WLANs) according to standards IEEE 802.11g / n.

[0004] The same is being deployed in 5G systems (5GS).

[0005] However, traditional technical solutions to non-3GPP access authentication in evolved packet core (EPC) and 5G core (5GC) coexistence scenarios have some problems. Summary of the Invention

[0006] In order to at least partially solve the above-mentioned problems in the conventional technical solutions, the present disclosure provides several mechanisms to support retrieval of authentication credentials based on privacy-protected subscriber identity, such as SUCI, in non-3GPP access authentication procedures. The mechanisms may include at least the following: - a stand-alone anonymized identity de-anonymization service enabling an AAA entity (e.g. an AAA server) to obtain a clear-text subscriber identity, i.e. an anonymized identity, from an authenticating entity (e.g. UDM) in the 5GC for NSWO according to baseline procedures, e.g. as specified in the EPC, to proceed with the authentication; - enhancements to Diameter- and UDICOM-based services to enable AAA entities or authenticating entities in the EPC (e.g., HSS) to handle anonymized identities and proceed with authentication over Diameter- and UDICOM-based interfaces, e.g., for NSWO according to baseline procedures as specified in the EPC; - enhancement of UDICOM-based services, whereby an authentication entity in the 5GC can fetch authentication credentials from an authentication entity in the EPC, for example for NSWO following baseline procedures as specified in the EPC, and then pass them to an AAA entity so that the AAA entity can proceed with the authentication; and A scheme in which a UE to be authenticated may determine whether to activate UE identity privacy based on at least one of information from a non-3GPP access element, e.g., a non-3GPP access point (AP), information provided by the UE's home network, or a configuration of the UE.

[0007] According to a first aspect of the present disclosure, there is provided a method implemented by a non-3GPP access element in a non-3GPP access network, the method including transmitting a list of networks, the non-3GPP access element having at least support for UE identity privacy via each of the networks.

[0008] In an example embodiment, the non-3GPP access element further has support for connectivity with an AAA entity for access authentication via each network in the list of networks.

[0009] In an exemplary embodiment, the method further includes receiving an access authentication request message from the UE, the access authentication request message including the UE identification information, and sending the authentication request message including the UE identification information to an AAA entity.

[0010] In an example embodiment, the identity of the UE includes a masked identity of the UE or a first identity of the UE.

[0011] In an example embodiment, the anonymized identity of the UE includes a SUCI of the UE, and the first identity of the UE includes an International Mobile Subscriber Identification (IMSI) of the UE.

[0012] In an example embodiment, the authentication request message further includes an access network identification information of the non-3GPP access network.

[0013] In an exemplary embodiment, the list of networks includes a list of Public Land Mobile Networks (PLMNs) and the AAA entity includes a 3GPP AAA server.

[0014] According to a second aspect of the present disclosure, there is provided a non-3GPP access element in a non-3GPP access network, the non-3GPP access element including at least one processor and at least one memory storing instructions, which when executed on the at least one processor, cause the non-3GPP access element to perform any of the methods according to the first aspect of the present disclosure.

[0015] According to a third aspect of the present disclosure, there is provided a method implemented by a UE, the method including: determining whether UE identity privacy should be used for communication with a non-3GPP access network for the UE, and sending an access authentication request message including an identity of the UE to a non-3GPP access element in the non-3GPP access network according to a result of the determination.

[0016] In an example embodiment, it is determined whether UE identity privacy should be used for communications with the non-3GPP access network for the UE based on at least one of the following: UE configuration, information about non-3GPP access elements in a non-3GPP access network, or Information about the UE's home network.

[0017] In an example embodiment, the method further includes receiving or pre-configuring a configuration for the UE that includes information indicating whether the UE has support for UE identity privacy.

[0018] In an exemplary embodiment, the method further includes receiving, from the non-3GPP access element, information about the non-3GPP access element indicating whether the non-3GPP access element has support for UE identity privacy, wherein the information about the non-3GPP access element includes a list of networks, where the non-3GPP access element has at least support for UE identity privacy via each of the networks.

[0019] In an example embodiment, the non-3GPP access element further has support for connectivity with an AAA entity for access authentication via each network in the list of networks. In an example embodiment, the method further includes receiving, from the home network, information about the home network indicating whether the home network has support for UE identity privacy.

[0020] In an example embodiment, information about the home network, indicating whether the home network has support for UE identity privacy, is conveyed in a UE Parameter Update (UPU) procedure or a Steering of Roaming (SoR) procedure.

[0021] In an example embodiment, the support for UE identity privacy includes support for UE identity privacy for non-3GPP access authentication.

[0022] In an exemplary embodiment, if it is determined that UE identity privacy should be used, the access authentication request message includes a concealed identity of the UE, and if it is determined that UE identity privacy should not be used, the access authentication request message includes that a first identity of the UE should be used.

[0023] In an example embodiment, the concealed identity of the UE includes a SUCI of the UE, and the first identity of the UE includes an IMSI of the UE.

[0024] In an example embodiment, the communication with the non-3GPP access network includes a NSWO from the non-3GPP access network to the UE.

[0025] In an exemplary embodiment, the list of networks includes a list of PLMNs and the AAA entity includes a 3GPP AAA server.

[0026] According to a fourth aspect of the present disclosure, there is provided a UE, the UE including at least one processor and at least one memory storing instructions that, when executed on the at least one processor, cause the UE to perform any of the methods according to the third aspect of the present disclosure.

[0027] According to a fifth aspect of the present disclosure, there is provided a method implemented by an AAA entity, the method including: receiving an authentication request message including a UE identity to be authenticated, including a masked UE identity or a first UE identity, from a non-3GPP access element, detecting the UE identity from the received authentication request message, and sending, to an interworking entity, a first request message for authentication credentials, including at least the detected UE identity.

[0028] In an example embodiment, the first request message for authentication credentials is sent to the interworking entity via the routing entity. In an example embodiment, if the UE identity in the received authentication request message includes a UE anonymized identity, the UE anonymized identity is detected and a first request message for authentication credentials includes the detected UE anonymized identity and is sent to the interworking entity over a Diameter-based interface supporting the UE anonymized identity.

[0029] In an exemplary embodiment, if the UE identity in the received authentication request message includes the UE first identity or the UE's anonymized identity protected with a Null Scheme, the UE first identity is detected, and a first request message for authentication credentials is sent to the interworking entity over a Diameter-based interface that includes the UE first identity and supports the UE first identity.

[0030] In an exemplary embodiment, the method further includes receiving a first response message of authentication credentials from the interworking entity, the message including an authentication method selected by an authentication entity in the 5GC associated with the UE or requested by the authentication entity in the 5GC from an authentication entity in the EPC associated with the UE, an authentication vector generated by the authentication entity in the 5GC or requested by the authentication entity in the 5GC from the authentication entity in the EPC, and a first identification information of the UE obtained from the detected UE identification information.

[0031] In an example embodiment, the concealed identity of the UE includes a SUCI of the UE, and the first identity of the UE includes an IMSI of the UE.

[0032] In an example embodiment, the request message for authentication further includes an access network identification information associated with the non-3GPP access element, and the first request message for authentication credentials further includes an access network identification information associated with the non-3GPP access element.

[0033] According to a sixth aspect of the present disclosure, there is provided a method implemented by an AAA entity, the method including: receiving an authentication request message from a non-3GPP access element, the authentication request message including a masked identity of a UE to be authenticated, detecting the masked identity of the UE from the received authentication request message, and sending an identity request message to an interworking entity, the identity request message including the detected masked identity of the UE.

[0034] In an exemplary embodiment, the identity request message is sent to the interworking entity via a routing entity.

[0035] In an example embodiment, the UE's masked identity includes the UE's SUCI.

[0036] In an example embodiment, the method further includes receiving an identity response message from the interworking entity, the identity response message including a first identity of the UE, the message being converted from a second identity of the UE by the interworking entity and then de-ciphered from the anonymized identity of the UE by an authentication entity in the 5GC associated with the UE, and forwarding the identity response message to an AAA entity.

[0037] In an example embodiment, the identity request message is sent over a Diameter-based interface supporting the masked identity of the UE, and the identity response message is received over the Diameter-based interface.

[0038] In an example embodiment, the method further includes sending a second request message for authentication credentials to an authentication entity in the EPC associated with the UE, the second request message for authentication credentials including at least the received first identification information of the UE, and receiving a second response message for authentication credentials from the authentication entity in the EPC, the message including an authentication method selected by the authentication entity in the EPC or requested by the authentication entity in the EPC from the authentication entity in the 5GC, and an authentication vector generated by the authentication entity in the EPC or requested by the authentication entity in the EPC from the authentication entity in the 5GC.

[0039] In an exemplary embodiment, the first identification information of the UE includes an IMSI of the UE, and the second identification information of the UE includes an International Mobile Subscriber Identity (SUbscription Permanent Identifier) ​​(SUPI) of the UE.

[0040] In an exemplary embodiment, the AAA entity includes a 3GPP AAA server and the routing entity includes a Subscriber Locator Function (SLF) / Diameter Routing Agent (DRA).

[0041] According to a seventh aspect of the present disclosure, there is provided an AAA entity, the AAA entity including at least one processor and at least one memory storing instructions, the instructions, when executed on the at least one processor, causing the AAA entity to perform any of the methods according to the fifth to sixth aspects of the present disclosure.

[0042] According to an eighth aspect of the present disclosure, there is provided a method implemented by a routing entity, the method including: receiving, from an AAA entity, a first request message for authentication credentials including at least an identity of a UE to be authenticated, including a masked identity of the UE or a first identity of the UE, and forwarding the first request message for authentication credentials to an interworking entity.

[0043] In an exemplary embodiment, if the UE identity includes an anonymized identity of the UE, the first request message for authentication credentials is received and forwarded over a Diameter-based interface supporting the anonymized identity of the UE.

[0044] In an exemplary embodiment, if the UE identification information includes a first identification information of the UE, the first request message for authentication credentials is received and forwarded over a Diameter-based interface supporting the first identification information of the UE.

[0045] In an exemplary embodiment, the method further includes receiving a first response message of authentication credentials from the interworking entity, the message including an authentication method selected by an authentication entity in a 5GC associated with the UE or requested by an authentication entity in a 5GC from an authentication entity in an EPC associated with the UE, an authentication vector generated by the authentication entity in the 5GC or requested by the authentication entity in the 5GC from the authentication entity in the EPC, and a first identification information of the UE obtained from the UE identification information, and forwarding the first response message of authentication credentials to an AAA entity.

[0046] In an example embodiment, the concealed identity of the UE includes a SUCI of the UE, and the first identity of the UE includes an IMSI of the UE.

[0047] In an example embodiment, the first request message for authentication credentials further includes access network identification information associated with the non-3GPP access element to which the UE is connected.

[0048] According to a ninth aspect of the present disclosure, there is provided a method implemented by a routing entity, the method including: receiving an identity request message from an AAA entity, the identity request message including a masked identity of a UE to be authenticated; and forwarding the identity request message to an interworking entity.

[0049] In an example embodiment, the UE's masked identity includes the UE's SUCI.

[0050] In an example embodiment, the method further includes receiving an identity response message from the interworking entity, the identity response message including a first identity of the UE, the message being converted from a second identity of the UE by the interworking entity and then de-ciphered from the anonymized identity of the UE by an authentication entity in the 5GC associated with the UE.

[0051] In an exemplary embodiment, the identity request message is received and forwarded over a Diameter-based interface supporting the UE's masked identity, and the UE's identity response message is received and forwarded over a Diameter-based interface.

[0052] In an example embodiment, the method further includes receiving, from the AAA entity, a second request message for authentication credentials of the UE, the second request message including at least the first identification information of the received UE, and forwarding the received second request message for authentication credentials to an authentication entity in an EPC associated with the UE.

[0053] In an exemplary embodiment, the first identity of the UE includes an IMSI of the UE, and the second identity of the UE includes a SUPI of the UE.

[0054] In an exemplary embodiment, the method further includes receiving a second response message of authentication credentials from an authentication entity in the EPC, the message including an authentication method selected by the authentication entity in the EPC or requested by the authentication entity in the EPC from the authentication entity in the 5GC and an authentication vector generated by the authentication entity in the EPC or requested by the authentication entity in the EPC from the authentication entity in the 5GC; and forwarding the received second response message of authentication credentials to the AAA entity.

[0055] In an exemplary embodiment, the routing entity includes an SLF / DRA and the AAA entity includes a 3GPP AAA server.

[0056] According to a tenth aspect of the present disclosure, there is provided a routing entity, the routing entity including at least one processor and at least one memory storing instructions that, when executed on the at least one processor, cause the routing entity to perform any of the methods according to the eighth to ninth aspects of the present disclosure.

[0057] According to an eleventh aspect of the present disclosure, a method is provided that is implemented by an interworking entity, the method including: receiving, from an AAA entity, a first request message for authentication credentials including at least an identity of a UE to be authenticated, where the received identity of the UE includes a masked identity of the UE or a first identity of the UE, selecting an authentication entity in a 5GC associated with the UE based on the received identity of the UE, and sending a fourth request message for authentication credentials to the selected authentication entity in the 5GC.

[0058] In an exemplary embodiment, a first request message for authentication credentials is received from an AAA entity via a routing entity.

[0059] In an exemplary embodiment, the method further includes receiving a fourth response message of authentication credentials from the selected authentication entity in the 5GC, the fourth response message of authentication credentials including at least an authentication method selected by the selected authentication entity in the 5GC or requested by the selected authentication entity in the 5GC from an authentication entity in an EPC associated with the UE, and an authentication vector generated by the selected authentication entity in the 5GC or requested by the selected authentication entity in the 5GC from the authentication entity in the EPC.

[0060] In an example embodiment, if the received UE identity includes an anonymized UE identity, a first request message for authentication credentials is received over a Diameter-based interface supporting the anonymized UE identity, an authentication entity in 5GC is selected based on a routing indicator included in the received UE anonymized identity, a fourth request message for authentication credentials includes at least an indication that the requesting node is an AAA entity and the anonymized UE identity, and the fourth response message for authentication credentials further includes a second identity of the UE that has been de-anonymized by the authentication entity in 5GC from the anonymized UE identity.

[0061] In an example embodiment, if the received UE identity includes a UE first identity, a first request message for authentication credentials is received over a Diameter-based interface supporting the UE first identity, an authentication entity in the 5GC is selected based on the UE first identity, a fourth request message for authentication credentials includes at least an indication that the requesting node is an AAA entity and a UE second identity converted from the UE first identity by the interworking entity, and the fourth response message for authentication credentials further includes the UE second identity.

[0062] In an example embodiment, the fourth request message for authentication credentials further includes an access network identification information associated with the non-3GPP access element to which the UE is connected.

[0063] In an exemplary embodiment, the method further includes sending, to the AAA entity, an authentication credential first response message including the authentication method, the authentication vector, and a first identification information of the UE obtained from the received UE identification information.

[0064] In an example embodiment, the concealed identity of the UE includes a SUCI of the UE, and the first identity of the UE includes an IMSI of the UE.

[0065] According to a twelfth aspect of the present disclosure, there is provided a method implemented by an interworking entity, the method including: receiving an identity request message including a masked identity of a UE to be authenticated from an AAA entity, selecting an authentication entity in 5GC associated with the UE based on the received masked identity of the UE, and sending an identity unmasking request message including the received masked identity of the UE to the selected authentication entity in 5GC.

[0066] In an exemplary embodiment, the identity request message is received from an AAA entity via a routing entity.

[0067] In an exemplary embodiment, the identity request message is received over a Diameter based interface supporting the UE's anonymized identity, and an authentication entity within the 5GC associated with the UE is selected based on a routing indicator included in the received UE's anonymized identity.

[0068] In an example embodiment, the UE's masked identity includes the UE's SUCI.

[0069] In an example embodiment, the method further includes receiving an identity de-ciphering response message from the selected authentication entity in 5GC, the identity de-ciphering response message including a second identity of the UE that has been de-ciphered by the selected authentication entity in 5GC from the anonymized identity of the UE, converting the received second identity of the UE into a first identity of the UE, and sending the identity response message including the first identity of the UE to the AAA entity.

[0070] In an exemplary embodiment, the first identity of the UE includes an IMSI of the UE, and the second identity of the UE includes a SUPI of the UE.

[0071] In an exemplary embodiment, the routing entity includes an SLF / DRA and the AAA entity includes a 3GPP AAA server.

[0072] According to a thirteenth aspect of the present disclosure, there is provided an interworking entity, the interworking entity including at least one processor and at least one memory storing instructions, the instructions, when executed on the at least one processor, causing the interworking entity to perform any of the methods according to the eleventh to twelfth aspects of the present disclosure.

[0073] According to a fourteenth aspect of the present disclosure, a method is provided that is implemented by an authentication entity in a 5GC, the method including: receiving, from an interworking entity, a fourth request message for authentication credentials of a UE to be authenticated, the fourth request message including at least an indication that the requesting node is an AAA entity and an identification information of the UE; and sending, to the interworking entity, a fourth response message for the authentication credentials.

[0074] In an example embodiment, the fourth request message for authentication credentials further includes an access network identification information associated with the non-3GPP access element to which the UE is connected.

[0075] In an example embodiment, the received UE identity includes a masked UE identity, and the method further includes de-masking a second UE identity from the received UE masked identity.

[0076] In an example embodiment, the received UE identification information includes a second identification information of the UE.

[0077] In an exemplary embodiment, the method further includes selecting an authentication method for the UE based at least on the indication that the requesting node is an AAA entity and the second identification information of the UE, and generating an authentication vector for the UE based at least on the second identification information of the UE.

[0078] In an example embodiment, the method further includes sending a fifth request message for authentication credentials to an authentication entity in the EPC, the fifth request message including at least an indication that the requesting node is an AAA entity and an identification information of the UE, and receiving a fifth response message for authentication credentials from the authentication entity in the EPC, the fifth response message including an authentication method for the UE and an authentication vector for the UE.

[0079] In an example embodiment, the concealed identity of the UE includes a SUCI of the UE and the second identity of the UE includes a SUPI of the UE.

[0080] In an example embodiment, the fifth request message for authentication credentials further includes an access network identification information associated with the non-3GPP access element to which the UE is connected.

[0081] According to a fifteenth aspect of the present disclosure, there is provided a method implemented by an authentication entity in a 5GC, the method including: receiving an identity unmasking request message from an interworking entity, the request message including a masked identity of a UE to be authenticated, unmasking a second identity of the UE from the received masked identity of the UE, and sending an identity unmasking response message to the interworking entity, the response message including the second identity of the UE.

[0082] In an example embodiment, the concealed identity of the UE includes a SUCI of the UE and the second identity of the UE includes a SUPI of the UE.

[0083] In an exemplary embodiment, the AAA entity includes a 3GPP AAA server.

[0084] According to a sixteenth aspect of the present disclosure, there is provided an authentication entity in a 5GC. The authentication entity in a 5GC includes at least one processor and at least one memory storing instructions, which, when executed on the at least one processor, cause the authentication entity in a 5GC to perform any of the methods according to the fourteenth to fifteenth aspects of the present disclosure.

[0085] According to a seventeenth aspect of the present disclosure, there is provided a method implemented by an authentication entity in an EPC, the method including: receiving a fifth request message for authentication credentials from an authentication entity in a 5GC associated with a UE to be authenticated, the fifth request message including at least an indication that the requesting node is an AAA entity and a first identification information of the UE, obtaining authentication credentials for the UE, and sending a fifth response message for authentication credentials to the authentication entity in the 5GC, the fifth response message including the obtained authentication credentials for the UE.

[0086] In an exemplary embodiment, the UE authentication credentials include a UE authentication method and a UE authentication vector, and obtaining the UE authentication credentials includes selecting a UE authentication method based at least on an indication that the requesting node is an AAA entity and a first identification information of the UE, and generating a UE authentication vector based at least on the first identification information of the UE.

[0087] In an exemplary embodiment, the first identification information of the UE includes an IMSI of the UE.

[0088] In an example embodiment, the fifth request message for authentication credentials further includes an access network identification information associated with the non-3GPP access element to which the UE is connected.

[0089] In an example embodiment, the method further includes registering with a network repository entity the routing indicators supported by the authentication entity in the EPC.

[0090] In an exemplary embodiment, the AAA entity includes a 3GPP AAA server.

[0091] According to an eighteenth aspect of the present disclosure, there is provided an authentic entity within an EPC, the authentic entity within the EPC including at least one processor and at least one memory storing instructions that, when executed on the at least one processor, cause the authentic entity within the EPC to perform any of the methods according to the seventeenth aspect of the present disclosure.

[0092] According to a nineteenth aspect of the present disclosure, there is provided a computer-readable storage medium having stored thereon computer program instructions which, when executed by at least one processor, cause the at least one processor to perform a method according to any of the first, third, fifth to sixth, eighth to ninth, eleventh to twelfth, fourteenth to fifteenth, and seventeenth aspects of the present disclosure.

[0093] The technical solution of the present disclosure may enable non-3GPP access authentication with minimal / no impact on existing access networks, e.g., Wi-Fi and 5GC, and provide support for retrieval of authentication credentials based on a hidden identity, e.g., SUCI, of the UE to be authenticated in the non-3GPP access authentication procedure. In particular, the technical solution of the present disclosure may at least support: Handling anonymized identities in AAA entities (e.g., AAA servers); In the case of EPC coexistence, handling of anonymized identification information through UDICOM, Handling the retrieval of authentication credentials from an authenticating entity in the 5GC (e.g., UDM) to an authenticating entity in the EPC (e.g., HSS); and Determining the use of masked identity information in a UE to be authenticated, etc.

[0094] The objects, advantages and features of the present disclosure will become more apparent following the description of the preferred embodiments in conjunction with the drawings. [Brief description of the drawings]

[0095] [Figure 1] FIG. 1 is a schematic diagram illustrating an example non-roaming architecture in an EPS supporting 3GPP and non-3GPP accesses. [Diagram 2] FIG. 1 is a schematic diagram illustrating an exemplary non-3GPP access authentication architecture in 5GC with EPS coexistence to which exemplary embodiments of the present disclosure are applied. [Diagram 3] 1 is a schematic diagram illustrating an example method implemented by a non-3GPP access element in a non-3GPP access network according to an example embodiment of the present disclosure. [Figure 4] 1 is a schematic diagram illustrating an example method implemented by a UE according to an example embodiment of the present disclosure. [Figure 5A] FIG. 2 is a schematic diagram illustrating an exemplary method implemented by an entity of an AAA according to a first exemplary embodiment of the present disclosure; [Figure 5B] FIG. 11 is a schematic diagram illustrating an exemplary method implemented by an AAA entity according to a second exemplary embodiment of the present disclosure; [Figure 5C] FIG. 13 is a schematic diagram illustrating an exemplary method implemented by an AAA entity according to a third exemplary embodiment of the present disclosure. [Figure 6A] FIG. 2 is a schematic diagram illustrating an exemplary method implemented by a routing entity according to a first exemplary embodiment of the present disclosure; [Figure 6B] FIG. 11 is a schematic diagram illustrating an exemplary method implemented by a routing entity according to a second exemplary embodiment of the present disclosure; [Figure 6C] FIG. 13 is a schematic diagram illustrating an exemplary method implemented by a routing entity according to a third exemplary embodiment of the present disclosure; [Figure 7A]FIG. 2 is a schematic diagram illustrating an exemplary method implemented by an interworking entity according to a first exemplary embodiment of the present disclosure; [Figure 7B] FIG. 11 is a schematic diagram illustrating an exemplary method implemented by an interworking entity according to a second exemplary embodiment of the present disclosure; [Figure 8A] FIG. 1 is a schematic diagram showing an exemplary method performed by an authentication entity in a 5GC according to a first exemplary embodiment of the present disclosure. [Figure 8B] A schematic diagram showing an exemplary method performed by an authentication entity within 5GC according to a second exemplary embodiment of the present disclosure. [Figure 8C] A schematic diagram showing an exemplary method performed by an authentication entity within a 5GC according to a third exemplary embodiment of the present disclosure. [Figure 9A] FIG. 2 is a schematic diagram illustrating an exemplary method performed by an authentication entity in an EPC according to a first exemplary embodiment of the present disclosure. [Figure 9B] FIG. 13 is a schematic diagram illustrating an exemplary method performed by an authentication entity in an EPC according to a third exemplary embodiment of the present disclosure. [Figure 10A] 1 is a schematic diagram of an exemplary signaling sequence for non-3GPP access authentication according to a first exemplary embodiment of the present disclosure, to which the methods of FIGS. 3, 4, 5A, 6A, 7A, 8A and 9 are applied. [Figure 10B] 11 is a schematic diagram of an exemplary signaling sequence for non-3GPP access authentication according to a second exemplary embodiment of the present disclosure, to which the methods of FIGS. 3, 4, 5B, 6B, 7B and 8B are applied. [Figure 10C] 3C is a schematic diagram of an exemplary signaling sequence for non-3GPP access authentication according to a third exemplary embodiment of the present disclosure, to which the methods of FIGS. 3, 4, 5C, 6C, 8C and 9B are applied. [Figure 11] 2 is an exemplary structural block diagram of a non-3GPP access element according to any of the first to third exemplary embodiments of the present disclosure. [Figure 12]1 is another exemplary structural block diagram of a non-3GPP access element according to any of the first to third exemplary embodiments of the present disclosure. [Figure 13] 1 is an exemplary structural block diagram of a UE according to any of the first to third exemplary embodiments of the present disclosure. [Figure 14] 1 is an exemplary structural block diagram of a UE according to any of the first to third exemplary embodiments of the present disclosure. [Figure 15] 1 is an exemplary structural block diagram of an entity for AAA according to any of the first to third exemplary embodiments of the present disclosure; [Figure 16] 13 is another exemplary structural block diagram of an entity for AAA according to any of the first to third exemplary embodiments of the present disclosure; [Figure 17A] 4 is an exemplary structural block diagram of a routing entity according to any of the first to second exemplary embodiments of the present disclosure; [Figure 17B] 13 is an exemplary structural block diagram of a routing entity according to a third exemplary embodiment of the present disclosure; [Figure 18] 13 is another exemplary structural block diagram of a routing entity according to any of the first to third exemplary embodiments of the present disclosure; [Figure 19] 1 is an exemplary structural block diagram of an interworking entity according to either the first or second exemplary embodiment of the present disclosure; [Figure 20] 13 is another exemplary structural block diagram of an interworking entity according to either the first or second exemplary embodiment of the present disclosure; [Figure 21A] 1 is an exemplary structural block diagram of an authentication entity in 5GC according to a first exemplary embodiment of the present disclosure; [Figure 21B] FIG. 11 is an exemplary structural block diagram of an authentication entity within a 5GC according to either the second or third exemplary embodiment of the present disclosure. [Figure 22] Another exemplary structural block diagram of an authentication entity in a 5GC according to any of the first to third exemplary embodiments of the present disclosure. [Figure 23A] 1 is an exemplary structural block diagram of an authentication entity in an EPC according to a first exemplary embodiment of the present disclosure; [Figure 23B] 13 is an exemplary structural block diagram of an authentication entity in an EPC according to a third exemplary embodiment of the present disclosure; [Figure 24] FIG. 13 is another exemplary structural block diagram of an authentication entity in an EPC according to any of the first and third exemplary embodiments of the present disclosure; DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0096] It should be noted that the same or similar reference numbers are used throughout the drawings to designate the same or similar elements, and that the various portions in the drawings are not drawn to scale, are for illustrative purposes only, and therefore should not be understood as a limitation or restriction on the scope of the present disclosure.

[0097] The principles and spirit of the present disclosure will now be described with reference to exemplary embodiments. Some of the embodiments contemplated herein will now be further described with reference to the accompanying drawings. However, other embodiments are included within the scope of the subject matter disclosed herein, and the subject matter disclosed should not be construed as being limited to only the embodiments described herein, but rather, these embodiments are provided as examples to convey the scope of the subject matter to those skilled in the art.

[0098] Those skilled in the art will appreciate that the term "exemplary" is used herein to mean "illustrative" or "serving as an example" and is not intended to suggest that a particular embodiment is preferred over another, or that a particular feature is essential. Similarly, the terms "first" and "second," and similar terms, are used merely to distinguish one particular example of an item or feature from another, and do not imply a particular order or arrangement unless otherwise indicated by the context. Furthermore, the term "step," as used herein, is intended to be synonymous with "operation" or "action." Any description of a sequence of steps herein does not imply that these operations must be performed in a particular order, or even that these operations may be performed in any order, unless otherwise indicated by the context or details of the operation being described.

[0099] References herein to "one embodiment," "an embodiment," "an example embodiment," and the like indicate that the embodiment being described includes a particular feature, structure, or characteristic, but that not all embodiments necessarily include the particular feature, structure, or characteristic. Moreover, such phrases do not necessarily refer to the same embodiment. Furthermore, when a particular feature, structure, or characteristic is described in connection with one embodiment, it is submitted that it is within the knowledge of one of ordinary skill in the art to affect such feature, structure, or characteristic in connection with other embodiments, whether or not explicitly described.

[0100] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of example embodiments. As used herein, the singular forms "a," "an," and "the" are intended to include the plural unless the context clearly dictates otherwise. It will be further understood that the terms "comprises," "comprising," "has," "having," "including," and / or "including," as used herein, specify the presence of stated features, elements, and / or components, etc., but do not exclude the presence or addition of one or more other features, elements, components, and / or combinations thereof.

[0101] As used herein, the term "and / or" includes any and all combinations of one or more of the associated listed terms.

[0102] In the following description and claims, unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs.

[0103] As used herein, the term "network" refers to a network conforming to any suitable (wireless or wired) communications standard. For example, wireless communications standards may include New Radio (NR), Long Term Evolution (LTE), LTE-Advanced, Wideband Code Division Multiple Access (WCDMA), High Speed ​​Packet Access (HSPA), Code Division Multiple Access (CDMA), Time Division Multiple Address (TDMA), Frequency Division Multiple Access (FDMA), Orthogonal Frequency Division Multiple Access (OFDMA), Single Carrier Frequency Division Multiple Access (SC-FDMA), and other wireless networks. A CDMA network may implement a radio technology such as Universal Terrestrial Radio Access (UTRA). UTRA includes WCDMA and other variants of CDMA. A TDMA network may implement a radio technology such as Global System for Mobile Communications (GSM). An OFDMA network may implement a wireless technology such as Enhanced UTRA (E-UTRA), Ultra Mobile Broadband (UMB), IEEE 802.11 (Wi-Fi), IEEE 802.16 (WiMAX), IEEE 802.20, Flash-OFDMA, ad-hoc networks, wireless sensor networks, etc. In the following description, the terms "network" and "system" may be used interchangeably.

[0104] Furthermore, communication between two devices of the network may be performed according to any suitable communication protocol, including, but not limited to, a wireless communication protocol, such as defined by a standardization organization such as 3GPP, or a wired communication protocol. For example, the wireless communication protocol may include first generation (1G), 2G, 3G, 4G, 4.5G, 5G communication protocols, and / or any other protocol now known or hereafter developed.

[0105] The term "entity" or "network entity" as used herein refers to a network device or a network node or a network function of a communication network, and may also refer to a virtualized entity that may be realized on a cloud. For example, in a wireless communication network, such as a 3GPP type cellular network, a core network device may provide a number of services to customers interconnected by access network devices. Each access network device may be connectable to the core network device through a wired or wireless connection.

[0106] The term "CN entity" refers to any suitable function that can be realized in a network entity (physical or virtual) of a communication network. For example, a network entity can be realized as a network element on dedicated hardware, or as a software instance running on dedicated hardware, or as a virtualized function instantiated on a suitable platform, e.g., a cloud infrastructure. For example, a 5G Core Network System (5GC) may include multiple functions, such as AMF, SMF, UDM (Unified Data Management), PCF (Policy Control Function), UPF (User Plane Function), NRF (Network Repository Function), etc. For example, a 4G Core Network System (such as EPC) may include MME, HSS (Home Subscriber Server), P-GW, BM-SC, etc. In other embodiments, a CN entity may include different types of functions, e.g., depending on the particular network.

[0107] As mentioned above, the EPS supports access to data communication services and / or Internet services via non-3GPP accesses, including, in addition to native 3GPP access technologies such as LTE, e.g. WiMAX according to standard IEEE 802.16, WLAN, e.g. according to standard IEEE 802.11g / n, in particular via non-3GPP access methods / technologies / networks / standards, including access through home networks, e.g. HPLMN.

[0108] Non-3GPP access may be understood to mean access using access technologies whose specifications are outside the scope of 3GPP. There are two categories of non-3GPP access: trusted non-3GPP access and untrusted non-3GPP access (also called "untrusted" non-3GPP access).

[0109] FIG. 1 illustrates generally an exemplary non-roaming architecture within an EPS supporting 3GPP as well as non-3GPP accesses, as specified in 3GPP TS 23.402 v16.0.0, “Architecture enhancement for Non-3GPP accesses,” which is incorporated herein by reference in its entirety.

[0110] In the case of 3GPP access, the 3GPP access point ("3GPP access" in FIG. 1) authenticates the user equipment (UE) via the S6a reference point (also referred to herein as the "interface") with a Home Subscriber Server (HSS), which is an example of an authentication entity in the EPC. After successful authentication, the 3GPP access point establishes IP connectivity to the UE via the Evolved Packet Core (EPC), i.e., connected to the operator's IP services via the S5 and SGi reference points.

[0111] In case of trusted non-3GPP access, the trusted non-3GPP access point ("Trusted Non-3GPP IP Access" in Figure 1) authenticates the UE with the HSS using a 3GPP Authentication, Authorization, and Accounting (AAA) server as an example of an AAA entity, i.e. via the STa and SWx reference points. After successful authentication, the trusted non-3GPP access point establishes IP connectivity through the EPC, i.e. is connected to the operator's IP services via the S2a and SGi reference points.

[0112] In case of untrusted non-3GPP access, an untrusted non-3GPP access point ("Untrusted Non-3GPP IP Access" in Fig. 1) is connected to the Evolved Packet Core (EPC) through an Evolved Packet Data Gateway (ePDG) via a 3GPP AAA server. In case of untrusted access, the UE and the ePDG shall perform mutual authentication during Internet Protocol Security (IPsec) tunnel establishment between the UE and the ePDG through the SWu reference point. The UE is connected to the ePDG through the SWu reference point, and the ePDG authenticates the UE by the HSS with the 3GPP AAA server, i.e., through the SWm and SWx reference points. After successful authentication, the ePDG establishes an IP connection to the operator's IP services through the EPC, i.e., through the S2b and SGi reference points.

[0113] The commonality of the above three types of access is that authentication related information (e.g., Authentication and Key Agreement (AKA) Authentication Vector (AV) for Extensible Authentication Protocol (EAP)-AKA or EAP-AKA') is fetched from the HSS in the EPC to authenticate the UE, and after successful authentication, IP connectivity is established for the UE through the EPC, and the operator's IP services may be connected via the SGi reference point, whether the previous reference point was S5 (for 3GPP access), S2a (for trusted non-3GPP access), or S2b (for untrusted non-3GPP access).

[0114] In addition, the non-3GPP access network may also provide an "offload" function, i.e., directly connected to the Internet via the non-3GPP access network without establishing a data connection through the EPC, e.g., non-seamless WLAN offload (NSWO).

[0115] In the example of Figure 1, for example, before an IPsec tunnel establishment between the UE and the ePDG can be performed, for the purpose of offloading from the untrusted non-3GPP access network, the UE needs to obtain IP connectivity across the access network, which may require an additional access authentication, which is independent of the EAP-AKA authentication in conjunction with the IPsec tunnel establishment through the ePDG, and which requires security of the untrusted non-3GPP access network, may be achieved through the SWa reference point.

[0116] The SWa reference point carries information related to access authentication, authorization, and charging in a secure format. The 3GPP AAA server fetches information related to authentication (e.g., AKA AV for EAP-AKA or EAP-AKA'), subscription, and packet data network (PDN) connection data from the HSS of the EPC via the SWx reference point.

[0117] After successful authentication of the UE via the SWa and SWx reference points, the UE connects to, for example, the Internet via an untrusted non-3GPP access network rather than establishing a data connection through the EPC, i.e., offloads to the untrusted non-3GPP access network.

[0118] A typical use of this additional access authentication is for Wi-Fi access authentication, for example, in stadiums, hotels, coffee shops, etc. This is where only SWa with 3GPP AAA servers are used, and mobility and PDN connectivity services are not required from the EPC (i.e., ePDG / SWm is not required). This deployment allows the UE to connect to a non-3GPP access network (e.g., WLAN) using Subscriber Identity Mobile (SIM)-based access authentication via the mobile network core, and offload selected traffic to the non-3GPP access network.

[0119] This is a feature deployed in 4G networks that allows the use of mobile network subscription and roaming agreements for non-3GPP access and for offloading selected traffic to non-3GPP access networks when the selection of traffic to offload is policy based and when the offloaded traffic does not use 3GPP specified entities.

[0120] 3GPP has approved a study item "New SID on Non Seamless WLAN Offload in 5GC using 3GPP credentials" (3GPP TSG-SA Meeting #91-e e-meeting, March 18-29, 2021, SP-210262, incorporated herein by reference in its entirety) that enables deployment characteristics in 5G systems (5GS) that are similar to those in EPC. The objectives as specified in the Study Item Description (SID) are: - Solution to support NSWO on 5GS - Instructions for supporting authentication methods for each solution in Objective 1 - Maintaining privacy of subscription identifiers even in case of NSWO authentication from WLAN.

[0121] PCT Application No. PCT / CN2020 / 136618, filed Dec. 15, 2020, proposes several alternatives for supporting non-3GPP access authentication, which are incorporated herein by reference in their entirety. Alternatives may include: - Alternative 1) SWa / SWx interwork with authentication entities in the 5G Core (5GC), e.g. Unified Data Management (UDM), via an interworking / proxy entity, e.g. AAA Interworking Function (IWF), and supporting EPC coexistence. - Alternative 2) SWa / SWx interworks with another authentication entity in 5GC, e.g. Authentication Server Function (AUSF), and e.g. UDM via EPC coexistence. - Alternative 3) SWa interworks with, for example, AUSF via, for example, AAA-IWF and EPC coexistence. - Alternative 4) Deploy a Trusted Wireless Local Area Interworking Function (TWIF) as a non-3GPP access point - Alternative 5) Deploy a Trusted Non-3GPP Gateway Function (TNGF) as a non-3GPP access point

[0122] However, with respect to alternative 1) SWa / SWx interworking with an authentication entity in 5GC via an interworking entity and EPC coexistence, the conventional technical solutions cannot support retrieval of authentication credentials based on a privacy-protected subscriber identity (also referred to as an "anonymized identity" throughout this specification), such as a subscription anonymized identifier (SUCI), in a non-3GPP access authentication procedure. For example, the conventional technical solutions cannot handle a privacy-protected subscriber identity in an AAA entity, such as an AAA server, cannot handle a privacy-protected subscriber identity through User Data Interworking, Coexistence, and Migration (UDICOM) for the case of EPC coexistence, cannot handle retrieval of authentication credentials from an authentication entity in 5GC (e.g., UDM) to an authentication entity in EPC (e.g., HSS), cannot determine the use of a privacy-protected subscriber identity in a UE to be authenticated, etc.

[0123] Therefore, this disclosure designs several mechanisms to support retrieval of authentication credentials based on privacy-preserving subscriber identity in non-3GPP access authentication procedures.

[0124] The present disclosure may be applied to non-3GPP access authentication architectures in 5GC where EPS coexists.

[0125] FIG. 2 illustrates an exemplary non-3GPP access authentication architecture in 5GC with EPS coexistence, to which exemplary embodiments of the present disclosure may be applied.

[0126] As shown in FIG. 2, the 3GPP AAA, also called "3GPP AAA server" (an example of an AAA entity), may request authentication credentials (e.g., AV for EAP AKA / EAP AKA', or simply referred to as "AV") of the UE to be authenticated from the HSS (an authentication entity in the EPC) through a SWx / SWx' interface (an example of a Diameter-based interface, where SWx is an example of a Diameter-based interface supporting a cleartext identity of the UE, e.g., IMSI, and SWx' is an example of a Diameter-based interface supporting a masked identity of the UE, e.g., SUCI). If the authentication vector generation function of the UE is deployed in the HSS, the HSS may provide the AV to the 3GPP AAA. If the authentication vector generation function of the UE has been moved to the UDM / Authentication Credentials Repository and Processing Function (ARPF), the HSS may request the AV from the UDM / ARPF through a UDICOM NU1 interface.

[0127] Alternatively, the 3GPP AAA may request authentication credentials (e.g., EAP AKA / EAP AKA' AV) from the UDM / ARPF (an example of an authentication entity in 5GC) via the AAA-IWF (an example of an interworking entity) through the SWx / SWx' interface between the 3GPP AAA and the AAA-IWF / NSSAAF and the N59 interface between the AAA-IWF / NSSAAF and the UDM / ARPF. The AAA-IWF may be realized by a network slice specific authentication and authorization function (NSSAAF) and may therefore also be represented as "AAA-IWF / NSSAAF". If the authentication vector generation function of the UE is deployed in the UDM / ARPF, the UDM / ARPF may provide the AV to the 3GPP AAA. If the authentication vector generation function of the UE has moved to the HSS, the UDM / ARPF may request the AV from the HSS through the UDICOM NU1 interface.

[0128] In a scenario where the home network supports a mix of 4G-only users, 5G users supporting interworking with the EPC, and 5G-only users, the SLF / DRA (an example of a routing entity) may assist in routing authentication vector requests from the 3GPP AAA via the AAA-IWF / NSSAAF towards the HSS (for 4G-only users, 5G users supporting interworking with the EPC) or towards the UDM / ARPF (for 5G-only users).

[0129] The 3GPP AAA may send the authentication vector request over a Diameter-based interface (e.g., SWx' interface) that supports a hidden identity (e.g., SUCI) instead of the UE's cleartext identity (e.g., IMSI).

[0130] The SLF / DRA may also assist in routing authentication vector requests (sometimes referred to as "Diameter commands") over a Diameter-based interface towards the UDM / ARPF via the AAA-IWF / NSSAAF, for example based on a Diameter command or the UE's identity (e.g., SUCI or IMSI).

[0131] The basic concepts of this disclosure mainly consist of the following: - a stand-alone de-anonymization service of the anonymized identity, enabling an AAA entity (e.g. an AAA server) to obtain a clear-text subscriber identity, i.e. an un-anonymized identity, from an authentication entity (e.g. UDM) in the 5GC, for example for NSWO after the baseline procedure as specified in the EPC, and to proceed with the authentication; - enhancements to Diameter-based and UDICOM-based services to enable AAA entities or EPC authentication entities (e.g. HSSs) to handle anonymized identities and proceed with authentication over Diameter-based and UDICOM interfaces, e.g. for NSWO after baseline procedures as specified in the EPC; - enhancement of UDICOM-based services to enable the authentication entity in the 5GC to fetch authentication credentials from the authentication entity in the EPC and then pass them to the AAA entity to proceed with the authentication, for example for NSWO after the baseline procedure as specified in the EPC; and A scheme in which a UE to be authenticated may determine whether to activate UE identity privacy based on at least one of, for example, information from a non-3GPP access element, e.g. a non-3GPP AP, information provided by the UE's home network, or a configuration of the UE.

[0132] In particular, the present disclosure relates to improvements to non-3GPP access elements, the UE to be authenticated, and various (CN) entities involved in the UE non-3GPP access authentication procedure in scenarios where 4G-only users, 5G users supporting interworking with the EPC, and 5G-only users are supported.

[0133] The improvements proposed by the present disclosure to the non-3GPP access element, the UE to be authenticated, and various (CN) entities involved in the UE non-3GPP access authentication procedure are described in detail below in the following exemplary embodiments with reference to Figures 3 to 24.

[0134] 3 illustrates an example method 300 implemented by a non-3GPP access element in a non-3GPP access network for access authentication of a UE according to an example embodiment of the present disclosure. For example, the non-3GPP access element may be an untrusted non-3GPP AP, such as a WLAN AP or a WLAN gateway.

[0135] As shown in FIG. 3, in step S301, the non-3GPP access element may transmit, eg, broadcast, a list of networks as specified in clause 6.3.12 of 3GPP TS 23.501 v17.1.1, which is incorporated herein by reference in its entirety.

[0136] In addition to supporting connectivity with an AAA entity, such as a 3GPP AAA server, for access authentication, the non-3GPP access element may also support UE identity privacy over the networks in the list.

[0137] For example, the list of networks may be a list of PLMNs that support not only AAA connectivity for access authentication, but also UE identity privacy, eg, for non-3GPP access authentication.

[0138] When the UE selects a non-3GPP access network, i.e., a non-3GPP access element, and selects a network in the list (e.g., a PLMN) through which the non-3GPP access element will broadcast to perform 3GPP-based access authentication, the UE may determine whether UE identity privacy should be used for communications with the non-3GPP access network.

[0139] Thus, in method 300, if the UE determines that UE identity privacy should be used, the non-3GPP access element may receive an access authentication request message (e.g., an EAP Response / Identity message) from the UE that includes the UE's anonymized identity, e.g., SUCI. The received UE's anonymized identity may conform to a Network Access Identifier (NAI) format as specified in 3GPP TS 23.003 v17.2.0.

[0140] Otherwise, if the UE determines that UE identity privacy should not be used, the non-3GPP access element may receive an access authentication request message from the UE, including the UE's cleartext identity (also referred to throughout this specification as "first identity"), e.g., an IMSI.

[0141] The method 300 may then send an authentication message to the appropriate entity in the AAA based on the realm portion of the NAI, for example, as specified in 3GPP TS 33.402 v16.0.0.

[0142] The authentication request message sent by the non-3GPP access element may include the UE's identity information obtained from the received access authentication request message. Alternatively, the authentication request message may also include the access network identity information, such as an ANID, of the non-3GPP access network.

[0143] In response to the above, Figure 4 illustrates an exemplary method 400 implemented by a UE for access authentication according to an exemplary embodiment of the present disclosure. It should be understood that the method 400 implemented by the UE corresponds at least in part to the method 300 implemented by a non-3GPP access element. Therefore, a description of some of the method 400 may refer to the description of the method 300 as described above, and is therefore omitted here for simplicity.

[0144] As described above, the UE may select a non-3GPP access network, i.e., a non-3GPP access element, and select a network (e.g., a PLMN) in the list through which the non-3GPP access element will broadcast to perform 3GPP-based access authentication.

[0145] Next, in step S401, the UE may determine whether to use UE identity privacy for communication with the selected non-3GPP access network. In an exemplary embodiment, the communication with the non-3GPP access network may include an NSWO from the non-3GPP access network for the UE.

[0146] In an example embodiment, the UE may determine whether UE identity privacy should be used for communications with a non-3GPP access network for the UE based on at least one of the following: UE configuration, information about non-3GPP access elements in a non-3GPP access network, or Information about the UE's home network.

[0147] In an example embodiment, the UE may obtain the UE configuration by receiving or pre-configuring the UE configuration, which may include information indicating whether the UE supports UE identity privacy.

[0148] In an example embodiment, the UE may obtain information about the non-3GPP access element by receiving, from the non-3GPP access element, information about the non-3GPP access element indicating whether the non-3GPP access element supports UE identity privacy. The information about the non-3GPP access element may include a list of networks, e.g., a list of PLMNs, through which the non-3GPP access element may support UE identity privacy as well as connectivity with an AAA entity, e.g., a 3GPP AAA server, for access authentication, as described above.

[0149] In an example embodiment, the UE may obtain information about the UE's home network by receiving information about the home network from the home network indicating whether the home network supports UE identity privacy.

[0150] The information about the home network, indicating whether the home network supports UE identity privacy or not, may be conveyed by the UE UPU procedure or the SoR procedure as specified in 3GPP TS 33.501 v17.2.1.

[0151] The support for UE identity privacy may include support for UE identity privacy for non-3GPP access authentication.

[0152] After the UE determines whether to use UE identity privacy, the UE may send an access authentication request message to the non-3GPP access element according to the result of the determination in step S403. The access authentication request message may include the UE's identity. The UE may send its identity in accordance with the NAI format as specified in 3GPP TS 23.003 v17.2.0.

[0153] In particular, if the UE determines that UE identity privacy should be used, the access authentication request message may include the UE's masked identity at the NAI, for example, the SUCI.

[0154] Otherwise, if the UE determines that UE identity privacy should not be used, the access authentication request message may include the UE's first identity, for example, IMSI, at the NAI.

[0155] After the non-3GPP access element sends an authentication request message including the UE's identity to an AAA entity, in a scenario where 4G-only users, 5G users supporting interworking with the EPC, and 5G-only users are supported, various (CN) entities may cooperate to perform non-3GPP access authentication of the UE.

[0156] With regard to methods implemented by various (CN) entities for non-3GPP access authentication of a UE in scenarios where 4G-only users, 5G users supporting interworking with the EPC, and 5G-only users are supported, the present disclosure proposes at least three exemplary embodiments, exemplary signaling sequence diagrams of which are shown in Figures 10A to 10C, respectively, which are described in detail below.

[0157] It can be appreciated that the methods implemented by the UE and the non-3GPP access element, as described above with reference to Figures 3 and 4, are the same for at least three example embodiments.

[0158] In a first exemplary embodiment, the UE's authentication credentials (e.g., authentication method, authentication vector, etc.) may be retrieved from an authentication entity in the 5GC via an interworking entity.

[0159] Hereinafter, a method for non-3GPP access authentication of a UE according to a first exemplary embodiment, which is performed by an AAA entity, a routing entity, an interworking entity, an authentication entity in the 5GC, and an authentication entity in the EPC, will be described with reference to Figures 5A, 6A, 7A, 8A, and 9A, respectively.

[0160] 5A illustrates an exemplary method 500A implemented by an AAA entity according to a first exemplary embodiment of the present disclosure. It should be understood that the AAA entity may be a 3GPP AAA server or any other entity that may be configured to implement the method 500A as described below, including a virtualization entity that may be implemented on a cloud.

[0161] In step S501A, the AAA entity may receive an authentication request message from a non-3GPP access element.

[0162] The authentication request message received from the non-3GPP access network may include an identity of the UE to be authenticated. As mentioned above, the UE identity may include a concealed identity of the UE, e.g., a SUCI, or a first identity of the UE, e.g., an IMSI, depending on the result of the UE's decision on whether to use UE identity privacy for communication with the non-3GPP access network, and may be included in the NAI conveyed by the access authentication request message from the UE to the non-3GPP access network and / or by the authentication request message from the non-3GPP access network to the AAA entity.

[0163] As mentioned above, the authentication request message may also include the access network identification information of the non-3GPP access network, for example, an ANID.

[0164] Then, the AAA entity may detect the identity of the UE from the received authentication request message in step S503A.

[0165] If the UE identity in the received authentication request message includes the UE's anonymized identity, for example, SUCI, the UE's anonymized identity may be detected by the AAA entity.

[0166] If the UE identity in the received authentication request message includes a first identity of the UE, e.g., an IMSI, or a concealed identity of the UE protected by a null scheme, e.g., a SUCI, the first identity of the UE, e.g., the IMSI, may be detected by the AAA entity.

[0167] Then, the AAA entity may send a first request message for authentication credentials to the interworking entity in step S505A. The first request message for authentication credentials may include at least the identification information of the detected UE.

[0168] If the detected UE identity is a UE anonymized identity, e.g., SUCI, then a first request message for authentication credentials may be sent to an interworking entity over a Diameter-based interface, e.g., an enhanced SWx interface (represented by SWx'), that supports the UE anonymized identity (e.g., SUCI).

[0169] For example, the first request message for authentication credentials may be an enhanced SWx message, such as Multimedia-Auth-Request / Multimedia-Auth-Answer, as specified in 3GPP TS 33.402 v16.0.0.

[0170] If the detected UE identity is a first identity of the UE, e.g., an IMSI, the first request message for authentication credentials may be sent to an interworking entity over a Diameter-based interface, e.g., an existing SWx interface, that supports the first identity of the UE (e.g., IMSI).

[0171] Alternatively, the first request message for authentication credentials may further include an access network identification information of the non-3GPP access network, such as an ANID.

[0172] In an example embodiment, the first request message for authentication credentials is sent to an interworking entity via a routing entity, for example, an SLF / DRA.

[0173] It can be understood that the routing entity may be optional: if there is no separate routing entity, the corresponding routing function may be realized by an entity of the AAA.

[0174] After the interworking entity obtains authentication credentials from an authentication entity in the 5GC, the AAA entity may receive a first response message of the authentication credentials from the interworking entity.

[0175] The first response message of the authentication credentials may include: An authentication method, e.g. EAP AKA / EAP AKA', selected by an authentication entity in the 5GC associated with the UE or requested by an authentication entity in the 5GC from an authentication entity in the EPC associated with the UE An authentication vector generated by an authenticating entity in the 5GC or requested by an authenticating entity in the 5GC from an authenticating entity in the EPC A first identity of the UE, for example an IMSI, obtained from the identity of the detected UE.

[0176] Details on the authentication method, the UE's authentication vector, and how to obtain authentication credentials such as the UE's first identification information, e.g., IMSI, are described below with reference to FIG. 7A in a method 700A performed by an interworking entity, and with reference to FIG. 8A in a method 800A performed by an authentication entity in the 5GC.

[0177] 6A illustrates an exemplary method 600A implemented by a routing entity according to a first exemplary embodiment of the present disclosure. It should be understood that the routing entity may be an SLF / DRA or any other entity that may be configured to implement the method 600A as described below, including a virtualization entity that may be implemented on a cloud.

[0178] It should be understood that the method 600A implemented by the routing entity corresponds at least in part to the method 500A implemented by the AAA entity. Therefore, some descriptions of the method 600A may refer to the description of the method 500A as described above, and thus are omitted here for simplicity.

[0179] In step S601A, the routing entity may receive a first request message for authentication credentials from an AAA entity, for example a 3GPP AAA server.

[0180] As mentioned above, the first request message for authentication credentials may include at least an identity of the UE to be authenticated. The identity of the UE may include a masked identity of the UE, such as the SUCI, or a first identity of the UE, such as the IMSI.

[0181] Alternatively, the first request message for authentication credentials may further include an access network identification information of the non-3GPP access network, such as an ANID.

[0182] In step S603A, the routing entity may forward the first request message for authentication credentials to an interworking entity, for example, to the AAA-IWF / NSSAAF. That is, the routing entity may assist in routing a first request message for authentication credentials via an interworking entity towards an authentication entity within the 5GC.

[0183] If the UE identity includes an anonymized identity, e.g., SUCI, of the UE, the first request message for authentication credentials may be received and forwarded over a Diameter-based interface, e.g., an SWx' interface, that supports the anonymized identity, e.g., SUCI, of the UE.

[0184] If the UE identity includes a first identity of the UE, e.g., an IMSI, the first request message for authentication credentials may be received and forwarded over a Diameter-based interface, e.g., an SWx interface, that supports the first identity of the UE, e.g., the IMSI.

[0185] After the interworking entity obtains the authentication credentials from the authentication entity in the 5GC, the routing entity may receive a first response message for the authentication credentials from the interworking entity and forward the first response message for the authentication credentials to the AAA entity.

[0186] As described above, the first response message of the authentication credentials may include: An authentication method, e.g. EAP AKA / EAP AKA', selected by an authentication entity in the 5GC associated with the UE or requested by an authentication entity in the 5GC from an authentication entity in the EPC associated with the UE An authentication vector generated by an authenticating entity in the 5GC or requested by an authenticating entity in the 5GC from an authenticating entity in the EPC, and A first identity of the UE, for example an IMSI, obtained from the identity of the UE.

[0187] As mentioned above, details regarding the authentication method, AV, and how to obtain authentication credentials such as a first identity of the UE, e.g., an IMSI, are described below with reference to FIG. 7A in a method 700A performed by an interworking entity, and with reference to FIG. 8A in a method 800A performed by an authentication entity in the 5GC.

[0188] Although the method 600A performed by a routing entity is described separately herein, it can be understood that it may also be performed by an AAA entity in the absence of a separate routing entity.

[0189] 7A illustrates an exemplary method 700A implemented by an interworking entity according to a first exemplary embodiment of the present disclosure. It should be understood that the interworking entity may be an AAA-IWF / NSSAAF or any other entity that may be configured to implement the method 700A as described below, including a virtualization entity that may be implemented on a cloud.

[0190] It should also be understood that the method 700A implemented by the interworking entity corresponds at least in part to the method 500A implemented by the AAA entity and, optionally, to the method 600A implemented by the routing entity. Thus, a description of some parts of the method 700A may refer to the description of the method 500A and, optionally, the description of the method 600A as described above, and is therefore omitted here for simplicity.

[0191] In step S701A, the interworking entity may receive a first request message for authentication credentials from an AAA entity, for example a 3GPP AAA server.

[0192] As mentioned above, the first request message for authentication credentials may include at least an identity of the UE to be authenticated. The received identity of the UE may include a masked identity of the UE (e.g., SUCI) or a first identity of the UE (e.g., IMSI).

[0193] Alternatively, the first request message for authentication credentials may further include an access network identification information of the non-3GPP access network, such as an ANID.

[0194] As described above, the first request message for authentication credentials may be received from an AAA entity via a routing entity.

[0195] Next, in step S703A, the interworking entity may select an authentication entity, such as a UDM, in the 5GC associated with the UE based on the received UE identification information.

[0196] In step S705A, the interworking entity may send a fourth request message for authentication credentials to the selected authentication entity in the 5GC. In an example embodiment, the fourth request message for authentication credentials may be a new service-based interface (SBI) request message for authentication credentials diverted from the first request message for authentication credentials by the interworking entity over a diameter-based interface, such as a SWx / SWx′ interface.

[0197] If the received UE identity includes the UE anonymized identity, e.g., SUCI, the interworking entity may receive a first request message for authentication credentials over a Diameter-based interface (e.g., SWx' interface) supporting the UE anonymized identity, e.g., SUCI, in step S701A. The interworking entity may then select an authentication entity in 5GC in step S703A based on a routing indicator included in the received UE anonymized identity, e.g., SUCI. The interworking entity may then send a fourth request message for authentication credentials to the selected authentication entity in 5GC in step S705A, where the fourth request message for authentication credentials may include at least an indication that the requesting node is an AAA entity and the UE anonymized identity, e.g., SUCI.

[0198] If the received UE identity includes the UE's first identity, e.g., IMSI, the interworking entity may receive a first request message for authentication credentials over a diameter-based interface (e.g., SWx interface) supporting the UE's first identity, e.g., IMSI, in step S701A. The interworking entity may then select an authentication entity in 5GC in step S703A based on the UE's first identity, e.g., IMSI. The interworking entity may then send a fourth request message for authentication credentials to the selected authentication entity in 5GC in step S705A, where the fourth request message for authentication credentials may include at least an indication that the requesting node is an AAA entity and another clear-text identity of the UE (also referred to throughout this specification as "second identity"), e.g., SUPI, which may be converted from the UE's first identity, e.g., IMSI, by the interworking entity.

[0199] Alternatively, in either of the above two cases, the fourth request message for authentication credentials may further include an access network identification, such as an ANID, associated with the non-3GPP access element to which the UE is connected.

[0200] After the selected authentication entity in the 5GC obtains the corresponding authentication credentials, the interworking entity may receive a fourth response message of the authentication credentials from the selected authentication entity in the 5GC.

[0201] The fourth response message of the authentication credentials may include: an authentication method selected by an authentication entity in the 5GC or requested by a selected authentication entity in the 5GC from an authentication entity in the EPC, e.g., an HSS, associated with the UE; and An authentication vector generated by a selected authenticating entity in the 5GC or requested by a selected authenticating entity in the 5GC from an authenticating entity in the EPC.

[0202] If the received UE identification information in the first request message for authentication credentials includes a first identification information of the UE, e.g., an IMSI, the interworking entity may understand that the fourth response message for authentication credentials does not need to include a second identification information of the UE, e.g., a SUPI, since the interworking entity knows the first identification information of the UE, e.g., the IMSI.

[0203] Alternatively, the fourth response message for authentication credentials may further include a second identity of the UE, e.g., SUPI, which may be de-ciphered from the anonymized identity of the UE, e.g., SUCI, by an authentication entity in 5GC when the received identity of the UE in the first request message for authentication credentials includes an anonymized identity of the UE, e.g., SUCI, or may include a second identity of the UE, e.g., SUPI, which may be converted from the received first identity of the UE, e.g., IMSI, by an interworking entity when the received identity of the UE in the first request message for authentication credentials includes a first identity of the UE, e.g., IMSI.

[0204] The interworking entity may then send a first response message of the authentication credentials to the AAA entity.

[0205] As described above, the first response message of the authentication credentials may include: An authentication method, e.g. EAP AKA / EAP AKA', selected by an authentication entity in the 5GC or requested by an authentication entity in the EPC associated with the UE An authentication vector generated by a selected authenticating entity in the 5GC or requested by a selected authenticating entity in the 5GC from an authenticating entity in the EPC, and A first identification information of the UE obtained from the received identification information of the UE.

[0206] In an exemplary embodiment where the fourth response message of the authentication credentials received from the selected authentication entity in the 5GC includes a second identity of the UE, e.g., a SUPI, as described above, the interworking entity may convert the second identity of the UE, e.g., a SUPI, into a first identity of the UE, e.g., an IMSI, and may include the first identity of the UE, e.g., the IMSI, in the first response message of the authentication credentials.

[0207] In an exemplary embodiment in which the interworking entity knows the UE first identity, e.g., IMSI, if the received UE identity in the first request message for authentication credentials includes the UE first identity, e.g., IMSI, the fourth response message for authentication credentials received from the selected authentication entity in the 5GC may not include the UE second identity, e.g., SUPI, as described above, and the interworking entity may directly include the UE first identity, e.g., IMSI, in the first response message for authentication credentials.

[0208] 8A is a schematic diagram of an exemplary method 800A performed by an authenticating entity in a 5GC according to a first exemplary embodiment of the present disclosure. It should be understood that the authenticating entity in a 5GC may be a UDM / ARPF / Subscription Identifier Unmasking Function (SIDF), or any other entity that may be configured to perform the method 800A as described below, including a virtualization entity that may be implemented on a cloud.

[0209] It should also be understood that the method 800A performed by the authentication entity in the 5GC corresponds at least in part to the method 700A performed by the interworking entity. Therefore, some descriptions of the method 800A may refer to the description of the method 700A, and are therefore omitted here for simplicity.

[0210] In step S801A, the authentication entity in the 5GC may receive a fourth request message for authentication credentials of the UE to be authenticated from the interworking entity.

[0211] As mentioned above, the fourth request message for authentication credentials may include at least an indication that the requesting node is an AAA entity and an identity of the UE. The identity of the UE may include an anonymized identity of the UE, such as a SUCI, or a second identity of the UE, such as a SUPI. Alternatively, the fourth request message for authentication credentials may further include an access network identity, such as an ANID, associated with a non-3GPP access element to which the UE is connected.

[0212] If the received UE identity includes a UE anonymized identity, e.g., a SUCI, the authentication entity in the 5GC may de-anonymize a second UE identity, e.g., a SUPI, from the received UE anonymized identity, e.g., a SUCI.

[0213] An authentication entity in the 5GC may then select an authentication method for the UE, e.g., EAP AKA / EAP AKA', based at least on the indication that the requesting node is an AAA entity and on a second identity for the UE, e.g., SUPI. The selection of EAP AKA' for the UE may further be based on an access network identity, e.g., ANID, associated with the non-3GPP access element to which the UE is connected.

[0214] An authentication entity within the 5GC may also generate an authentication vector for the UE based at least on a second identity of the UE, such as the SUPI.

[0215] It can be understood that if the received UE identity includes a UE second identity, e.g., SUPI, converted from the UE first identity, e.g., IMSI, by the interworking entity, the authentication entity in the 5GC may directly use the UE second identity, e.g., SUPI, to select an authentication method and generate an authentication vector without deciphering.

[0216] In an example embodiment, the authentication vector generation functionality for the UE may be deployed in an authentication entity in the EPC, such as an HSS, associated with the UE, in which case the authentication entity in the 5GC may request corresponding authentication credentials from the authentication entity in the EPC.

[0217] In particular, the authentication entity in the 5GC may send a fifth request message for authentication credentials to the authentication entity in the EPC. The fifth request message for authentication credentials may include at least an indication that the requesting node is an AAA entity and an identification information of the UE. Here, the identification information of the UE may include a second identification information of the UE, such as a SUPI, or may include a first identification information of the UE, such as an IMSI, which may be converted by the authentication entity in the 5GC.

[0218] Alternatively, the fifth request message for authentication credentials may further include an access network identification information, such as an ANID, of the non-3GPP access network to which the UE is connected.

[0219] Then, the authentication entity in the 5GC may receive a fifth response message of authentication credentials from the authentication entity in the EPC. The fifth response message of authentication credentials may include at least an authentication method for the UE and an authentication vector for the UE.

[0220] Details regarding how the authentication entity in the EPC obtains authentication credentials, such as an authentication method, AV, etc. for the UE are described below in method 900A performed by the authentication entity in the EPC with reference to FIG. 9A.

[0221] After the authentication entity in the 5GC obtains authentication credentials, such as an authentication method, AV, etc. for the UE, the authentication entity in the 5GC may, in step S803A, include the authentication credentials in a fourth response message of the authentication credentials and send the fourth response message of the authentication credentials to the interworking entity.

[0222] FIG. 9A illustrates generally an exemplary method 900A performed by an authentication entity in an EPC according to a first exemplary embodiment of the present disclosure. It should be understood that the authentication entity in the EPC may be an HSS / Authentication Center (AUC) or any other entity that may be configured to perform method 900A as described below, including a virtualization entity that may be implemented on a cloud.

[0223] It should also be understood that the method 900A performed by the authentication entity in the EPC corresponds at least in part to the method 800A performed by the authentication entity in the 5GC. Therefore, a description of some of the method 900A may refer to the description of the method 800A, and is therefore omitted here for simplicity.

[0224] As described above, if the authentication vector generation function for the UE is deployed in an authentication entity in the EPC, the method 900A is performed by the authentication entity in the EPC. In this case, the authentication entity in the 5GC may request corresponding authentication credentials from the authentication entity in the EPC.

[0225] In step S901A, an authentication entity in the EPC may receive a fifth request message for authentication credentials from an authentication entity in the 5GC associated with the UE to be authenticated.

[0226] As described above, the fifth request message for authentication credentials may include at least an indication that the requesting node is an AAA entity and an identity of the UE, which may include a second identity of the UE, such as a SUPI, or may include a first identity of the UE, such as an IMSI, which may be converted by an authentication entity in the 5GC.

[0227] Alternatively, the fifth request message for authentication credentials may further include an access network identification information, such as an ANID, of the non-3GPP access network to which the UE is connected.

[0228] Next, in step S903A, an authentication entity in the EPC may obtain authentication credentials for the UE. The authentication credentials for the UE may include an authentication method for the UE, for example, EAP AKA / EAP AKA', and an authentication vector for the UE.

[0229] In particular, in step S903A, an authentication entity in the EPC may select an authentication method for the UE based at least on an indication that the requesting node is an AAA entity and the UE's identity, e.g., SUPI or IMSI, and may generate an authentication vector for the UE based at least on the UE's identity, e.g., SUPI or IMSI.

[0230] Next, in step S905A, the authentication entity in the EPC may include the obtained authentication credentials of the UE in a fifth response message of authentication credentials and send the fifth response message of authentication credentials to the authentication entity in the 5GC.

[0231] Hereinafter, the non-3GPP access authentication of a UE according to the first exemplary embodiment of the present disclosure will be described with reference to an exemplary sequence diagram as shown in Fig. 10A, in which the methods of Fig. 3, 4, 5A, 6A, 7A, 8A and 9 are applied. The description of some of the exemplary signaling sequence diagram as shown in Fig. 10A may refer to those of the methods 300, 400, 500A, 600A, 700A, 800A and 900A as described previously, and thus will be omitted here for brevity.

[0232] In the following description of the exemplary signaling sequence diagram of FIG. 10A, a WLAN AP is illustrated as an example of a non-3GPP access element as previously described, a 3GPP AAA server is illustrated as an example of an AAA entity, an SLF / DRA (not shown) is illustrated as an example of a routing entity, an AAA-IWF / NSSAAF is illustrated as an example of an interworking entity, UDM / ARPF / SIDF are illustrated as examples of authentication entities within 5GC, and HSS / AUS are illustrated as examples of authentication entities within EPC.

[0233] It should be understood that the above exemplary entities are used herein for illustration purposes and are not intended to be limiting in any way, and each or any combination of entities other than those described herein may cooperate to perform non-3GPP access authentication of a UE, so long as they implement methods 300, 500A, 600A, 700A, 800A, and 900A, respectively.

[0234] It should be noted that the following description focuses primarily on signaling related to methods 300, 400, 500A, 600A, 700A, 800A, and 900A, and some other signaling is not described in detail to avoid obscuring the principles of the present disclosure. In FIG. 10A, changes related to signaling related to methods 300, 400, 500A, 600A, 700A, 800A, and 900A are shown in bold italics, e.g., signaling S10A_0B, S10A_5-S10A_7, and S10A_9-S10A_11 are related.

[0235] In S10A_0a, the UE may select a WLAN access network, and a PLMN for performing 3GPP based access authentication via this PLMN.

[0236] During this procedure, a WLAN AP in the WLAN access network may broadcast a PLMN list as specified in 3GPP TS 23.501 v17.1.1, clause 6.3.12. The WLAN AP may broadcast the PLMN list including all PLMNs through which the WLAN access network may support connectivity with a 3GPP AAA server for access authentication and UE identity privacy (e.g., SUCI).

[0237] In S10A_0b, the UE may determine whether UE identity privacy should be used, e.g., for NSWO traffic, based on, e.g., local configuration, information from the WLAN AP, and information provided by the home network that the home network supports UE identity privacy for access authentication, e.g., NSWO. The provision of such information may be carried within the UE UPU procedure or SoR procedure as specified in 3GPP TS 33.501 v17.2.1.

[0238] In S10A_1, a layer-2 connection may be established between the UE and the WLAN access network.

[0239] In S10A_2, the WLAN access network, for example an EAP authenticator in the WLAN access network, may send an EAP request / identification information to the UE.

[0240] In S10A_3, the UE may send an EAP-Request / Identity message to the WLAN access network, i.e., the WLAN AP. The UE shall send its identity conforming to the NAI format as specified in 3GPP TS 23.003 v17.2.0.

[0241] If the UE determines that UE identity privacy should be used, the NAI contains either the pseudonym assigned to the UE in the previous round of the authentication procedure, or the SUCI in case of the first authentication.

[0242] Then, in S10A_4, the WLAN AP may send an AAA request message towards an appropriate 3GPP AAA server based on the realm part of the NAI, for example, as specified in 3GPP TS 33.402 v16.0.0. The routing path may include one or several AAA proxies. In such a case, the NAI of the SUCI may be formed in the decorated NAI format, as specified in 3GPP TS 23.003 v17.2.0. The AAA request message sent by the WLAN AP may include the SUCI or IMSI in the NAI, and optionally the ANID of the WLAN access network.

[0243] In S10A_5, the 3GPP AAA server may receive an AAA request message including the identity of the UE. If the UE determines that it uses a SUCI, the AAA request message may include a SUCI in an NAI format, and the 3GPP AAA may detect the SUCI from the NAI.

[0244] The 3GPP AAA may decide to retrieve authentication credentials, such as EAP AKA / EAP AKA', AVs, etc., for the UE on SWx (if IMSI is detected) or SWx' (if SUCI is detected).

[0245] If the UE determines to use IMSI, the AAA request message may include the IMSI in NAI format, and the 3GPP AAA may discover the IMSI from the NAI and may determine to retrieve authentication credentials from the HSS / AUC via SWx, similar to existing EPC procedures (in UDICOM).

[0246] In S10A_6, the 3GPP AAA server may send an AV request message to retrieve authentication credentials from the UDM / ARPF / SIDF via the AAA-IWF / NSSAAF. The AV request message may include the SUCI or IMSI, and optionally the ANID.

[0247] If the SUCI is detected, the 3GPP AAA server may generate an updated Diameter SWx' request message as an AV request message. This message may be an enhancement to the SWx messages, e.g., Multimedia Authentication Request / Multimedia Authentication Answer, as specified in 3GPP TS 33.402 v16.0.0. Alternatively, if the IMSI is detected, the existing Diameter SWx Multimedia Authentication Request (MAR) command may be used as specified.

[0248] An optional SLF / DRA (not shown) may help route the updated Diameter SWx / SWx' request towards the UDM / ARPF / SIDF via the AAA-IWF / NSSAAF.

[0249] In S10A_7, the AAA-IWF / NSSAAF may discover and select a UDM / ARPF / SIDF, for example, based on a routing identifier in the SUCI. The AAA-IWF / NSSAAF may translate the SXx' / SWx AV request message into a new SBI AV request message, for example Nudm_UEAuthentication_GetAaaAV, which may include the SUCI (if a SUCI is received) or the SUPI converted by the AAA-IWF / NSSAAF from the IMSI (if a SUCI is received), an indication of the requesting node being a 3GPP AAA server, and optionally an ANID. The AAA-IWF / NSSAAF may send the SBI AV request message to the selected UDM / ARPF / SIDF.

[0250] In S10A_8, the UDM / ARPF / SIDF may uncipher a SUPI from the SUCI (if the SUCI is received). The UDM / ARPF / SIDF may select EAP AKA as the authentication method based at least on the UE's SUPI (unciphered or directly received if the SUCI is received) and an instruction of the requesting node, which is a 3GPP AAA server, for example, or may select EAP AKA' as the authentication method based at least on the UE's subscriber, ANID, and an instruction of the requesting node, which is a 3GPP AAA server, for example. The UDM / ARPF / SIDF may generate AVs for EAP-AKA / EAP-AKA' based at least on the UE's SUPI.

[0251] Alternatively, if an authentication vector generation function (for this user) is deployed in the HSS / AUC, in S10A_9, the UDM / ARPF / SIDF may send an AV request message for the corresponding authentication credentials to the HSS / AUC using the new service behavior of the UDICOM NU1 reference point. The AV request message may include a SUPI or IMSI, which may be converted by the UDM / ARPF / SIDF, an indication of the requesting node that is the 3GPP AAA server, and optionally an ANID. The UDM / ARPF / SIDF may then receive the corresponding authentication credentials from the HSS / AUC.

[0252] In S10A_10, the UDM / ARPF / SIDF may send an AV response message to the AAA-IWF / NSSAAF with the selected authentication credentials, and optionally the SUPI.

[0253] In S10A_11, the AAA-IWF / NSSAAF may convert the SUPI to an IMSI (if SUPI is received) and send an AV response message to the 3GPP AAA server on SWx / SWx' with the selected authentication credentials and IMSI.

[0254] Thereafter, in S10A_14, the 3GPP AAA server and the UE may proceed with the EAP AKA' procedure and derive keying material, for example the MSK / EMSK as specified in 3GPP TS 33.402 v16.0.0.

[0255] In S10A_15, the 3GPP AAA server may send the EAP success message and the MSK to the authenticator in the WLAN access network.

[0256] In S10A_16, the authenticator in the WLAN access network may report to the UE regarding the successful authentication with an EAP success message.

[0257] In S10A_17a, the UE and the WLAN access network may proceed to security establishment based on shared key material.

[0258] In S10A_17b, after successful authentication, the UE may retrieve its IP configuration from the WLAN access network and can exchange IP data traffic directly via the WLAN, i.e., using NSWO.

[0259] In a second exemplary embodiment, authentication credentials (e.g., authentication method, authentication vector, etc.) of the UE may be retrieved from an authentication entity in the EPC based on a first identity of the UE, e.g., an IMSI, that has been deciphered from the authentication entity in the 5GC.

[0260] Hereinafter, a method for non-3GPP access authentication of a UE according to a second exemplary embodiment, performed by an AAA entity, a routing entity, an interworking entity, and an authentication entity in 5GC, will be described with reference to Figures 5B, 6B, 7B, and 8B, respectively.

[0261] 5B illustrates a schematic diagram of an exemplary method 500B performed by an AAA entity according to a second exemplary embodiment of the present disclosure. It should be understood that the AAA entity may be a 3GPP AAA server or any other entity that may be configured to perform the method 500B as described below, including a virtualization entity that may be implemented on a cloud.

[0262] In step S501B, the AAA entity may receive an authentication request message from a non-3GPP access element.

[0263] The authentication request message received from the non-3GPP access network may include an identity of the UE to be authenticated. The UE identity may include a concealed identity of the UE, e.g., SUCI, resulting from the UE's decision that UE identity privacy should be used for communication with the non-3GPP access network, and may be included in the access authentication request message from the UE to the non-3GPP access network and / or the NAI carried by the authentication request message from the non-3GPP access network to the AAA entity.

[0264] The AAA entity may then detect the UE's anonymized identity, for example, SUCI, from the authentication request message received in step S503B.

[0265] Then, in step S505B, the AAA entity may send an identity request message to an interworking entity, e.g., the AAA-IWF / NSSAAF, to retrieve the non-ciphered identity (also referred to as "first identity") of the UE, e.g., the IMSI. The identity request message may include the detected cir- ciphered identity, e.g., the SUCI, of the UE. The identity request message may be sent on a diameter-based interface, e.g., the SWx' interface, and may support the cir- ciphered identity, e.g., the SUCI, of the UE.

[0266] In an example embodiment, the identity request message may be sent to the interworking entity via a routing entity, for example, the SLF / DRA.

[0267] It should be understood that the routing entity may be optional: if there is no separate routing entity, the corresponding routing function may be performed by an entity of the AAA.

[0268] After the interworking entity obtains the first identity of the UE, e.g., IMSI, from the authentication entity in 5GC, the AAA entity may receive an identity response message from the interworking entity. The identity response message may then include the first identity of the UE, e.g., IMSI, which may be converted by the interworking entity from the anonymized identity of the UE, e.g., SUCI, to a second identity of the UE, e.g., SUPI, that is de-anonymized by the authentication entity in 5GC associated with the UE.

[0269] The identity response message may also be received on a Diameter-based interface, for example, an SWx' interface. The AAA entity may then perform an existing authentication credential retrieval process based on the first identity of the UE, e.g., the IMSI, that has been de-anonymized from the authentication entity in the 5GC.

[0270] In particular, the AAA entity may send, optionally via a routing entity, a request message for authentication credentials (referred to throughout the specification as a "second request message for authentication credentials") to an authentication entity in the EPC associated with the UE. The second request message for authentication credentials may include at least the received first identity of the UE, e.g., the IMSI.

[0271] The AAA entity may then receive, optionally via a routing entity, a second response message of the authentication credentials from the authentication entity in the EPC.

[0272] The second response message for authentication credentials is the authentication method selected by the authentication entity in the EPC or requested by the authentication entity in the EPC from the authentication entity in the 5GC; and It may contain an authentication vector generated by an authenticating entity in the EPC or requested by an authenticating entity in the EPC from an authenticating entity in the 5GC.

[0273] It will be appreciated that the search for authentication credentials such as the UE's authentication method, authentication vector, etc. is performed by an authentication entity in the EPC in existing authentication credential search approaches that are not part of this disclosure, and therefore, for simplicity, will be briefly described below in the manner performed by the authentication entity in the EPC.

[0274] 6B illustrates a schematic diagram of an exemplary method 600B performed by a routing entity according to a second exemplary embodiment of the present disclosure. It should be understood that the routing entity may be an SLF / DRA or any other entity that may be configured to perform the method 600B as described below, including a virtualization entity that may be implemented on a cloud.

[0275] It should also be understood that the method 600B performed by the routing entity corresponds at least in part to the method 500B performed by the AAA entity, and therefore some descriptions of the method 600B may refer to those of the method 500B as previously described and are therefore omitted here for brevity.

[0276] In step S601B, the routing entity may receive an identity request message from an AAA entity, e.g., a 3GPP AAA server, to retrieve an unciphered identity (also referred to as a "first identity") of the UE, e.g., an IMSI. The identity request message may include the detected ancillary identity, e.g., a SUCI, of the UE.

[0277] Then, in step S603B, the routing entity may forward the identity request message to an interworking entity, for example, the AAA-IWF / NSSAAF.

[0278] The identity request message may be received and forwarded on a Diameter based interface, such as a SWx' interface, and may support a concealed identity, such as a SUCI, of the UE.

[0279] That is, the routing entity may help route the identity request message towards an authentication entity in the 5GC via the interworking entity.

[0280] After the interworking entity obtains the first identity of the UE, e.g., IMSI, from an authentication entity in 5GC, the routing entity may receive an identity response message from the interworking entity. The identity response message may then include the first identity of the UE, e.g., IMSI, that may be converted by the interworking entity from the anonymized identity of the UE, e.g., SUCI, to a second identity of the UE, e.g., SUPI, that is deanonymized by an authentication entity in 5GC associated with the UE.

[0281] The routing entity may then forward the identity response message to the AAA entity.

[0282] The identity response message may be received and forwarded over a Diameter-based interface, for example, an SWx' interface.

[0283] The routing entity may receive a second request message for authentication credentials from the AAA entity. The second request message for authentication credentials may include at least the received first identity information, such as an IMSI, of the UE.

[0284] The routing entity may then forward the received second request message for authentication credentials to an authentication entity in the EPC associated with the UE.

[0285] The routing entity may then receive, optionally via the routing entity, a second response message of the authentication credentials from the authenticating entity in the EPC.

[0286] The second response message for authentication credentials is the authentication method selected by the authentication entity in the EPC or requested by the authentication entity in the EPC from the authentication entity in the 5GC; and It may contain an authentication vector generated by an authenticating entity in the EPC or requested by an authenticating entity in the EPC from an authenticating entity in the 5GC.

[0287] The routing entity may then forward the received second response message of the authentication credentials to the AAA entity.

[0288] It will be appreciated that the search for authentication credentials such as the UE's authentication method, authentication vector, etc. is performed by an authentication entity in the EPC in existing authentication credential search approaches that are not part of this disclosure, and therefore, for simplicity, will be briefly described below in the manner performed by the authentication entity in the EPC.

[0289] Although the method 600B performed by a routing entity is described separately herein, it should be understood that the method may be performed by an AAA entity in the absence of a separate routing entity.

[0290] 7B illustrates a schematic diagram of an exemplary method 700B performed by an interworking entity according to a second exemplary embodiment of the present disclosure. It should be understood that the interworking entity may be an AAA-IWF / NSSAAF, or any other entity that may be configured to perform the method 700B as described below, including a virtualization entity that may be implemented on a cloud.

[0291] It should also be understood that the method 700B performed by the interworking entity corresponds at least in part to the method 500B performed by the AAA entity and, optionally, the method 600B performed by the routing entity. Thus, some descriptions of the method 700B may refer to those of the method 500B and, optionally, the method 600B as previously described, and are therefore omitted here for brevity.

[0292] In step S701B, the interworking entity may receive an identity request message from an AAA entity, e.g., a 3GPP AAA server, to retrieve an unmasked identity (also referred to as a "first identity") of the UE, e.g., an IMSI.

[0293] As previously described, the identity request message may include the UE's anonymized identity, e.g., SUCI. The identity request message may be received on a Diameter-based interface, e.g., SWx' interface, and may support the UE's anonymized identity, e.g., SUCI.

[0294] As previously described, the identity request message may be received from an AAA entity via a routing entity.

[0295] Then, in step S703B, the interworking entity may select an authentication entity in the 5GC associated with the UE based on the received anonymized identity of the UE. In an example embodiment, the authentication entity in the 5GC associated with the UE may be selected by the interworking entity based on the received anonymized identity of the UE, e.g., a routing indicator included in the SUCI.

[0296] Then, in step S705B, the interworking entity may send an identity unmasking request message to the selected entity for authentication in 5GC. In an example embodiment, the identity unmasking request message is a new SBI request message for identity unmasking that is translated by the interworking entity from the identity request message over a diameter-based interface, e.g., SWx′ interface, and may support the UE's unmasked identity, e.g., SUCI.

[0297] The identity unmasking request message may include the received masked identity of the UE, for example, the SUCI.

[0298] The interworking entity may then receive an identity unmasking response message from the selected entity for authentication in 5GC. The identity unmasking response message may include a second identity, e.g., SUPI, of the UE unmasked by the selected entity for authentication in 5GC from the masked identity, e.g., SUCI, of the UE, convert the received second identity, e.g., SUPI, of the UE to a first identity, e.g., IMSI, of the UE, and send an identity response message to the AAA entity. The identity response message may include the first identity, e.g., IMSI, of the UE.

[0299] 8B is a schematic diagram of an exemplary method 800B performed by an authenticating entity in a 5GC according to a second exemplary embodiment of the present disclosure. It should be understood that the authenticating entity in a 5GC may be a UDM / ARPF / SIDF, or any other entity that may be configured to perform the method 800B as described below, including a virtualization entity that may be implemented on a cloud.

[0300] It should also be understood that the method 800B performed by the authentication entity in the 5GC corresponds at least in part to the method 700B performed by the interworking entity, and therefore some descriptions of the method 800B may refer to those of the method 700B and are therefore omitted here for brevity.

[0301] In step S801B, an authentication entity in the 5GC may receive an identity unmasking request message from an interworking entity, e.g., an AAA-IWF / NSSAAF. As previously described, the identity unmasking request message may include the received unmasked identity, e.g., SUCI, of the UE.

[0302] In step S803B, an authentication entity in the 5GC may decipher a second identity of the UE, for example a SUPI, from the received anonymized identity of the UE, for example a SUCI.

[0303] Then, in step S805B, the authentication entity in the 5GC may send an identity unmasking response message to the interworking entity. The identity unmasking response message may include the unmasked second identity of the UE, for example, SUPI.

[0304] As previously described, the method performed by the authentication entity in the EPC for non-3GPP access authentication in the second exemplary embodiment is not part of this disclosure and will be described briefly here for brevity.

[0305] After the AAA entity receives the first identity, e.g., IMSI, of the UE, it may send a second request message for authentication credentials to an authentication entity in the EPC associated with the UE, optionally via a routing entity, on a Diameter-based interface supporting the first identity, e.g., IMSI, of the UE. The second request message for authentication credentials may include at least the first identity, e.g., IMSI, of the UE, and optionally an ANID of the non-3GPP access network to which the UE is connected.

[0306] Thus, the authentication entity in the EPC may receive a second request message for authentication credentials from the AAA entity over a Diameter-based interface supporting the first identity of the UE, e.g., the IMSI, The second request message may include at least the first identity of the UE, e.g., the IMSI, and optionally the ANID.

[0307] If the authentication vector generation function for the UE is deployed in an authentication entity in the EPC, the authentication entity in the EPC may directly provide authentication credentials such as authentication method, AV, etc. for the UE to the AAA entity.

[0308] Alternatively, if the authentication vector generation function for the UE is deployed in an authentication entity in 5GC, the authentication entity in the EPC may send another request message for authentication credentials over the UDICOM NU1 interface to the authentication entity in 5GC to obtain authentication credentials for the UE from the authentication entity in 5GC.

[0309] The authentication entity in the EPC may then send a second response message of the authentication credentials to the AAA entity over a Diameter-based interface supporting the first identity, e.g., the IMSI, of the UE.

[0310] The second response message of authentication credentials may include an authentication method selected by the authentication entity in the EPC or requested by the authentication entity in the EPC from the authentication entity in the 5GC, and an authentication vector generated by the authentication entity in the EPC or requested by the authentication entity in the EPC from the authentication entity in the 5GC.

[0311] Hereinafter, the non-3GPP access authentication of a UE according to the second exemplary embodiment of the present disclosure will be described with reference to an exemplary signaling sequence diagram as shown in Figure 10B, in which the methods of Figures 3, 4, 5B, 6B, 7B, and 8B are applied. The description of some of the exemplary signaling sequence diagram as shown in Figure 10B may refer to those of methods 300, 400, 500B, 600B, 700B, and 800B, as previously described, and therefore will be omitted here for brevity.

[0312] Similar to the exemplary signaling sequence diagram of FIG. 10A, in the following description of the exemplary signaling sequence diagram of FIG. 10B, a WLAN AP is illustrated as an example of a non-3GPP access element as previously described, a 3GPP AAA server is illustrated as an example of an AAA entity, an SLF / DRA (not shown) is illustrated as an example of a routing entity, an AAA-IWF / NSSAAF is illustrated as an example of an interworking entity, UDM / ARPF / SIDF are illustrated as examples of authentication entities within 5GC, and HSS / AUC are illustrated as examples of authentication entities within EPC.

[0313] It should be understood that the above exemplary entities are used herein for illustration purposes and are not intended to be limiting in any way, and each or any combination of entities other than those described herein may cooperate to perform non-3GPP access authentication of a UE, so long as they implement methods 300, 500B, 600B, 700B, and 800B, respectively.

[0314] It should be noted that the following description focuses primarily on signaling related to methods 300, 400, 500B, 600B, 700B, and 800B, and some other signaling is not described in detail to avoid obscuring the principles of the present disclosure. In FIG. 10B, changes related to signaling related to methods 300, 400, 500B, 600B, 700B, and 800B are shown in bold italics, e.g., signaling S10B_0b, S10B_5-S10B_7, and S10B_9 are related.

[0315] In the exemplary signaling sequence diagram of FIG. 10B, the signaling S10B_0a to S10B_5 of FIG. 10B are similar to the signaling S10A_0a to S10A_5 of FIG. 10A. The only difference is that the UE determines that UE identity privacy should be used in S10B_0b, and therefore sends an EAP-Response / Identity message to the WLAN AP in S10B_3 with SUCI in NAI, and the 3GPP AAA server therefore detects SUCI from NAI in S10B_5. Therefore, detailed descriptions of these signaling S10B_0a to S10B_5 may be referred to as those of signaling S10A_0a to S10A_5, and are omitted here for brevity.

[0316] At S10B_6, the 3GPP AAA server may send an IMSI retrieval request with the SUCI received from S10B_4 and discovered at S10B_5 via a new Diameter-based command on SWx'.

[0317] An optional SLF / DRA (not shown) may help route new Diameter SWx' requests towards the UDM / ARPF / SIDF via the AAA-IWF / NSSAAF.

[0318] NOTE: If the NAI received from S10B_4 contains a SUCI protected with a null scheme, the 3GPP AAA server may retrieve the IMSI from the SUCI by itself and skip from S10B_6 to S10B_10.

[0319] In S10B_7, the AAA-IWF / NSSAAF may discover and select a UDM / ARPF / SIDF, for example, based on a routing identifier in the SUCI. The AAA-IWF / NSSAAF may send a SUCI deconcealment request to the UDM / ARPF / SIDF using a new Nudm service, for example, Nudm_SUCIDeconcealment_Get.

[0320] In S10B_8, the UDM / ARPF / SIDF may decipher the SUPI from the SUCI.

[0321] In S10B_9, the UDM / ARPF / SIDF may send a SUCI de-ciphering response to the AAA-IWF / NSSAAF with the SUPI.

[0322] In S10B_10, the AAA-IWF / NSSAAF may convert the SUPI to an IMSI and send an IMSI search response to the 3GPP AAA server on SWx'.

[0323] In S10B_11, the 3GPP AAA server may send an AV request message with the IMSI and, optionally, the ANID received in S10B_4. The AV request message may be routed to the HSS via SWx as currently specified. In a situation where there are multiple HSS instances in the UE's home network, the SLF / DRA helps route the SWx request to the HSS associated with the UE.

[0324] In a scenario where the home network supports a mix of 4G-only users, 5G users supporting interworking with the EPC, and 5G-only users, the SLF / DRA may also assist in routing AV request messages towards the HSS / AUC (for 4G-only users, 5G users supporting interworking with the EPC) or towards the UDM / ARPF / SIDF (for 5G-only users) via the AAA-IWF realized by the NSSAAF.

[0325] In S10B_12, if the HSS / AUC supports the UE authentication vector generation function, the HSS / AUC may provide the UE authentication credentials, such as authentication method, AV, etc., to the 3GPP AAA server as currently specified. If the UE authentication vector generation function has migrated to the UDM / ARPF / SIDF, the HSS / AUC may request the authentication credentials from the UDM / ARPF / SIDF using the UDICOM NU1 reference point as currently specified.

[0326] At S10B_13, the HSS / AUC may send an AV Response message to the 3GPP AAA server through the Diameter SWx. The flow continues at S10B_14.

[0327] Signaling S10B_14 to S10B_17b in Fig. 10B are the same as signaling S10A_14 to S10A_17b in Fig. 10A. Therefore, the description of these signaling S10B_14 to S10B_17b may refer to the description of signaling S10A_14 to S10A_17b, and will be omitted for simplicity.

[0328] In a third exemplary embodiment, the UE's authentication credentials (eg, authentication method, authentication vector, etc.) may be retrieved from an authentication entity in the EPC based on the UE's anonymized identity, eg, SUCI.

[0329] Hereinafter, a method for non-3GPP access authentication of a UE according to a second exemplary embodiment, performed by an AAA entity, a routing entity, an interworking entity, and an authentication entity in 5GC, will be described with reference to Figures 5C, 6C, 8C, and 9B, respectively.

[0330] 5C illustrates an exemplary method 500C implemented by an AAA entity according to a third exemplary embodiment of the present disclosure. It should be understood that the AAA entity may be a 3GPP AAA server or any other entity that may be configured to implement the method 500C as described below, including a virtualization entity that may be implemented on a cloud.

[0331] In step S501C, the AAA entity may receive an authentication request message from the non-3GPP access element.

[0332] The authentication request message received from the non-3GPP access network may include an identity of the UE to be authenticated. The identity of the UE may include a concealed identity of the UE, e.g., a SUCI, depending on a result of a decision of the UE on whether or not to use UE identity privacy for communication with the non-3GPP access network, and may be included in an NAI conveyed by the access authentication request message from the UE to the non-3GPP access network and / or by the authentication request message from the non-3GPP access network to the AAA entity.

[0333] Next, in step S503C, the AAA entity may detect the UE's anonymized identity, for example, SUCI, from the received authentication request message.

[0334] Next, in step S505C, the AAA entity may send a third request message for authentication credentials to an authentication entity in the EPC associated with the UE, such as an HSS. The third request message for authentication credentials may include at least the anonymized identity, such as the SUCI, of the detected UE.

[0335] In an example embodiment, the AAA entity may send a third request message for authentication credentials to an authentication entity in the EPC via a routing entity, e.g., SLF / DRA, which in turn selects the authentication entity in the EPC, as described in more detail below.

[0336] Alternatively, in an example embodiment where there is no separate routing entity, the AAA entity may select an authentication entity in the EPC based on the anonymized identity, e.g., SUCI, of the detected UE in a network repository entity (e.g., NRF).

[0337] An authentication entity in the EPC may be selected within an entity of the network repository based on a routing indicator included in the anonymized identity of the detected UE.

[0338] In step S505C, the AAA entity may send a third request message for authentication credentials to the selected authentication entity in the EPC. The third request message for authentication credentials may be sent over a Diameter-based interface, such as an SWx' interface, supporting the UE's masked identity, such as the SUCI.

[0339] The AAA entity may then receive a third response message of the authentication credentials from the authentication entity in the EPC. The third response message of the identification credentials may be received via a Diameter-based interface, for example, a SWx' interface.

[0340] The authentication credentials third response message may include: an authentication method selected by an authentication entity in the EPC or requested by an authentication entity in the EPC from an authentication entity in the 5GC associated with the UE, e.g., a UDM; An authentication vector generated by an authenticating entity in the EPC or requested by an authenticating entity in the EPC from an authenticating entity in the 5GC, and A first identity of the UE, e.g., an IMSI, obtained from a concealed identity of the UE, e.g., a SUCI.

[0341] 6C illustrates an exemplary method 600C implemented by a routing entity according to a third exemplary embodiment of the present disclosure. It should be understood that the routing entity may be an SLF / DRA or any other entity that may be configured to implement the method 600A as described below, including a virtualization entity that may be implemented on a cloud.

[0342] It should also be understood that the method 600C implemented by the routing entity corresponds at least in part to the method 500C implemented by the AAA entity. Therefore, some descriptions of the method 600C may refer to the description of the method 500C as described above, and are therefore omitted here for simplicity.

[0343] In step S601C, the routing entity may receive a third request message for authentication credentials from an AAA entity, such as a 3GPP AAA server. The third request message for authentication credentials may include at least the detected anonymized identity, such as SUCI, of the UE to be authenticated.

[0344] Next, in step S603C, the routing entity may select an authentication entity in the EPC (e.g., HSS) based on the detected anonymized identity of the UE, e.g., SUCI, in a network repository entity (e.g., NRF).

[0345] An authentication entity in the EPC may be selected within an entity of the network repository based on a routing indicator included in the anonymized identity of the detected UE.

[0346] Next, in step S605C, the routing entity may forward the third request message for authentication credentials to the selected authentication entity in the EPC.

[0347] The third request message for authentication credentials may be received and forwarded over a Diameter-based interface, such as an SWx' interface, supporting the UE's masked identity, such as the SUCI.

[0348] The routing entity may then receive a third response message of the authentication credentials from the authentication entity in the EPC and forward it to the AAA entity.

[0349] The authentication credentials third response message may include: an authentication method selected by an authentication entity in the EPC or requested by an authentication entity in the EPC from an authentication entity in the 5GC associated with the UE, e.g., a UDM; An authentication vector generated by an authenticating entity in the EPC or requested by an authenticating entity in the EPC from an authenticating entity in the 5GC, and A first identity of the UE, e.g., an IMSI, obtained from a concealed identity of the UE, e.g., a SUCI.

[0350] The third response message of the identification credentials may be received and forwarded via a Diameter-based interface, for example, a SWx' interface.

[0351] Although the method 600C performed by a routing entity is described separately herein, it can be understood that it may also be performed by an AAA entity in the absence of a separate routing entity.

[0352] 9C illustrates an exemplary method 900C performed by an authentication entity in the EPC according to a third exemplary embodiment of the present disclosure. It should be understood that the authentication entity in the EPC may be an HSS / AUC or any other entity that may be configured to perform the method 900C as described below, including a virtualization entity that may be implemented on a cloud.

[0353] It should also be understood that the method 900C implemented by the authentication entity in the EPC corresponds at least in part to the method 5C implemented by the AAA entity. Therefore, the description of part of the method 900C may refer to the description of the method 500C, and is therefore omitted here for simplicity.

[0354] As mentioned above, a routing entity or AAA entity may select an authentication entity in the EPC based on the anonymized identity of the detected UE, e.g. a routing indicator included in the SUCI, in a network repository entity (e.g. NRF).

[0355] Therefore, the authentication entity in the EPC should register in the network repository entity the routing indicators it supports, so that the routing entity or AAA entity can select an authentication entity in the EPC from the network repository entity based on the routing indicator included in the detected UE's anonymized identity, e.g., SUCI.

[0356] In step S901C, the authentication entity in the EPC may receive a third request message for authentication credentials from an AAA entity, such as a 3GPP AAA server. The third request message for authentication credentials may include at least an anonymized identity, such as a SUCI, of the UE to be authenticated.

[0357] The third request message for authentication credentials may be received over a Diameter-based interface, such as an SWx' interface, supporting the UE's masked identity, such as the SUCI.

[0358] The authentication entity in the EPC may then send a sixth request for authentication credentials message to an authentication entity in the 5GC associated with the UE, e.g., a UDM. The sixth request for authentication credentials message may include at least an indication that the requesting node is an AAA entity and an anonymized identity of the UE, e.g., a SUCI. The sixth request message for authentication credentials may be sent, for example, over the UDICOM NU1 reference point.

[0359] Thus, the authentication entity in the EPC may receive a sixth response message of authentication credentials from the authentication entity in the 5GC, for example over the UDICOM NU1 reference point. The sixth response message of authentication credentials may include at least a first identity (e.g., IMSI) or a second identity (e.g., SUPI) of the UE, which may be obtained from the anonymized identity (e.g., SUCI) of the UE.

[0360] In an example embodiment, an authentication entity in the EPC may select an authentication method for the UE based at least on the indication that the requesting node is an AAA entity and a first identity of the UE, e.g., an IMSI, and may generate an authentication vector for the UE based at least on the first identity of the UE.

[0361] In another exemplary embodiment, the authentication entity in the EPC may retrieve corresponding authentication credentials from the authentication entity in the 5GC. In this case, the sixth response message of the authentication credentials may further include the authentication credentials of the UE in addition to the first identity (e.g., IMSI) or the second identity (e.g., SUPI) of the UE. The authentication credentials may include an authentication method of the UE selected by the authentication entity in the 5GC and an authentication vector of the UE generated by the authentication entity in the 5GC.

[0362] The authentication entity in the EPC may then send a third response message of authentication credentials to the AAA entity. The third response message of authentication credentials may include the authentication method, the authentication vector, and the first identity of the UE, e.g., the IMSI, which may be obtained from the second identity of the UE, e.g., the SUPI.

[0363] The third response message of the identification credentials may be sent over a Diameter-based interface, for example, a SWx' interface.

[0364] 8C is a schematic diagram of an exemplary method 800C performed by an authentication entity in a 5GC according to a third exemplary embodiment of the present disclosure. It should be understood that the authentication entity in a 5GC may be a UDM / ARPF / SIDF or any other entity that may be configured to perform the method 800C as described below, including a virtualization entity that may be implemented on a cloud.

[0365] It should also be understood that the method 800C performed by the authentication entity in the 5GC corresponds at least in part to the method 900C performed by the authentication entity in the EPC. Therefore, a description of some of the method 800C may refer to the description of the method 900C as described above, and is therefore omitted here for simplicity.

[0366] In step S801C, the authentication entity in the 5GC may receive a sixth request for authentication credentials message from an authentication entity in the EPC, e.g., an HSS. The sixth request for authentication credentials message may include at least an indication that the requesting node is an AAA entity, and an anonymized identity of the UE, e.g., a SUCI, and optionally an access network identity, e.g., an ANID, associated with a non-3GPP access element to which the UE is connected.

[0367] The sixth request message for authentication credentials may be received, for example, over the UDICOM NU1 reference point.

[0368] Next, in step S803C, an authentication entity in the 5GC may obtain the first identity (e.g., IMSI) or the second identity (e.g., SUPI) of the UE from the concealed identity (e.g., SUCI).

[0369] Next, in step S805C, the authentication entity in the 5GC may send a sixth response message of the authentication credentials to the authentication entity in the EPC, for example, via the UDICOM NU1 reference point. The sixth response message of the authentication credentials may include at least the first identity (e.g., IMSI) or the second identity (e.g., SUPI) of the obtained UE.

[0370] In an example embodiment, an authentication entity in the 5GC may decipher a second identity (e.g., SUPI) of the UE from the anonymized identity (e.g., SUCI) of the UE. Optionally, the authentication entity in the 5GC may convert the second identity (e.g., SUPI) of the UE to a first identity (e.g., IMSI) of the UE.

[0371] In an example embodiment, an authentication entity in the 5GC may obtain authentication credentials, such as an authentication method, an authentication vector, etc., for the UE. In particular, the authentication entity in the 5GC may select an authentication method for the UE based at least on the indication that the requesting node is an AAA entity and a second identity (e.g., SUPI) of the UE, and may generate an authentication vector for the UE based at least on the second identity (e.g., SUPI) of the UE.

[0372] In this case, the authentication entity in the 5GC may provide the authentication credentials and the UE's identity (e.g., IMSI) to the authentication entity in the EPC. Thus, the sixth response message of the authentication credentials sent to the authentication entity in the EPC may include the UE's authentication credentials and the UE's identity (e.g., IMSI).

[0373] In an example embodiment, the authentication entity in the 5GC may send only the first or second identity of the UE in the sixth response message of the authentication credentials to the authentication entity in the EPC, and the corresponding authentication credentials may be provided by the authentication entity in the EPC, which has already been described above in method 900C.

[0374] Hereinafter, a non-3GPP access authentication of a UE according to a third exemplary embodiment of the present disclosure will be described with reference to an exemplary signaling sequence diagram as shown in Figure 10C, to which the methods of Figures 3, 4, 5C, 6C, 8C, and 9B may be applied. The description of some of the exemplary signaling sequence diagram as shown in Figure 10C may refer to the description of the methods 300, 400, 500C, 600C, 800C, and 900C as described above, and thus will be omitted here for simplicity.

[0375] Similar to the example signaling sequence diagrams of Figures 10A and 10B, in the following description of the example signaling sequence diagram of Figure 10C, a WLAN AP is shown as an example of a non-3GPP access element as described above, a 3GPP AAA server is shown as an example of an AAA entity, an SLF / DRA (not shown) is shown as an example of a routing entity, an AAA-IWF / NSSAAF is shown as an example of an interworking entity, UDM / ARPF / SIDF is shown as an example of an authentication entity within 5GC, and HSS / AUC is shown as an example of an authentication entity within EPC.

[0376] It should be understood that the above exemplary entities are used herein for illustration purposes only and without any limitation, and each entity or any combination thereof other than those mentioned herein may cooperate to perform non-3GPP access authentication of the UE as long as it can realize the methods 300, 500C, 600C, 800C, and 900C, respectively.

[0377] It should be noted that the following description focuses primarily on signaling associated with methods 300, 400, 500C, 600C, 800C, and 900C, and that some other signaling will not be described in detail to avoid obscuring the principles of the present disclosure. In FIG. 10C, modifications to signaling associated with methods 300, 400, 500C, 600C, 800C, and 900C are shown in bold italics, e.g., associated with signaling S10C_0b, S10C_5-S10C_8.

[0378] In the exemplary signaling sequence diagram of Figure 10C, signaling S10C_0a to S10C_5 in Figure 10C are the same as signaling S10B_0a to S10B_5 in Figure 10B. Therefore, detailed descriptions of these signaling S10C_0a to S10C_5 may refer to the descriptions of signaling S10B_0a to S10B_5, and are omitted here for simplicity.

[0379] At S10C_6, the 3GPP AAA server may send an AV request message including the SUCI received from S10C_4 and discovered at S10C_5 via the new Diameter-based command through SWx'. The AV request message may optionally include the ANID received at S10C_4.

[0380] The AV request message may be routed to the HSS / AUC via the (updated) SWx'.

[0381] In a situation where there are multiple HSS / AUC instances in the UE's home network, an optional SLF / DRA (not shown) may assist the UE in routing the SWx' request to the HSS defined, i.e., associated with the UE.

[0382] The SLF / DRA may discover and select an HSS from the NRF, for example, based on the routing indicators included in the SUCI. For this purpose, the HSS needs to register in advance with the NRF the routing indicators it supports.

[0383] At S10C_7, the HSS may use a new service operation of the UDICOM NU1 reference point, together with the SUCI, an indication that the requesting node is a 3GPP AAA server, and optionally the ANID, to request authentication credentials and IMSI from the UDM / ARPF / SIDF.

[0384] The UDM / ARPF / SIDF may uncipher the SUPI from the SUCI and generate the AKA AV for EAP-AKA' and send it back to the HSS.

[0385] At S10C_8, the HSS may send an AV Response message to the 3GPP AAA server through Diameter SWx / SWx'. The flow continues to S10C_14.

[0386] Signalings S10C_14 to S10C_17b in Fig. 10C are the same as signalings S10A_14 to S10A_17b in Fig. 10A. Therefore, the description of these signalings S10C_14 to S10C_17b may refer to the description of signalings S10A_14 to S10A_17b, and will be omitted for simplicity.

[0387] Hereinafter, an exemplary structure of a non-3GPP access element according to any of the first to third exemplary embodiments of the present disclosure will be described with reference to Fig. 11. Fig. 11 generally illustrates an exemplary structural block diagram of a non-3GPP access element 1100 according to any of the first to third exemplary embodiments of the present disclosure. The non-3GPP access element 1100 in Fig. 11 may implement the method 300 with reference to Fig. 3. Therefore, some detailed description of the non-3GPP access element 1100 may refer to the corresponding description of the method 300 in Fig. 1 and the signaling sequence diagrams in Figs. 10A to 10C, and thus will be omitted here for simplicity.

[0388] As shown in FIG. 11, the non-3GPP access element 1100 may include at least a transmitting unit 1101.

[0389] The sending unit 1101 may be configured to send a list of networks, through which each network the non-3GPP access element may have at least support for UE identity privacy.

[0390] In an example embodiment, the non-3GPP access element may further have support for connectivity with an AAA entity for access authentication via each network in the list of networks.

[0391] In an example embodiment, the non-3GPP access element 1100 may include a receiving unit (not shown), which may be configured to receive an access authentication request message including the UE's identity from the UE. The sending unit 1101 may then be configured to send the authentication request message including the UE's identity to an AAA entity.

[0392] In an example embodiment, the identity of the UE may include a masked identity of the UE or a first identity of the UE.

[0393] In an example embodiment, the concealed identity of the UE may include a SUCI of the UE, and the first identity of the UE may include an IMSI of the UE.

[0394] In an example embodiment, the authentication request message may further include an access network identification information of the non-3GPP access network.

[0395] In an example embodiment, the list of networks may include a list of PLMNs, and the AAA entity may include a 3GPP AAA server.

[0396] Hereinafter, another exemplary structure of a non-3GPP access element 1200 according to any of the first to third exemplary embodiments of the present disclosure will be described with reference to Fig. 12. Fig. 12 generally illustrates an exemplary structural block diagram of a non-3GPP access element 1200 according to any of the first to third exemplary embodiments of the present disclosure. The non-3GPP access element 1200 in Fig. 12 may implement the method 300 as described above with reference to Fig. 3. Therefore, some detailed description of the non-3GPP access element 1200 may refer to the corresponding description of the method 300 in Fig. 3 and the signaling sequence diagrams in Figs. 10A to 10C, and thus will be omitted here for simplicity.

[0397] As shown in Figure 12, the non-3GPP access element 1200 includes at least one processor 1201 and at least one memory 1203. The at least one processor 1201 includes, for example, any suitable CPU (Central Processing Unit), microcontroller, DSP (Digital Signal Processor), etc., capable of executing computer program instructions. The at least one memory 1203 may be any combination of RAM (Random Access Memory) and ROM (Read Only Memory). The at least one processor memory 1203 may also include persistent storage, which may be, for example, any one or combination of magnetic, optical, or solid-state memory, or even remotely mounted memory.

[0398] The at least one memory 1203 stores instructions executable by the at least one processor 1201. The instructions, when loaded from the at least one memory 1203 and executed on the at least one processor 1201, may cause the non-3GPP access element 1200 to perform actions of procedures, such as those described above in relation to Figure 3, and thus are omitted here for simplicity.

[0399] Hereinafter, an exemplary structure of a UE according to any of the first to third exemplary embodiments of the present disclosure will be described with reference to Fig. 13. Fig. 13 generally illustrates an exemplary structural block diagram of a UE 1300 according to any of the first to third exemplary embodiments of the present disclosure. The UE 1300 in Fig. 13 may implement the method 400 as described above with reference to Fig. 4. Therefore, some detailed descriptions regarding the UE 1300 may refer to the corresponding descriptions of the method 400 in Fig. 4 and the signaling sequence diagrams in Figs. 10A to 10C, and thus are omitted here for simplicity.

[0400] As shown in FIG. 13, the UE 1300 may include at least a determining unit 1301 and a sending unit 1303.

[0401] The determining unit 1301 may be configured to determine whether UE identity privacy should be used for communication with the non-3GPP access network for the UE. The sending unit 1303 may be configured to send, according to a result of the determining, to a non-3GPP access element in the non-3GPP access network, a request message for access authentication, which may include the identity of the UE.

[0402] In an example embodiment, it is determined whether UE identity privacy should be used for communications with a non-3GPP access network for the UE based on at least one of the following: UE configuration, information about non-3GPP access elements in a non-3GPP access network, or Information about the UE's home network.

[0403] In an example embodiment, the UE 1300 may further include a configuration unit (not shown), which may be configured to receive or preconfigure a configuration for the UE. The configuration for the UE may include information indicating whether the UE has support for UE identity privacy.

[0404] In an example embodiment, the method may further include a receiving unit (not shown), which may be configured to receive information about the non-3GPP access element from the non-3GPP access element indicating whether the non-3GPP access element has support for UE identity privacy, and the information about the non-3GPP access element may include a list of networks, via each network, over which the non-3GPP access element may have at least support for UE identity privacy.

[0405] In an example embodiment, the non-3GPP access element may further have support for connectivity with an AAA entity for access authentication via each network in the list of networks.

[0406] In an example embodiment, the receiving unit may be further configured to receive, from the home network, information about the home network indicating whether the home network has support for UE identity privacy.

[0407] In an example embodiment, information about the home network indicating whether the home network may have support for UE identity privacy may be conveyed in a UPU procedure or a SoR procedure.

[0408] In an example embodiment, support for UE identity privacy may include support for UE identity privacy for non-3GPP access authentication.

[0409] In an example embodiment, if it is determined that UE identity privacy should be used, the access authentication request message may include a concealed identity of the UE, and if it is determined that UE identity privacy should not be used, the access authentication request message may include that a first identity of the UE should be used.

[0410] In an example embodiment, the concealed identity of the UE may include a SUCI of the UE, and the first identity of the UE may include an IMSI of the UE. In an example embodiment, communication with the non-3GPP access network may include NSWO from the non-3GPP access network for the UE.

[0411] In an example embodiment, the list of networks may include a list of PLMNs, and the AAA entity may include a 3GPP AAA server.

[0412] Hereinafter, another exemplary structure of a UE according to another exemplary embodiment of the present disclosure will be described with reference to Figure 14. Figure 14 generally illustrates an exemplary structural block diagram of a UE 1400 according to an exemplary embodiment of the present disclosure. The UE 1400 of Figure 14 may implement the method 400 as described above with reference to Figure 4. Therefore, some detailed description of the UE 1400 may refer to the corresponding description of the method 400 of Figure 4 and the signaling sequence diagrams of Figures 10A to 10C, and thus will be omitted here for simplicity.

[0413] As shown in FIG. 14, the UE 1400 includes at least one processor 1401 and at least one memory 1403. The at least one processor 1401 can execute computer program instructions and includes, for example, any suitable CPU (Central Processing Unit), microcontroller, DSP (Digital Signal Processor), etc. The at least one memory 1403 can be any combination of RAM (Random Access Memory) and ROM (Read Only Memory). The at least one processor memory 1403 can also include persistent storage, which can be, for example, any one or combination of magnetic, optical, or solid-state memory, or even remotely mounted memory.

[0414] The at least one memory 1403 stores instructions executable by the at least one processor 1401. The instructions, when loaded from the at least one memory 1403 and executed on the at least one processor 1401, may cause the UE 1400 to perform actions of procedures, such as those described above in relation to FIG. 4, and thus are omitted here for simplicity.

[0415] Hereinafter, an exemplary structure of an AAA entity according to any of the first to third exemplary embodiments of the present disclosure will be described with reference to FIG. 15. FIG. 15 illustrates an exemplary structural block diagram of an AAA entity 1500 according to any of the first to third exemplary embodiments of the present disclosure. The AAA entity 1500 in FIG. 15 may implement the method 500A according to the first exemplary embodiment as described above with reference to FIG. 5A, the method 500B according to the second exemplary embodiment as described above with reference to FIG. 5B, and the method 500C according to the third exemplary embodiment as described above with reference to FIG. 5C, respectively. Therefore, some detailed descriptions regarding the AAA entity 1500 may refer to the corresponding descriptions of the methods 500A-500C in FIG. 5A-5C, respectively, and the signaling sequence diagrams in FIG. 10A-10C, respectively, and are therefore omitted here for simplicity.

[0416] As shown in FIG. 15, the AAA entity 1500 may include at least a receiving unit 1501, a detecting unit 1503, and a sending unit 1505.

[0417] In the first exemplary embodiment described with reference to Figures 5A and 10A, the receiving unit 1501 may be configured to receive an authentication request message including an identity of a UE to be authenticated from a non-3GPP access element, where the identity of the UE may include a masked identity of the UE or a first identity of the UE. The detecting unit 1503 may be configured to detect the identity of the UE from the received authentication request message. The sending unit 1505 may be configured to send a first request message for authentication credentials, which may include at least the detected identity of the UE, to the interworking entity.

[0418] In an example embodiment, the first request message for authentication credentials may be sent to the interworking entity via a routing entity.

[0419] In an example embodiment, if the UE identity in the received authentication request message may include a UE anonymized identity, the UE anonymized identity may be detected, and a first request message for authentication credentials may include the detected UE anonymized identity and may be sent to the interworking entity over a Diameter-based interface supporting the UE anonymized identity.

[0420] In an example embodiment, if the UE identity in the received authentication request message may include the UE first identity or the UE anonymized identity protected with a null scheme, the UE first identity may be detected, and the authentication credential first request message may include the UE first identity and may be sent to the interworking entity over a Diameter-based interface supporting the UE first identity.

[0421] In an exemplary embodiment, the receiving unit 1501 may be further configured to receive a first response message of authentication credentials from the interworking entity, where the message may include an authentication method selected by an authentication entity in a 5GC associated with the UE or requested by an authentication entity in a 5GC from an authentication entity in an EPC associated with the UE, an authentication vector generated by the authentication entity in the 5GC or requested by the authentication entity in the 5GC from the authentication entity in the EPC, and a first identification information of the UE obtained from the detected UE identification information.

[0422] In an example embodiment, the concealed identity of the UE may include a SUCI of the UE, and the first identity of the UE may include an IMSI of the UE.

[0423] In an exemplary embodiment, the request message for authentication may further include access network identification information associated with the non-3GPP access element, and the first request message for authentication credentials may further include access network identification information associated with the non-3GPP access element.

[0424] In an example embodiment, the AAA entity may include a 3GPP AAA server, the routing entity may include an SLF / DRA, and the network repository entity may include an NRF.

[0425] In the second exemplary embodiment described with reference to Figures 5B and 10B, the receiving unit 1501 may be configured to receive an authentication request message from a non-3GPP access element, the authentication request message including the anonymized identity of the UE to be authenticated. The detecting unit 1503 may be configured to detect the anonymized identity of the UE from the received authentication request message. The sending unit 1505 may be configured to send an identity request message including the detected anonymized identity of the UE to the interworking entity.

[0426] In an example embodiment, the identity request message may be sent to the interworking entity via a routing entity.

[0427] In an example embodiment, the UE's anonymized identity may include the UE's SUCI.

[0428] In an example embodiment, the receiving unit 1501 may be further configured to receive an identity response message including a first identity of the UE from the interworking entity, the message being converted from a second identity of the UE by the interworking entity and then deciphered from the anonymized identity of the UE by an authentication entity in the 5GC associated with the UE. And the sending unit 1505 may be further configured to forward the identity response message to an AAA entity.

[0429] In an example embodiment, the identity request message may be sent over a Diameter-based interface supporting the concealed identity of the UE, and the identity response message may be received over the Diameter-based interface.

[0430] In an example embodiment, the transmitting unit 1505 may be further configured to transmit a second request message for authentication credentials, which may include at least the first identification information of the received UE, to an authentication entity in the EPC associated with the UE. Also, the receiving unit 1501 may be further configured to receive a second response message for authentication credentials from the authentication entity in the EPC, which may include an authentication method selected by the authentication entity in the EPC or requested by the authentication entity in the EPC from the authentication entity in the 5GC, and an authentication vector generated by the authentication entity in the EPC or requested by the authentication entity in the EPC from the authentication entity in the 5GC.

[0431] In an example embodiment, the first identity of the UE may include an IMSI of the UE, and the second identity of the UE may include a SUPI of the UE.

[0432] In an example embodiment, the AAA entity may include a 3GPP AAA server, the routing entity may include an SLF / DRA, and the network repository entity may include an NRF.

[0433] In the third exemplary embodiment described with reference to Figures 5C and 10C, the receiving unit 1501 may be configured to receive an authentication request message including an anonymized identity of a UE to be authenticated from a non-3GPP access element. The detecting unit 1503 may be configured to detect the anonymized identity of the UE from the received authentication request message. The sending unit 1505 may be configured to send a third request message for authentication credentials, which may include at least the detected anonymized identity of the UE, to an authentication entity in an EPC associated with the UE.

[0434] In an example embodiment, the AAA entity 1500 may further include a selection unit (not shown), which may be configured to select an authentication entity in the EPC within the network repository entity based on the anonymized identity of the detected UE. The sending unit 1505 may further be configured to send a third request message for authentication credentials to the selected authentication entity in the EPC.

[0435] In an example embodiment, an authentication entity in the EPC may be selected within an entity of a network repository based on a routing indicator included in the anonymized identity of the detected UE.

[0436] In an example embodiment, the third request message for authentication credentials may be sent to the interworking entity via the routing entity.

[0437] In an example embodiment, the UE's anonymized identity may include the UE's SUCI.

[0438] In an exemplary embodiment, the receiving unit 1501 may be further configured to receive a third response message of authentication credentials from an authentication entity in the EPC, where the message may include an authentication method selected by the authentication entity in the EPC or requested by the authentication entity in the EPC from the authentication entity in the 5GC associated with the UE, an authentication vector generated by the authentication entity in the EPC or requested by the authentication entity in the EPC from the authentication entity in the 5GC, and a first identification information of the UE obtained from the anonymized identification information of the UE.

[0439] In an example embodiment, the third request message for authentication credentials may be sent over a Diameter-based interface supporting the anonymized identity of the UE, and the third response message for authentication credentials may be received over the Diameter-based interface.

[0440] In an example embodiment, the first identification information of the UE may include an IMSI of the UE.

[0441] In an example embodiment, the AAA entity may include a 3GPP AAA server, the routing entity may include an SLF / DRA, and the network repository entity may include an NRF.

[0442] Hereinafter, another exemplary structure of an AAA entity according to any of the first to third exemplary embodiments of the present disclosure will be described with reference to FIG. 16. FIG. 16 generally illustrates an exemplary structural block diagram of an AAA entity 1600 according to any of the first to third exemplary embodiments of the present disclosure. The AAA entity 1600 in FIG. 16 may implement the method 500A according to the first exemplary embodiment as described above with reference to FIG. 5A, the method 500B according to the second exemplary embodiment as described above with reference to FIG. 5B, and the method 500C according to the third exemplary embodiment as described above with reference to FIG. 5C, respectively. Therefore, some detailed descriptions regarding the AAA entity 1600 may refer to the corresponding descriptions of the methods 500A-500C in FIG. 5A-5C, respectively, and the signaling sequence diagrams in FIG. 10A-10C, respectively, and are therefore omitted here for simplicity.

[0443] As shown in FIG. 16, the AAA entity 1600 includes at least one processor 1601 and at least one memory 1603. The at least one processor 1601 includes, for example, any suitable CPU (Central Processing Unit), microcontroller, DSP (Digital Signal Processor), etc., capable of executing computer program instructions. The at least one memory 1603 may be any combination of RAM (Random Access Memory) and ROM (Read Only Memory). The at least one processor memory 1603 may also include persistent storage, which may be, for example, any one or combination of magnetic, optical, or solid-state memory, or even remotely mounted memory.

[0444] The at least one memory 1603 stores instructions executable by the at least one processor 1601. The instructions, when loaded from the at least one memory 1603 and executed on the at least one processor 1601, may cause the AAA entity 1600 to perform actions of respective procedures, such as those described above in relation to Figures 5A-5C, and thus are omitted here for simplicity.

[0445] Hereinafter, an exemplary structure of a routing entity according to any of the first to second exemplary embodiments of the present disclosure will be described with reference to FIG. 17A. FIG. 17A illustrates an exemplary structural block diagram of a routing entity 1700 according to any of the first to second exemplary embodiments of the present disclosure. The routing entity 1700 in FIG. 17A may implement the method 600A according to the first exemplary embodiment as described above with reference to FIG. 6A, and the method 600B according to the second exemplary embodiment as described above with reference to FIG. 6B, respectively. Therefore, some detailed descriptions regarding the routing entity 1700 may refer to the corresponding descriptions of the methods 600A and 600B in FIG. 6A and FIG. 6B, respectively, and the signaling sequence diagrams in FIG. 10A and FIG. 10B, respectively, and are therefore omitted here for simplicity.

[0446] As shown in FIG. 17A , the routing entity 1700 may include at least a receiving unit 1701 and a sending unit 1703.

[0447] In the first exemplary embodiment described with reference to Figures 6A and 10A, the receiving unit 1701 may be configured to receive, from an AAA entity, a first request message for authentication credentials, which may include at least an identity of a UE to be authenticated, and the identity of the UE may include a masked identity of the UE or a first identity of the UE. The sending unit 1703 may be configured to forward the first request message for authentication credentials to an interworking entity.

[0448] In an example embodiment, if the identity of the UE may include an anonymized identity of the UE, the first request message for authentication credentials may be received and forwarded over a Diameter-based interface supporting the anonymized identity of the UE.

[0449] In an exemplary embodiment, if the UE identification information may include a first identification information of the UE, the first request message for authentication credentials may be received and forwarded over a Diameter-based interface supporting the first identification information of the UE.

[0450] In an example embodiment, the receiving unit 1701 may be further configured to receive a first response message of authentication credentials from the interworking entity, and the message may include an authentication method selected by an authentication entity in the 5GC associated with the UE or requested by an authentication entity in the 5GC from an authentication entity in the EPC associated with the UE, an authentication vector generated by an authentication entity in the 5GC or requested by an authentication entity in the 5GC from an authentication entity in the EPC, and a first identification information of the UE obtained from the identification information of the UE. The sending unit 1703 may be further configured to forward the first response message of authentication credentials to an AAA entity.

[0451] In an example embodiment, the concealed identity of the UE may include a SUCI of the UE, and the first identity of the UE may include an IMSI of the UE.

[0452] In an example embodiment, the first request message for authentication credentials may further include access network identification information associated with the non-3GPP access element to which the UE is connected.

[0453] In an example embodiment, the routing entity may include an SLF / DRA, the AAA entity may include a 3GPP AAA server, and the network repository entity may include an NRF.

[0454] In the second exemplary embodiment described with reference to Figures 6B and 10B, the receiving unit 1701 may be configured to receive an identity request message from an AAA entity, the identity request message including the anonymized identity of the UE to be authenticated, and the sending unit 1703 may be configured to forward the identity request message to an interworking entity.

[0455] In an example embodiment, the UE's anonymized identity may include the UE's SUCI.

[0456] In an example embodiment, the receiving unit 1701 may be further configured to receive an identity response message including a first identity of the UE from the interworking entity, which may be converted from a second identity of the UE by the interworking entity and then deciphered from the anonymized identity of the UE by an authentication entity in the 5GC associated with the UE.

[0457] In an example embodiment, the identity request message may be received and forwarded over a Diameter-based interface supporting the UE's masked identity, and the UE's identity response message may be received and forwarded over a Diameter-based interface.

[0458] In an example embodiment, the receiving unit 1701 may be further configured to receive, from an AAA entity, a second request message for authentication credentials of the UE, which may include at least the first identification information of the received UE. The sending unit 1703 may be further configured to forward the received second request message for authentication credentials to an authentication entity in an EPC associated with the UE.

[0459] In an example embodiment, the first identity of the UE may include an IMSI of the UE, and the second identity of the UE may include a SUPI of the UE.

[0460] In an example embodiment, the receiving unit 1701 may be further configured to receive a second response message of authentication credentials from an authentication entity in the EPC, the message may include an authentication method selected by the authentication entity in the EPC or requested by the authentication entity in the EPC from the authentication entity in the 5GC, and an authentication vector generated by the authentication entity in the EPC or requested by the authentication entity in the EPC from the authentication entity in the 5GC. The sending unit 1703 may be further configured to forward the received second response message of authentication credentials to an AAA entity.

[0461] In an example embodiment, the routing entity may include an SLF / DRA, the AAA entity may include a 3GPP AAA server, and the network repository entity may include an NRF.

[0462] Hereinafter, an exemplary structure of a routing entity according to the third exemplary embodiment of the present disclosure will be described with reference to FIG. 17B. FIG. 17B illustrates an exemplary structural block diagram of a routing entity 1700′ according to the third exemplary embodiment of the present disclosure. The routing entity 1700′ in FIG. 17B may implement the method 600C according to the third exemplary embodiment as described above with reference to FIG. 6C. Therefore, some detailed descriptions regarding the routing entity 1700′ may refer to the corresponding descriptions of the method 600C in FIG. 6C and the signaling sequence diagram in FIG. 10C, and are therefore omitted here for simplicity.

[0463] As shown in FIG. 17B, the routing entity 1700' may include at least a receiving unit 1701', a selecting unit 1702', and a sending unit 1703'.

[0464] In the third exemplary embodiment described with reference to Figures 6C and 10C, the receiving unit 1701' may be configured to receive a third request message for authentication credentials from an AAA entity, which may include at least an anonymized identity of the UE to be authenticated. The selecting unit 1702' may be configured to select an authentication entity in the EPC based on the received anonymized identity of the UE in the network repository entity. The sending unit 1703' may be configured to forward the third request message for authentication credentials to the selected authentication entity in the EPC.

[0465] In an example embodiment, an authentication entity in the EPC may be selected within an entity of a network repository based on a routing indicator included in the masked identity of the UE.

[0466] In an example embodiment, the receiving unit 1701' may be further configured to receive a third response message of authentication credentials from an authentication entity in the EPC, the message may include an authentication method selected by the authentication entity in the EPC or requested by the authentication entity in the EPC from an authentication entity in the 5GC associated with the UE, an authentication vector generated by the authentication entity in the EPC or requested by the authentication entity in the EPC from an authentication entity in the 5GC, and a first identity of the UE obtained from the anonymized identity of the UE. The sending unit 1703' may be further configured to forward the second response message of the received authentication credentials to an AAA entity.

[0467] In an example embodiment, the third request message for authentication credentials may be received and forwarded over a Diameter-based interface supporting the masked identity of the UE, and the third response message for authentication credentials may be received and forwarded over a Diameter-based interface.

[0468] In an example embodiment, the concealed identity of the UE may include a SUCI of the UE, and the first identity of the UE may include an IMSI of the UE.

[0469] In an example embodiment, the routing entity may include an SLF / DRA, the AAA entity may include a 3GPP AAA server, and the network repository entity may include an NRF.

[0470] Hereinafter, another exemplary structure of a routing entity according to any of the first to third exemplary embodiments of the present disclosure will be described with reference to FIG. 18. FIG. 18 illustrates an exemplary structural block diagram of a routing entity 1800 according to any of the first to third exemplary embodiments of the present disclosure. The routing entity 1800 in FIG. 18 may implement the method 600A according to the first exemplary embodiment as described above with reference to FIG. 6A, the method 600B according to the second exemplary embodiment as described above with reference to FIG. 6B, and the method 600C according to the third exemplary embodiment as described above with reference to FIG. 6C, respectively. Therefore, some detailed descriptions regarding the routing entity 1800 may refer to the corresponding descriptions of the methods 600A to 600C in FIG. 6A to FIG. 6C, respectively, and the signaling sequence diagrams in FIG. 10A to FIG. 10C, respectively, and are therefore omitted here for simplicity.

[0471] As shown in Figure 18, the routing entity 1800 includes at least one processor 1801 and at least one memory 1803. The at least one processor 1801 includes, for example, any suitable CPU (Central Processing Unit), microcontroller, DSP (Digital Signal Processor), etc., capable of executing computer program instructions. The at least one memory 1803 may be any combination of RAM (Random Access Memory) and ROM (Read Only Memory). The at least one processor memory 1803 may also include persistent storage, which may be, for example, any one or combination of magnetic, optical, or solid-state memory, or even remotely mounted memory.

[0472] The at least one memory 1803 stores instructions executable by the at least one processor 1801. The instructions, when loaded from the at least one memory 1803 and executed on the at least one processor 1801, may cause the routing entity 1800 to perform actions of respective procedures, such as those described above in relation to Figures 6A-6C, and thus are omitted here for simplicity.

[0473] Hereinafter, an exemplary structure of an interworking entity according to any of the first to second exemplary embodiments of the present disclosure will be described with reference to FIG. 19. FIG. 19 illustrates an exemplary structural block diagram of an interworking entity 1900 according to any of the first to second exemplary embodiments of the present disclosure. The interworking entity 1900 in FIG. 19 may implement the method 700A according to the first exemplary embodiment as described above with reference to FIG. 7A, and the method 700B according to the second exemplary embodiment as described above with reference to FIG. 7B, respectively. Therefore, some detailed descriptions regarding the routing entity 1700 may refer to the corresponding descriptions of the methods 700A and 700B in FIG. 7A and FIG. 7B, respectively, and the signaling sequence diagrams in FIG. 10A and FIG. 10B, respectively, and are therefore omitted here for simplicity.

[0474] As shown in FIG. 19, the interworking entity 1900 may include at least a receiving unit 1901, a selecting unit 1903, and a sending unit 1905.

[0475] In the first exemplary embodiment described with reference to Figures 7A and 10A, the receiving unit 1901 may be configured to receive a first request message for authentication credentials from an AAA entity, which may include at least an identification information of a UE to be authenticated, and the received UE identification information may include a masked identification information of the UE or a first identification information of the UE. The selecting unit 1903 may be configured to select an authentication entity in the 5GC associated with the UE based on the received UE identification information. The sending unit 1905 may be configured to send a fourth request message for authentication credentials to the selected authentication entity in the 5GC.

[0476] In an example embodiment, the first request message for authentication credentials may be received from an AAA entity via a routing entity.

[0477] In an exemplary embodiment, the receiving unit 1901 may be further configured to receive a fourth response message of authentication credentials from a selected authentication entity in the 5GC, and the fourth response message of authentication credentials may include at least an authentication method selected by the selected authentication entity in the 5GC or requested by the selected authentication entity in the 5GC from an authentication entity in an EPC associated with the UE, and an authentication vector generated by the selected authentication entity in the 5GC or requested by the selected authentication entity in the 5GC from an authentication entity in the EPC.

[0478] In an example embodiment, if the received UE identity includes an anonymized UE identity, the first request message for authentication credentials may be received over a Diameter-based interface supporting the anonymized UE identity, an authentication entity in 5GC may be selected based on a routing indicator included in the received UE anonymized identity, the fourth request message for authentication credentials may include at least an indication that the requesting node is an AAA entity and the anonymized UE identity, and the fourth response message for authentication credentials may further include a second identity of the UE that has been de-anonymized by the authentication entity in 5GC from the anonymized UE identity.

[0479] In an example embodiment, if the received UE identity includes a UE first identity, a first request message for authentication credentials may be received over a Diameter-based interface supporting the UE first identity, an authentication entity within the 5GC may be selected based on the UE first identity, a fourth request message for authentication credentials may include at least an indication that the requesting node is an AAA entity and a second identity of the UE converted from the UE first identity by the interworking entity, and the fourth response message for authentication credentials may further include the second identity of the UE.

[0480] In an example embodiment, the fourth request message for authentication credentials may further include access network identification information associated with the non-3GPP access element to which the UE is connected.

[0481] In an example embodiment, the sending unit 1905 may be further configured to send, to the AAA entity, a first response message of the authentication credentials, which may include the authentication method, the authentication vector, and a first identification information of the UE obtained from the received UE identification information.

[0482] In an example embodiment, the concealed identity of the UE may include a SUCI of the UE, and the first identity of the UE may include an IMSI of the UE.

[0483] In an example embodiment, the routing entity may include an SLF / DRA, and the AAA entity may include a 3GPP AAA server.

[0484] In the second exemplary embodiment described with reference to Figures 7B and 10B, the receiving unit 1901 may be configured to receive an identity request message including the anonymized identity of the UE to be authenticated from an AAA entity. The selecting unit 1903 may be configured to select an authentication entity in 5GC associated with the UE based on the received anonymized identity of the UE. The sending unit 1905 may be configured to send an identity de-anonymization request message, which may include the received anonymized identity of the UE, to the selected authentication entity in 5GC.

[0485] In an example embodiment, the identity request message may be received from an AAA entity via a routing entity.

[0486] In an example embodiment, the identity request message may be received over a Diameter based interface supporting the anonymized identity of the UE, and an authentication entity within the 5GC associated with the UE may be selected based on a routing indicator included in the received anonymized identity of the UE.

[0487] In an example embodiment, the UE's anonymized identity may include the UE's SUCI.

[0488] In an example embodiment, the receiving unit 1901 may be further configured to receive an identity de-ciphering response message from the selected authentication entity in the 5GC, which may include a second identity of the UE that is deciphered from the anonymized identity of the UE by the selected authentication entity in the 5GC. The interworking entity 1900 may further include a conversion unit (not shown) that may be configured to convert the received second identity of the UE into a first identity of the UE. The sending unit 1905 may be further configured to send the identity response message including the first identity of the UE to the AAA entity.

[0489] In an example embodiment, the first identity of the UE may include an IMSI of the UE, and the second identity of the UE may include a SUPI of the UE.

[0490] In an example embodiment, the routing entity may include an SLF / DRA, and the AAA entity may include a 3GPP AAA server.

[0491] Hereinafter, another exemplary structure of an interworking entity according to any of the first to second exemplary embodiments of the present disclosure will be described with reference to FIG. 20. FIG. 20 generally illustrates an exemplary structural block diagram of an interworking entity 2000 according to any of the first to second exemplary embodiments of the present disclosure. The interworking entity 2000 of FIG. 20 may implement the method 700A according to the first exemplary embodiment as described above with reference to FIG. 7A, and the method 700B according to the second exemplary embodiment as described above with reference to FIG. 7B, respectively. Therefore, some detailed descriptions regarding the interworking entity 2000 may refer to the corresponding descriptions of the respective methods 700A and 700B in FIG. 7A and FIG. 7B, respectively, and the respective signaling sequence diagrams in FIG. 10A and FIG. 10B, and are therefore omitted here for simplicity.

[0492] As shown in Figure 20, the interworking entity 2000 includes at least one processor 2001 and at least one memory 2003. The at least one processor 2001 includes, for example, any suitable CPU (Central Processing Unit), microcontroller, DSP (Digital Signal Processor), etc., capable of executing computer program instructions. The at least one memory 2003 may be any combination of RAM (Random Access Memory) and ROM (Read Only Memory). The at least one processor memory 2003 may also include persistent storage, which may be, for example, any one or combination of magnetic, optical, or solid-state memory, or even remotely mounted memory.

[0493] The at least one memory 2003 stores instructions executable by the at least one processor 2001. The instructions, when loaded from the at least one memory 2003 and executed on the at least one processor 2001, may cause the interworking entity 2000 to perform actions of respective procedures, such as those described above in relation to Figures 7A and 7B, and therefore omitted here for simplicity.

[0494] Hereinafter, an exemplary structure of an authentication entity in 5GC according to a first exemplary embodiment of the present disclosure will be described with reference to FIG. 21A. FIG. 21A illustrates an exemplary structural block diagram of an authentication entity 2100 in 5GC according to a first exemplary embodiment of the present disclosure. The authentication entity 2100 in 5GC in FIG. 21A may implement the method 800A as described above with reference to FIG. 8A. Therefore, some detailed description of the authentication entity 2100 in 5GC may refer to the corresponding description of the method 800A in FIG. 7A and the signaling sequence diagram in FIG. 10A, and thus will be omitted here for simplicity.

[0495] As shown in FIG. 21A, an authentication entity 2100 in 5GC may include at least a receiving unit 2101 and a transmitting unit 2103.

[0496] The receiving unit 2101 may be configured to receive, from the interworking entity, a fourth request message for authentication credentials of the UE to be authenticated, which may include at least an indication that the requesting node is an AAA entity and an identification information of the UE. The sending unit 2103 may be configured to send a fourth response message for the authentication credentials to the interworking entity.

[0497] In an example embodiment, the fourth request message for authentication credentials may further include access network identification information associated with the non-3GPP access element to which the UE is connected.

[0498] In an example embodiment, the received UE identity may include a masked UE identity. The authentication entity 2100 in the 5GC may further include an acquisition unit (not shown), which may be configured to de-mask a second UE identity from the received masked UE identity.

[0499] In an example embodiment, the received UE identification information may include a second identification information of the UE.

[0500] In an exemplary embodiment, the obtaining unit may be configured to select an authentication method for the UE based at least on the indication that the requesting node is an AAA entity and the second identification information of the UE, and to generate an authentication vector for the UE based at least on the second identification information of the UE.

[0501] In an example embodiment, the sending unit 2103 may be further configured to send a fifth request message for authentication credentials, which may include at least an indication that the requesting node is an AAA entity and an identification information of the UE, to an authentication entity in the EPC. The receiving unit 2103 may be further configured to receive a fifth response message for authentication credentials, which may include an authentication method of the UE and an authentication vector of the UE, from the authentication entity in the EPC.

[0502] In an example embodiment, the concealed identity of the UE may include a SUCI of the UE, and the second identity of the UE may include a SUPI of the UE.

[0503] In an example embodiment, the fifth request message for authentication credentials may further include access network identification information associated with the non-3GPP access element to which the UE is connected.

[0504] In an example embodiment, the AAA entity may include a 3GPP AAA server.

[0505] Hereinafter, an exemplary structure of an authentication entity in 5GC according to any of the second and third exemplary embodiments of the present disclosure will be described with reference to FIG. 21B. FIG. 21B illustrates an exemplary structural block diagram of an authentication entity 2100' in 5GC according to any of the second and third exemplary embodiments of the present disclosure. The authentication entity 2100' in 5GC in FIG. 21B may implement the method 800B as described above with reference to FIG. 8B, and the method 800C as described above with reference to FIG. 8C, respectively. Therefore, some detailed description of the authentication entity 2100' in 5GC may refer to the corresponding description of the methods 800B and 800C in FIG. 7B and FIG. 7C, respectively, and the signaling sequence diagrams in FIG. 10B and FIG. 10C, respectively, and thus will be omitted here for simplicity.

[0506] As shown in FIG. 21B, an authentication entity 2100' in 5GC may include at least a receiving unit 2101, an acquiring unit 2102' and a sending unit 2103'.

[0507] In the second exemplary embodiment described with reference to Figures 8B and 10B, the receiving unit 2101' may be configured to receive an identity unmasking request message, which may include the masked identity of the UE to be authenticated, from the interworking entity. The obtaining unit 2102' may be configured to unmask a second identity of the UE from the received masked identity of the UE. The sending unit 2103' may be configured to send an identity unmasking response message, which may include the second identity of the UE, to the interworking entity.

[0508] In an example embodiment, the concealed identity of the UE may include a SUCI of the UE, and the second identity of the UE may include a SUPI of the UE.

[0509] In the third exemplary embodiment described with reference to Figures 8C and 10C, the receiving unit 2101' may be configured to receive a sixth request message of authentication credentials from an authentication entity in an EPC associated with the UE to be authenticated, the sixth request message may include at least an indication that the requesting node is an AAA entity and an anonymized identity of the UE. The obtaining unit 2102' may be configured to obtain a first identity or a second identity of the UE from the anonymized identity of the UE. The sending unit 2103' may be configured to send a sixth response message of authentication credentials to the authentication entity in the EPC, the sixth response message may include at least the obtained first identity or the second identity of the UE.

[0510] In an exemplary embodiment, the obtaining unit 2102′ may be further configured to: de-anonymize a second identity of the UE from the anonymized identity of the UE, and convert the second identity of the UE into a first identity of the UE.

[0511] In an example embodiment, the obtaining unit 2102' may be further configured to decipher a second identity of the UE from the anonymized identity of the UE.

[0512] In an example embodiment, the obtaining unit 2102' may be further configured to obtain authentication credentials of the UE, and the sixth response message of the authentication credentials may further include the authentication credentials of the UE.

[0513] In an example embodiment, the UE authentication credentials may include a UE authentication method and a UE authentication vector. The obtaining unit 2102′ may be further configured to select, based at least on the indication that the requesting node is an AAA entity and the second identification information of the UE, an authentication method for the UE, and generate, based at least on the second identification information of the UE, an authentication vector for the UE.

[0514] In an example embodiment, the concealed identity of the UE may include a SUCI of the UE, the first identity of the UE may include an IMSI of the UE, and the second identity of the UE may include a SUPI of the UE.

[0515] In an example embodiment, the sixth request message for authentication credentials may further include an access network identification information associated with the non-3GPP access element to which the UE is connected.

[0516] In an example embodiment, the AAA entity may include a 3GPP AAA server.

[0517] Hereinafter, another exemplary structure of an authentication entity in 5GC according to any of the first to third exemplary embodiments of the present disclosure will be described with reference to FIG. 22. FIG. 22 illustrates an exemplary structural block diagram of an authentication entity in 5GC 2200 according to any of the first to third exemplary embodiments of the present disclosure. The authentication entity in 5GC 2200 may implement the method 800A according to the first exemplary embodiment as described above with reference to FIG. 8A, the method 800B according to the second exemplary embodiment as described above with reference to FIG. 8B, and the method 800C according to the third exemplary embodiment as described above with reference to FIG. 8C, respectively. Therefore, some detailed descriptions of the authentication entity in 5GC 2200 may refer to the corresponding descriptions of the methods 800A to 800C in each of FIGS. 8A to 8C, and the signaling sequence diagrams in each of FIGS. 10A to 10C, respectively, and are therefore omitted here for simplicity.

[0518] As shown in FIG. 22, the authentication entity 2200 in the 5GC includes at least one processor 2201 and at least one memory 2203. The at least one processor 2201 can execute computer program instructions, including, for example, any suitable CPU (Central Processing Unit), microcontroller, DSP (Digital Signal Processor), etc. The at least one memory 2203 can be any combination of RAM (Random Access Memory) and ROM (Read Only Memory). The at least one processor memory 2203 can also include persistent storage, which can be, for example, any one or combination of magnetic, optical, or solid-state memory, or even remotely mounted memory.

[0519] The at least one memory 2203 stores instructions executable by the at least one processor 2201. The instructions, when loaded from the at least one memory 2203 and executed on the at least one processor 2201, may cause the authentication entity 2200 in the 5GC to perform actions of respective procedures, such as those described above in relation to Figures 8A-8C, and thus are omitted here for simplicity.

[0520] Hereinafter, an exemplary structure of an authentication entity in an EPC according to a first exemplary embodiment of the present disclosure will be described with reference to Figure 23A. Figure 23A illustrates an exemplary structural block diagram of an authentication entity in an EPC 2300 according to a first exemplary embodiment of the present disclosure. The authentication entity in an EPC 2300 in Figure 23A may implement the method 900A as described above with reference to Figure 9A. Therefore, some detailed description of the authentication entity in an EPC 2300 may refer to the corresponding description of the method 900A in Figure 9A and the signaling sequence diagram in Figure 10A, and thus will be omitted here for simplicity.

[0521] As shown in FIG. 23A , an authentication entity 2300 in an EPC may include at least a receiving unit 2301, an acquiring unit 2303, and a sending unit 2305.

[0522] The receiving unit 2301 may be configured to receive a fifth request message for authentication credentials from an authentication entity in the 5GC associated with the UE to be authenticated, the fifth request message may include at least an indication that the requesting node is an AAA entity and a first identification information of the UE. The acquiring unit 2303 may be configured to acquire authentication credentials of the UE. The sending unit 2305 may be configured to send a fifth response message for authentication credentials to the authentication entity in the 5GC, the fifth response message may include the acquired authentication credentials of the UE.

[0523] In an example embodiment, the UE authentication credentials may include an authentication method of the UE and an authentication vector of the UE. The obtaining unit 2303 may be further configured to select an authentication method of the UE based at least on the indication that the requesting node is an AAA entity and the first identification information of the UE, and generate an authentication vector of the UE based at least on the first identification information of the UE.

[0524] In an example embodiment, the first identification information of the UE may include an IMSI of the UE.

[0525] In an example embodiment, the fifth request message for authentication credentials may further include access network identification information associated with the non-3GPP access element to which the UE is connected.

[0526] Hereinafter, an exemplary structure of an authentication entity in an EPC according to a third exemplary embodiment of the present disclosure will be described with reference to Figure 23B. Figure 23B illustrates an exemplary structural block diagram of an authentication entity in an EPC 2300' according to a third exemplary embodiment of the present disclosure. The authentication entity in an EPC 2300' in Figure 23B may implement the method 900C as described above with reference to Figure 9B. Therefore, some detailed description of the authentication entity in an EPC 2300' may refer to the corresponding description of the method 900C in Figure 9B and the signaling sequence diagram in Figure 10C, and thus will be omitted here for simplicity.

[0527] As shown in FIG. 23C, an authentication entity 2300' in an EPC may include at least a receiving unit 2301'.

[0528] The receiving unit 2301' may be configured to receive, from an AAA entity, a third request message for authentication credentials, which may include at least the anonymized identity information of the UE to be authenticated.

[0529] In an example embodiment, the authentication entity in the EPC 2300' may further include a transmitting unit (not shown) that may be configured to transmit a sixth request message for authentication credentials, which may include at least an indication that the requesting node is an AAA entity and the anonymized identity of the UE, to the authentication entity in the 5GC associated with the UE. The receiving unit 2301' may further be configured to receive a sixth response message for authentication credentials, which may include at least the first identity or the second identity of the UE, which may be obtained from the anonymized identity of the UE, from the authentication entity in the 5GC.

[0530] In an exemplary embodiment, the sixth response message of the authentication credentials may further include authentication credentials of the UE, which may include an authentication method for the UE selected by the authentication entity within the 5GC and an authentication vector for the UE generated by the authentication entity within the 5GC.

[0531] In an exemplary embodiment, the authentication entity 2300′ in the EPC may further include an acquisition unit (not shown), which may be configured to select an authentication method for the UE based at least on the indication that the requesting node is an AAA entity and the first identification information of the UE, and to generate an authentication vector for the UE based at least on the first identification information of the UE.

[0532] In an exemplary embodiment, the sending unit may be further configured to send, to the AAA entity, a third response message of the authentication credentials, which may include the authentication method, the authentication vector, and the first identification information of the UE obtained from the second identification information of the UE.

[0533] In an example embodiment, the third request message for authentication credentials may be received over a Diameter-based interface supporting the anonymized identity of the UE, and the third response message for authentication credentials may be sent over the Diameter-based interface.

[0534] In an exemplary embodiment, the authentication entity in the EPC 2300′ may further include a registration unit (not shown) that may be configured to register, in a network repository entity, routing indicators supported by the authentication entity in the EPC.

[0535] In an example embodiment, the concealed identity of the UE may include a SUCI of the UE, the first identity of the UE may include an IMSI of the UE, and the second identity of the UE may include a SUPI of the UE.

[0536] In an example embodiment, the AAA entity may include a 3GPP AAA server.

[0537] Hereinafter, another exemplary structure of an authentication entity in an EPC according to any of the first to third exemplary embodiments of the present disclosure will be described with reference to FIG. 24. FIG. 24 illustrates an exemplary structural block diagram of an authentication entity in an EPC 2400 according to any of the first and third exemplary embodiments of the present disclosure. The authentication entity in an EPC 2400 may implement the method 900A according to the first exemplary embodiment as described above with reference to FIG. 9A, and the method 900C according to the third exemplary embodiment as described above with reference to FIG. 9B, respectively. Therefore, some detailed descriptions of the authentication entity in an EPC 2400 may refer to the corresponding descriptions of the methods 900A and 900C in FIG. 9A and FIG. 9C, respectively, and the signaling sequence diagrams in FIG. 10A and FIG. 10C, respectively, and are therefore omitted here for simplicity.

[0538] As shown in FIG. 24, the authentication entity 2400 in the EPC includes at least one processor 2401 and at least one memory 2403. The at least one processor 2401 includes, for example, any suitable CPU (Central Processing Unit), microcontroller, DSP (Digital Signal Processor), etc., capable of executing computer program instructions. The at least one memory 2403 may be any combination of RAM (Random Access Memory) and ROM (Read Only Memory). The at least one processor memory 2403 may also include persistent storage, which may be, for example, any one or combination of magnetic, optical, or solid-state memory, or even remotely mounted memory.

[0539] The at least one memory 2403 stores instructions executable by the at least one processor 2401. The instructions, when loaded from the at least one memory 2403 and executed on the at least one processor 2401, may cause the authentication entity 2400 in the EPC to perform actions of respective procedures, e.g., as described above in relation to Figures 9A and 9C, and are therefore omitted here for simplicity.

[0540] As will be appreciated by those skilled in the art, the concepts described herein may be embodied as a method, a data processing system, a computer program product, and / or a computer storage medium having an executable computer program stored thereon. Thus, the concepts described herein may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects, all generally referred to herein as "circuits" or "modules." Any process, step, action, and / or function described herein may be performed by and / or associated with a corresponding module, which may be implemented in software and / or firmware and / or hardware. Furthermore, the present disclosure may take the form of a computer program product on a tangible computer usable storage medium having computer program code embodied therein, which may be executed by a computer. Any suitable tangible computer readable medium may be utilized, including hard disks, CD-ROMs, electronic storage devices, optical storage devices, or magnetic storage devices.

[0541] Some embodiments are described herein with reference to flowchart illustrations and / or block diagrams of methods, systems, and computer program products. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer (thereby creating a special purpose computer), a special purpose computer, or other programmable data processing apparatus to produce a machine whereby the instructions, executed via the processor of the computer or other programmable data processing apparatus, create means for implementing the function / act specified in the block(s) of the flowchart illustrations and / or block diagrams.

[0542] These computer program instructions may also be stored in a computer-readable memory or storage medium that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture that includes instruction means for implementing the functions / acts specified in the flowchart and / or block diagram block(s).

[0543] The computer program instructions may also be loaded into a computer or other programmable data processing apparatus to cause a sequence of operational steps to be performed on the computer or other programmable data processing apparatus to generate a computer-implemented process, whereby the instructions, when executed on the computer or other programmable data processing apparatus, provide steps to implement the functions / operations specified in the block(s) of the flowcharts and / or block diagrams.

[0544] It should be understood that the functions / acts noted in the blocks may occur out of the order noted in the illustrations of the acts. For example, two blocks shown in succession may in fact be executed substantially simultaneously, depending on the functions / acts involved, or in some cases the blocks may be executed in the reverse order. Some of the figures include arrows on communication paths to indicate the primary direction of communication, but it should be understood that communication may occur in the opposite direction to that of the illustrated arrows.

[0545] Computer program code implementing the operations of the concepts described herein may be written in an object-oriented programming language such as Java or C++. However, computer program code implementing the operations of the present disclosure may also be written in a conventional procedural programming language such as the "C" programming language. The program code may run entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer. In the latter scenario, the remote computer may be connected to the user's computer through a local area network (LAN) or wide area network (WAN), or the connection may be made to an external computer (e.g., through the Internet using an Internet Service Provider).

[0546] Many different embodiments have been disclosed herein in connection with the above description and drawings. It will be understood that a verbatim description and illustration of every combination and subcombination of these embodiments would be overly repetitive and unclear. Thus, all embodiments can be combined in any manner and / or combination, and this specification, including the drawings, shall be construed as constituting a complete written description of every combination and subcombination of the embodiments described herein, as well as the manner and process of making and using them, and shall support the rights to any such combination or subcombination.

[0547] Those skilled in the art will recognize that the embodiments described herein are not limited to those that have been particularly shown and described herein above. In addition, it should be noted that, unless otherwise noted above to the contrary, all of the accompanying drawings are not to scale. Various modifications and variations are possible in light of the above teachings. Illustrative embodiments of the techniques and apparatus described herein include, but are not limited to, the examples listed below.

[0548] Group A Embodiments A method (500C) implemented by an authentication, authorization, and accounting (AAA) entity, comprising: receiving an authentication request message from a non-3GPP access element, the authentication request message including anonymized identification information of a user equipment (UE) to be authenticated (S501C); Detecting the concealed identification information of the UE from the received authentication request message (S503C); and sending (S505C) a third request message for authentication credentials to an authentication entity in an evolved packet core (EPC) associated with the UE, the third request message including at least the anonymized identity of the detected UE. A-2 further includes selecting an authentication entity in the EPC based on the anonymized identity information of the detected UE in the network repository entity; said sending the third request message for authentication credentials includes sending the third request message for authentication credentials to a selected authentication entity in the EPC. The method (500C) according to embodiment A-1. A-3 The method according to embodiment A-2 (500C), in which an authentication entity in the EPC is selected within an entity of the network repository based on a routing indicator included in the anonymized identity of the detected UE. A-4. The method according to any one of claims A-1 to A-3, wherein the third request message for authentication credentials is sent to the interworking entity via the routing entity (500C). A-5 The UE's anonymized identity includes the UE's Subscription Anonymization Identifier (SUCI), The method (500C) according to any one of embodiments A-1 to A-4. A-6 further includes receiving a third response message of authentication credentials from an authentication entity in the EPC, the third response message of authentication credentials including: an authentication method selected by an authentication entity in the EPC or requested by an authentication entity in the EPC from an authentication entity in the 5GC associated with the UE; An authentication vector generated by an authenticating entity in the EPC or requested by an authenticating entity in the EPC from an authenticating entity in the 5GC, and a first identification information of the UE obtained from the anonymized identification information of the UE; The method (500C) according to any one of embodiments A-1 to A-5. A third request message for authentication credentials is sent via a Diameter-based interface supporting the masked identity of the UE; a third response message for the authentication credentials is received over the Diameter-based interface; The method of embodiment A-6 (500C). A-8 The first identification information of the UE includes an International Mobile Subscriber Identity (IMSI) of the UE; The method (500C) according to any one of embodiments A-6 to A-7. A-9 The AAA entity includes a 3GPP AAA server; The routing entity includes a Subscriber Locator Function (SLF) / Diameter Routing Agent (DRA); A network repository entity includes a network repository function (NRF), The method (500C) according to any one of embodiments A-1 to A-8. A-10 Authentication, Authorization, and Accounting (AAA) entity (1600), At least one processor (1601); At least one memory (1603) storing instructions that, when executed on at least one processor (1601), cause an entity (1600) of the AAA to perform a method according to at least one of embodiments A-1 to A-9; The AAA entity (1600) includes: A-11. A computer-readable storage medium having stored thereon computer program instructions that, when executed by at least one processor, cause the at least one processor to perform a method according to at least one of embodiments A-1 to A-9.

[0549] Group B Embodiments B-1 A method (600C) implemented by a routing entity, comprising: receiving a third request message for authentication credentials from an authentication, authorization, and accounting (AAA) entity, the third request message including at least an anonymized identity of a user equipment (UE) to be authenticated (S601C); Selecting, within the network repository entity, an authentication entity within an evolved packet core (EPC) based on the received anonymized identity information of the UE (S603C); forwarding a third request message for authentication credentials to the selected authentication entity in the EPC (S605C); The method (600C). B-2 The method of embodiment B-1 (600C), in which an authentication entity in the EPC is selected among entities of the network repository based on a routing indicator included in the anonymized identity of the UE. B-3 receiving a third response message of authentication credentials from an authentication entity in the EPC, the third response message of authentication credentials comprising: an authentication method selected by an authentication entity in the EPC or requested by an authentication entity in the EPC from an authentication entity in the 5GC associated with the UE; An authentication vector generated by an authenticating entity in the EPC or requested by an authenticating entity in the EPC from an authenticating entity in the 5GC, and receiving a third response message of the authentication credentials, the third response message including a first identity of the UE obtained from the anonymized identity of the UE; forwarding a second response message of the received authentication credentials to the AAA entity; The method (600C) of embodiment B-1 or B-2, further comprising: B-4 a third request message for authentication credentials is received and forwarded over a Diameter-based interface supporting the masked identity of the UE; a third response message for the authentication credentials is received and forwarded over the Diameter-based interface; The method of embodiment B-3 (600C). B-5 The UE's anonymized identity includes the UE's Subscription Anonymization Identifier (SUCI), The first identification information of the UE includes an International Mobile Subscriber Identity (IMSI) of the UE; The method (600C) according to any one of embodiments B-1 to B-4. B-6 The routing entity includes a Subscriber Locator Function (SLF) / Diameter Routing Agent (DRA), the AAA entity includes a 3GPP AAA server; A network repository entity includes a network repository function (NRF), The method according to any one of embodiments B-1 to B-6 (600C). B-7 At least one processor (1801); At least one memory (1803) storing instructions that, when executed on at least one processor (1801), cause the routing entity (1800) to perform a method according to at least one of embodiments B-1 to B-6; A routing entity (1800) comprising: B-8. A computer-readable storage medium having stored thereon computer program instructions that, when executed by at least one processor, cause the at least one processor to perform a method according to at least one of embodiments B-1 to B-6.

[0550] Group C Embodiments C-1 A method (800C) performed by an authentication entity in a 5G core (5GC), comprising: receiving a sixth request message for authentication credentials from an authentication entity in an evolved packet core (EPC) associated with a user equipment (UE) to be authenticated, the request message including at least an indication that the requesting node is an authentication, authorization, and accounting (AAA) entity and a masked identity of the UE (S801C); Obtaining a first identification information or a second identification information of the UE from the anonymized identification information of the UE (S803C); sending a sixth response message of the authentication credentials to an authentication entity in the EPC, the sixth response message including at least the first identification information or the second identification information of the obtained UE (S805C); A method (800C). C-2 The above-mentioned acquisition of the first identification information of the UE, deciphering a second identity of the UE from the concealed identity of the UE; Converting the second identification information of the UE into the first identification information of the UE; The method (800C) of embodiment C-1, comprising: C-3 The above-mentioned acquisition of the second identification information of the UE, Deciphering a second identity of the UE from the concealed identity of the UE. The method of embodiment C-1, comprising: C-4. Further comprising obtaining authentication credentials for the UE; the sixth response message of the authentication credentials further includes the authentication credentials of the UE; The method (800C) according to any one of embodiments C-1 to C-3. C-5 The UE authentication credentials include a UE authentication method and a UE authentication vector; The above acquisition of UE authentication credentials, selecting an authentication method for the UE based at least on the indication that the requesting node is an AAA entity and a second identity of the UE; generating an authentication vector for the UE based at least on a second identity of the UE; The method of embodiment C-4 (800C), comprising: C-6 The UE's anonymized identity includes the UE's Subscription Anonymization Identifier (SUCI), the first identification information of the UE includes an International Mobile Subscriber Identity (IMSI) of the UE; the second identification information of the UE includes an international mobile subscriber identity (SUPI) of the UE; The method (800C) according to any one of embodiments C-1 to C-5. C-7. The method (800C) according to any one of embodiments C-1 to C-6, wherein the sixth request message for authentication credentials further includes access network identification information related to the non-3GPP access element to which the UE is connected. C-8 The AAA entity includes a 3GPP AAA server; The method (800C) according to any one of embodiments C-1 to C-7. C-9 An authentication entity (2200) in a 5G core (5GC), At least one processor (2201); At least one memory (2203) storing instructions that, when executed on at least one processor (2201), cause an authentication entity (2200) in a 5GC to perform a method according to at least one of embodiments C-1 to C-8; An authentication entity (2200) within 5GC comprising: C-10. A computer-readable storage medium having stored thereon computer program instructions that, when executed by at least one processor, cause the at least one processor to perform a method according to at least one of embodiments C-1 to C-8.

[0551] Group D embodiment D-1 A method (900C) implemented by an authentication entity in an evolved packet core (EPC), comprising: receiving a third request message for authentication credentials from an authentication, authorization, and accounting (AAA) entity, the third request message including at least an anonymized identification of a user equipment (UE) to be authenticated (S901C); A method (900C). D-2. Sending a sixth request message for authentication credentials to an authentication entity in a 5G core (5GC) associated with the UE, the sixth request message including at least an indication that the requesting node is an AAA entity and anonymized identification information of the UE; receiving a sixth response message of the authentication credentials from an authentication entity in the 5GC, the sixth response message including at least the first identity or the second identity of the UE obtained from the anonymized identity of the UE; The method of embodiment D-1, further comprising: D-3 The sixth response message of the authentication credentials further includes the authentication credentials of the UE, and the authentication credentials of the UE include: An authentication method for the UE selected by an authentication entity in the 5GC; The UE authentication vector generated by the authentication entity in the 5GC; The method of embodiment D-2 (900C), comprising: D-4 Selecting an authentication method for the UE based at least on the indication that the requesting node is an AAA entity and the first identification information of the UE; generating an authentication vector for the UE based at least on a first identity of the UE; The method of embodiment D-2, further comprising: D-5 further includes sending a third response message of the authentication credentials to the AAA entity, the third response message of the authentication credentials further including: An authentication method; an authentication vector; the first identification information of the UE obtained from the second identification information of the UE; The method of embodiment D-3 or D-4 (900C), comprising: D-6 A third request message for authentication credentials is received via a Diameter-based interface supporting the UE's masked identity; a third response message for the authentication credentials is sent over the Diameter-based interface; The method according to embodiment D-4 (900C). D-7 Register in the network repository entity the routing indicators supported by the authentication entity in the EPC The method (900C) of any one of embodiments D-1 to D-6, further comprising: D-7 The UE's anonymized identity includes the UE's Subscription Anonymization Identifier (SUCI), the first identification information of the UE includes an International Mobile Subscriber Identity (IMSI) of the UE; the second identification information of the UE includes an international mobile subscriber identity (SUPI) of the UE; The method (900C) according to any one of embodiments D-2 to D-6. D-8 The AAA entity includes a 3GPP AAA server; The method (900C) according to any one of embodiments D-1 to D-7. D-9 An authentication entity (2400) in an evolved packet core (EPC), At least one processor (2401); At least one memory (2403) storing instructions that, when executed on at least one processor (2401), cause an authentication entity (2400) in the EPC to perform a method according to at least one of embodiments D-1 to D-8; An authentication entity (2400) in an EPC. D-10. A computer-readable storage medium having stored thereon computer program instructions that, when executed by at least one processor, cause the at least one processor to perform a method according to at least one of embodiments D-1 to D-8.

Claims

1. 1. A method implemented by a non-3rd Generation Partnership Project (non-3GPP) access element in a non-3GPP access network, comprising: transmitting a list of networks to a user equipment (UE), the non-3GPP access element having at least support for UE identity privacy through each of the networks; receiving, from the UE, a request message for access authentication, the request message including an identity of the UE; If the UE determines based on the list of networks that the UE identity privacy should be used, the access authentication request message includes a concealed identity of the UE; If the UE determines that the UE identity privacy should not be used based on the list of networks, the access authentication request message includes that a first identity of the UE should be used. A method comprising:

2. 2. The method of claim 1, wherein the non-3GPP access element further comprises support for connectivity with an authentication, authorization, and accounting (AAA) entity for access authentication via each network in the list of networks.

3. The method of claim 2, further comprising sending an authentication request message to an AAA entity, the authentication request message including the identification information of the UE.

4. The method of claim 1 , wherein the anonymized identity of the UE comprises a Subscription Anonymization Identifier (SUCI) of the UE.

5. the authentication request message further includes an access network identity of the non-3GPP access network; 5. The method according to any one of claims 1 to 4.

6. 1. A method implemented by a user equipment (UE), comprising: receiving a list of networks from a non-3GPP access element, the non-3GPP access element having at least support for UE identity privacy via each of the networks; determining whether UE identity privacy should be used for communications with non-Third Generation Partnership Project (non-3GPP) access networks for the UE based on the list of networks; sending an access authentication request message, including an identity of the UE, to a non-3GPP access element in the non-3GPP access network according to a result of the determination; Including, If it is determined that the UE identity privacy should be used, the access authentication request message includes a concealed identity of the UE; If it is determined that the UE identity privacy should not be used, the access authentication request message includes that a first identity of the UE should be used. method.

7. The UE's configuration, or Information about the home network of the UE 7. The method of claim 6, further comprising determining whether the UE identity privacy should be used for communication with the non-3GPP access network for the UE based on at least one of:

8. receiving or pre-configuring the configuration of the UE, the configuration including information indicating whether the UE has support for the UE identity privacy; The method of claim 7 further comprising:

9. 8. The method of claim 6 or 7, wherein the non-3GPP access element further comprises support for connectivity with an Authentication, Authorization, and Accounting (AAA) entity for access authentication via each network in the list of networks.

10. receiving, from the home network, the information relating to the home network indicating whether the home network has support for the UE identity privacy; The method of claim 7 further comprising:

11. 11. The method of claim 10, wherein the information about the home network indicating whether the home network has support for the UE identity privacy is conveyed in a UE Parameter Update (UPU) procedure or a Steering of Roaming (SoR) procedure.

12. 9. The method of claim 8, wherein the support for UE identity privacy includes support for UE identity privacy for non-3GPP access authentication.

13. the anonymized identity of the UE includes a Subscription Anonymization Identifier (SUCI) of the UE; the first identification information of the UE includes an International Mobile Subscriber Identity (IMSI) of the UE; 13. The method according to any one of claims 6 to 12.

14. 7. The method of claim 6, wherein the communication with the non-3GPP access network includes a Non-Seamless Wireless Local Access Network Offload (NSWO) from the non-3GPP access network for the UE.

Images