System and method to authenticate the user of the UE for the metaverse services

Abstract

Embodiment herein discloses method for authenticating a user of the UE for metaverse / any other services by network / AF entity (110). The method includes receiving session establishment request message to access metaverse service from a user of UE. The session establishment request message includes a UE-ID identifying UE through which metaverse service is accessed, an AF-ID, an external identity provider ID identifying a 3rd party identity service provider though which the user utilizing the service is authenticated. Further, the method includes identifying a home network based on UE-ID. Further, the method includes sending a user authentication request to the UAF entity (106) for verifying a user of the UE requesting for the metaverse service based on the identification. Further, the method includes receiving a user authentication response from the UAF entity based on the user authentication request. The user authentication response includes a user authentication results and a derived user-identity.

Description

SYSTEM AND METHOD TO AUTHENTICATE THE USER OF THE UE FOR THE METAVERSE SERVICES

[0001] This application is based on and derives the benefit of Indian Patent Application 202341048391 filed on 19thJuly, 2023 and 21stJune, 2024, the contents of which are incorporated herein by reference. The present invention relates to a wireless communication, and more specifically related to a system and method to authenticate a user of a UE for a metaverse services.

[0002] 5G mobile communication technologies define broad frequency bands such that high transmission rates and new services are possible, and can be implemented not only in "Sub 6GHz" bands such as 3.5GHz, but also in "Above 6GHz" bands referred to as mmWave including 28GHz and 39GHz. In addition, it has been considered to implement 6G mobile communication technologies (referred to as Beyond 5G systems) in terahertz bands (for example, 95GHz to 3THz bands) in order to accomplish transmission rates fifty times faster than 5G mobile communication technologies and ultra-low latencies one-tenth of 5G mobile communication technologies.

[0003] At the beginning of the development of 5G mobile communication technologies, in order to support services and to satisfy performance requirements in connection with enhanced Mobile BroadBand (eMBB), Ultra Reliable Low Latency Communications (URLLC), and massive Machine-Type Communications (mMTC), there has been ongoing standardization regarding beamforming and massive MIMO for mitigating radio-wave path loss and increasing radio-wave transmission distances in mmWave, supporting numerologies (for example, operating multiple subcarrier spacings) for efficiently utilizing mmWave resources and dynamic operation of slot formats, initial access technologies for supporting multi-beam transmission and broadbands, definition and operation of BWP (BandWidth Part), new channel coding methods such as a LDPC (Low Density Parity Check) code for large amount of data transmission and a polar code for highly reliable transmission of control information, L2 pre-processing, and network slicing for providing a dedicated network specialized to a specific service.

[0004] Currently, there are ongoing discussions regarding improvement and performance enhancement of initial 5G mobile communication technologies in view of services to be supported by 5G mobile communication technologies, and there has been physical layer standardization regarding technologies such as V2X (Vehicle-to-everything) for aiding driving determination by autonomous vehicles based on information regarding positions and states of vehicles transmitted by the vehicles and for enhancing user convenience, NR-U (New Radio Unlicensed) aimed at system operations conforming to various regulation-related requirements in unlicensed bands, NR UE Power Saving, Non-Terrestrial Network (NTN) which is UE-satellite direct communication for providing coverage in an area in which communication with terrestrial networks is unavailable, and positioning.

[0005] Moreover, there has been ongoing standardization in air interface architecture / protocol regarding technologies such as Industrial Internet of Things (IIoT) for supporting new services through interworking and convergence with other industries, IAB (Integrated Access and Backhaul) for providing a node for network service area expansion by supporting a wireless backhaul link and an access link in an integrated manner, mobility enhancement including conditional handover and DAPS (Dual Active Protocol Stack) handover, and two-step random access for simplifying random access procedures (2-step RACH for NR). There also has been ongoing standardization in system architecture / service regarding a 5G baseline architecture (for example, service based architecture or service based interface) for combining Network Functions Virtualization (NFV) and Software-Defined Networking (SDN) technologies, and Mobile Edge Computing (MEC) for receiving services based on UE positions.

[0006] As 5G mobile communication systems are commercialized, connected devices that have been exponentially increasing will be connected to communication networks, and it is accordingly expected that enhanced functions and performances of 5G mobile communication systems and integrated operations of connected devices will be necessary. To this end, new research is scheduled in connection with eXtended Reality (XR) for efficiently supporting AR (Augmented Reality), VR (Virtual Reality), MR (Mixed Reality) and the like, 5G performance improvement and complexity reduction by utilizing Artificial Intelligence (AI) and Machine Learning (ML), AI service support, metaverse service support, and drone communication.

[0007] Furthermore, such development of 5G mobile communication systems will serve as a basis for developing not only new waveforms for providing coverage in terahertz bands of 6G mobile communication technologies, multi-antenna transmission technologies such as Full Dimensional MIMO (FD-MIMO), array antennas and large-scale antennas, metamaterial-based lenses and antennas for improving coverage of terahertz band signals, high-dimensional space multiplexing technology using OAM (Orbital Angular Momentum), and RIS (Reconfigurable Intelligent Surface), but also full-duplex technology for increasing frequency efficiency of 6G mobile communication technologies and improving system networks, AI-based communication technology for implementing system optimization by utilizing satellites and AI (Artificial Intelligence) from the design stage and internalizing end-to-end AI support functions, and next-generation distributed computing technology for implementing services at levels of complexity exceeding the limit of UE operation capability by utilizing ultra-high-performance communication and computing resources.

[0008] The principal object of the embodiments herein is provided for the mobile Metaverse services, such as Metaverse conference, the user and user's digital representations, and multiple devices which belongs to the same user and multiple users accessing the same device should be identified and authenticated.

[0009] Yet another objective of the embodiment herein is to authenticate / verify the user of the UE via NAS procedure for the Metaverse or any other services.

[0010] Yet another objective of the embodiment herein is to authenticate / verify the user behind the UE via an AAA protocol (NSSAA between the UE and the AAA) for the Metaverse or any other services.

[0011] Yet another objective of the embodiment herein is to assign / derive a User-Identity for the user to carry out / to be used with external AF for the Metaverse or any other service.

[0012] Yet another objective of the embodiment herein is to authenticate and / or authorize the Digital-ID and how to forward the result of authentication to the 5GC and exposing the Digital-ID and the authentication result with the 3rdparty entity.

[0013] Accordingly, the embodiment herein discloses a method for authenticating a user of the User Equipment (UE) for a metaverse service. The method includes receiving, by an application-function (AF) entity, a session establishment request message to access a metaverse service from a user of the UE. Further, the method includes identifying, by the AF entity, a home network based on the session establishment request message. Further, the method includes sending, by the AF entity, a user authentication request to a User Authentication Function (UAF) entity for verifying a user behind the UE requesting for the metaverse service based on the identification. Further, the method includes receiving, by the AF entity, an user authentication response from the UAF entity based on the user authentication request, wherein the user authentication response comprises a user authentication result and a derived user-identity. Further, the method includes performing the user authentication result via a Non-Access Stratum (NAS) message or via an Authentication, Authorization, and Accounting (AAA) protocol based Network Slice Specific Authentication and Authorization (NSSAA).

[0014] In an embodiment, the user authentication request is sent via a Network Exposure Function (NEF) if the AF entity is not trusted by the home network. The session establishment request message includes a UE-identifier (ID) identifying the UE through which the metaverse service is accessed, an AF-ID, session ID, an external identity provider ID identifying a 3rdparty identity service provider though which the user utilizing the service is authenticated.

[0015] In another embodiment, the user authentication can be performed for metaverse and / or any other services for a human user case.

[0016] Accordingly, the embodiment herein discloses a method for authenticating a user behind the UE for a metaverse and / or other services. The method includes receiving, by a UAF entity, a user authentication request from an AF entity for verifying a user behind a UE requesting for the metaverse service, wherein the user authentication request comprises a UE ID, the session ID, the anonymous user ID and an external identity provider ID identifying a 3rdparty identity service provider though which the user utilizing the service is authenticated. Further, the method includes sending, by the UAF entity, the user authentication request to the UE via an existing NAS message or using a new NAS message. Further, the method includes receiving, by the UAF entity, the user authentication response comprising an user ID token and an authentication result from the UE as a result of biometric verification. Further, the method includes sending, by the UAF entity, another user authentication request comprising the user ID token and the authentication result to at least one of a User Data Management (UDM) entity and a third party service provider. Further, the method includes receiving, by the UAF entity, the user authentication response from at least one of: the UDM entity and the third party service provider. Further, the method includes deriving, by the UAF entity, a user-identity based on the user authentication response received from at least one of: the UDM entity and the third party service provider. Further, the method includes sending, by the UAF entity, an user authentication response to the AF entity based on the user authentication request, wherein the user authentication response comprises a user authentication result and the derived user-identity.

[0017] Accordingly, the embodiment herein discloses a method for authenticating a UE for a metaverse service. The method includes receiving, by an UDM entity, a user authentication request from an AF entity for verifying a user behind the UE requesting for the metaverse service, wherein the user authentication request comprises a UE ID and a session identifier (ID). Further, the method includes sending, by the UDM entity, the user authentication request to the UE through an Access and Mobility Management Function (AMF) entity. Further, the method includes receiving, by the UDM entity, the user authentication response comprising an user ID token and an authentication result from the UE through the AMF entity. Further, the method includes initiating, by the UDM entity, a user verification at a network side by verifying a locally stored user profile information with the user ID token received from the UE via the AMF entity. Further, the method includes sending, by the UDM entity, a user authentication response to the AF entity based on the user authentication request, wherein the user authentication response comprises a user authentication results and the derived user-identity.

[0018] In an embodiment, the UE sends the user authentication response to the UDM entity through the AMF entity over a NAS message, wherein the NAS message comprising a result of user-authentication result, and the User-ID token generated by the UE during the verification process.

[0019] In an embodiment, the user authentication and authorization request is sent directly to the AAA-Server (AAA-S), or via other function in the network (e.g., NSSAA Function (NSSAAF) / AAA-Proxy (AAA-P)) or any other protocol.

[0020] In an embodiments, the UE sends the user authentication request to at least one of: the AMF entity, a Session Management Function (SMF) entity and the UAF entity via at least one of: a registration request and a Protocol Data Unit (PDU) session establishment request by receiving, by at least one of: the AMF entity, the SMF entity and the UAF entity, the user authentication request from the UE comprising an user ID and a UE ID, initiating, by the UAF entity, a user verification by verifying a locally stored user profile information, generating, by the UAF entity, a short-term identity certificate where the short-term identity certificate indicates that user behind the UE has been verified by the network, so that the short-term identity certificate is signed by a Certificate Authority (CA), and is valid for a certain duration, initiating, by the UDM entity, a user verification by verifying a locally stored user profile information, and generating, by the UDM entity, a user ID for the user to be provided for an application server or metaverse server for further communication to perform the legitimate user verification.

[0021] Accordingly, the embodiment herein discloses an AF entity for authenticating a UE for a metaverse service. The AF entity includes an authentication controller communicatively coupled to a memory and a processor. The authentication controller is configured to receive a session establishment request message to access a metaverse service from a user of the UE, wherein the session establishment request message comprises a UE-ID identifying the UE through which the metaverse service is accessed, an AF-ID, an external identity provider identifier (ID) identifying a 3rdparty identity service provider though which the user utilizing the service is authenticated, a session ID and an anonymous user ID. Further, the authentication controller is configured to identify a home network based on the UE-ID. Further, the authentication controller is configured to send a user authentication request to a UAF entity for verifying a user behind the UE requesting for the metaverse service based on the identification. Further, the authentication controller is configured to receive a user authentication response from the UAF entity based on the user authentication request, wherein the user authentication response comprises a user authentication result and a derived user-identity.

[0022] Accordingly, the embodiment herein discloses a UAF entity for authenticating a user behind the UE for a metaverse service. The UAF entity includes an authentication controller communicatively coupled to a memory and a processor. The authentication controller is configured to receive a user authentication request from an AF entity for verifying a user behind a UE requesting for the metaverse service, wherein the user authentication request comprises a UE ID, a session ID, an anonymous user ID, and an external identity provider identifier (ID) identifying a 3rdparty identity service provider though which the user utilizing the service is authenticated. Further, the authentication controller is configured to send the user authentication request to the UE via an existing NAS message or using a new NAS message. Further, the authentication controller is configured to receive the user authentication response comprising a user ID token and an authentication result from the UE as a result of biometric verification. Further, the authentication controller is configured to send another user authentication request comprising the user ID token and the authentication result to at least one of a UDM entity and a third party service provider. Further, the authentication controller is configured to receive the user authentication response from at least one of: the UDM entity and the third party service provider. Further, the authentication controller is configured to derive a user-identity based on the user authentication response received from at least one of: the UDM entity and the third party service provider. Further, the authentication controller is configured to send n user authentication response to the AF entity based on the user authentication request, wherein the user authentication response comprises a user authentication result and the derived user-identity.

[0023] Accordingly, the embodiment herein discloses a UDM entity for authenticating a UE for a metaverse service. The UDM entity includes an authentication controller communicatively coupled to a memory and a processor. The authentication controller is configured to receive a user authentication request from an AF entity for verifying a user behind the UE requesting for the metaverse service, wherein the user authentication request comprises a UE ID and a session identifier (ID). Further, the authentication controller is configured to send the user authentication request to the UE through an AMF entity. Further, the authentication controller is configured to receive the user authentication response comprising a user ID token and an authentication result from the UE through the AMF entity. Further, the authentication controller is configured to initiate a user verification at a network side by verifying a locally stored user profile information with the user ID token received from the UE via the AMF entity. Further, the authentication controller is configured to send a user authentication response to the AF entity based on the user authentication request, wherein the user authentication response comprises a user authentication and the derived user-identity.

[0024] These and other aspects of the embodiments herein will be better appreciated and understood when considered in conjunction with the following description and the accompanying drawings. It should be understood, however, that the following descriptions, while indicating preferred embodiments and numerous specific details thereof, are given by way of illustration and not of limitation. Many changes and modifications may be made within the scope of the embodiments herein without departing from the scope thereof, and the embodiments herein include all such modifications.

[0025] These and other features, aspects, and advantages of the present invention will become better understood when the following detailed description is read with reference to the accompanying drawings in which like characters represent like parts throughout the drawings, wherein:

[0026] FIG. 1 illustrates the mobile as an enabler of the Digital-IDentification, according to the embodiments as disclosed herein;

[0027] FIG. 2 illustrates roles a Mobile Network Operators (MNO) plays in accelerating the Digital-ID ecosystem, according to the embodiments as disclosed herein;

[0028] FIG. 3 is a flow chart illustrating an Application-Function (AF) requesting a 5GC to perform the user authentication, according to the embodiments as disclosed herein;

[0029] FIG. 4 is a flow chart illustrating a flow chart that the AF requests the 5thGeneration (5G) Core (5GC) and the 5GC requests the third party to initiate the user authentication, according to the embodiments as disclosed herein;

[0030] FIG. 5 is a flow chart illustrating a flow chart that the AF requests the Identity provider to initiate the user authentication, according to the embodiments as disclosed herein;

[0031] FIG. 6 is a flow chart illustrating the AF requesting an Authentication and Key Management for Applications (AKMA) Anchor Function (AAnF) entity to indicate user authentication and a User Authentication Function (UAF) entity initiating the user authentication, according to the embodiments as disclosed herein;

[0032] FIG. 7 is a flow chart illustrating a User Equipment (UE) initiates user authentication and the UAF entity provides the certificate to the user, according to the embodiments as disclosed herein;

[0033] FIG. 8 is a flow chart illustrating the UE initiates binding request and the UAF entity initiates the user authentication, according to the embodiments as disclosed herein;

[0034] FIG. 9 is a flow chart illustrating a User Data Management (UDM) entity initiating user authentication and the UDM entity providing the user ID for authenticated user, according to the embodiments as disclosed herein;

[0035] FIG. 10 shows various hardware components of the AF entity, according to the embodiments as disclosed herein;

[0036] FIG. 11 shows various hardware components of the UAF entity, according to the embodiments as disclosed herein;

[0037] FIG. 12 shows various hardware components of the UDM entity, according to the embodiments as disclosed herein;

[0038] FIG. 13 is a flow chart illustrating a method, implemented by the AF entity, for authenticating the UE for a metaverse service, according to the embodiments as disclosed herein;

[0039] FIG. 14 is a flow chart illustrating a method, implemented by the UAF entity, for authenticating the UE for the metaverse service, according to the embodiments as disclosed herein; and

[0040] FIG. 15 is a flow chart illustrating a method, implemented by the UDM entity, for authenticating a UE for a metaverse service, according to the embodiments as disclosed herein.

[0041] It may be noted that to the extent possible, like reference numerals have been used to represent like elements in the drawing. Further, those of ordinary skill in the art will appreciate that elements in the drawing are illustrated for simplicity and may not have been necessarily drawn to scale. For example, the dimension of some of the elements in the drawing may be exaggerated relative to other elements to help to improve the understanding of aspects of the invention. Furthermore, the one or more elements may have been represented in the drawing by conventional symbols, and the drawings may show only those specific details that are pertinent to the understanding the embodiments of the invention so as not to obscure the drawing with details that will be readily apparent to those of ordinary skill in the art having benefit of the description herein.

[0042] 3rdGeneration Partnership Program (3GPP) has studied multiple use cases and service requirements for 5GS support of enhanced XR-based services, for Metaverse and other services. There are several use cases such as Localized Mobile Metaverse Service, Metaverse Conference with user's Digital-ID, Spatial Mapping and Localization Service Enabler, and Avatar Communications that requires system architecture enhancements for 5G system to support Mobile Metaverse services. It is figured out that the mobile Metaverse services have distinct characteristics and have service aspects that are not present in any other immersive user services such as XR or VR for today. There are also certain use cases specified in TR 22.856 (for e.g., use case 3, use case 28 etc.) where there is a need for the security enhancement. Further there are key issues and solutions studied in SA2 TR 23.700-32 for user authentication and authorization aspects.

[0043] In mobile Metaverse services, real-time conversational user experience is highly desired for avatar communications. The new type of media file format, media codec, and characteristics of those need to be considered for representing user's avatar in the network. Moreover, based on the different UE capabilities, various network entity deployments, network conditions, and based on the user's preferences, the avatar call may be dynamically converted to the video call, or more over normal voice call. The transition between the avatar media call and the other type of calls including video call may be processed in the network in this respect as described in 3GPP TR 22.856.

[0044] From a survey / study it is identified that around 1 billion people does not have a proof of identity and there comes the initiative from GSMA on the proposal for a Digital-ID. As detailed in the Annex B of 3GPP TR 22.856, the EU Digital-ID wallet is an initiative in the recent technology. The EU Digital-ID Wallet is intended to allow European citizens to safely save their documents and personal information in a manner that complies with privacy regulations, as well as to give the data owners full control how the data is used (who can access it), and to track how it has been used. The information stored in the wallet could have general utility in many circumstances, even outside of the country in which the information was issued. Examples given are driver's licenses, medical records or certification such as university degree titles. It is acknowledged that people need to establish their identity in many ways. This process is currently complex, as each activity requires different credentials and as the form of credentials vary, identification requires different process. Having a single Digital-ID wallet will simplify these processes.

[0045] The goal of the program is to bring the following benefits:

[0046] a) To support the ability of every person eligible for a national ID card to have a Digital-ID that is recognized anywhere in the EU.

[0047] b) To provide a simple and safe way to control how much information you want to share with services that require the sharing of information.

[0048] c) To allow mobile phone apps and other devices to support a means to provide identity services on- and off-line.

[0049] d) Store and exchange information provided by governments, e.g. name, surname, date of birth, nationality.

[0050] e) To use information as confirmation of the right to reside, work, or study in a particular member state.

[0051] Thus, it is desired to address the above mentioned disadvantages or other shortcomings or at least provide a useful alternative.

[0052] The embodiments herein and the various features and advantageous details thereof are explained more fully with reference to the non-limiting embodiments that are illustrated in the accompanying drawings and detailed in the following description. Descriptions of well-known components and processing techniques are omitted so as to not unnecessarily obscure the embodiments herein. Also, the various embodiments described herein are not necessarily mutually exclusive, as some embodiments can be combined with one or more other embodiments to form new embodiments. The term "or" as used herein, refers to a non-exclusive or, unless otherwise indicated. The examples used herein are intended merely to facilitate an understanding of ways in which the embodiments herein can be practiced and to further enable those skilled in the art to practice the embodiments herein. Accordingly, the examples should not be construed as limiting the scope of the embodiments herein.

[0053] As is traditional in the field, embodiments may be described and illustrated in terms of blocks which carry out a described function or functions.　These blocks, which may be referred to herein as managers, units, modules, hardware components or the like, are physically implemented by analog and / or digital circuits such as logic gates, integrated circuits, microprocessors, microcontrollers, memory circuits, passive electronic components, active electronic components, optical components, hardwired circuits and the like, and may optionally be driven by firmware and software. The circuits may, for example, be embodied in one or more semiconductor chips, or on substrate supports such as printed circuit boards and the like.　The circuits constituting a block may be implemented by dedicated hardware, or by a processor (e.g., one or more programmed microprocessors and associated circuitry), or by a combination of dedicated hardware to perform some functions of the block and a processor to perform other functions of the block.　Each block of the embodiments may be physically separated into two or more interacting and discrete blocks without departing from the scope of the disclosure.　Likewise, the blocks of the embodiments may be physically combined into more complex blocks without departing from the scope of the disclosure.

[0054] The accompanying drawings are used to help easily understand various technical features and it should be understood that the embodiments presented herein are not limited by the accompanying drawings. As such, the present disclosure should be construed to extend to any alterations, equivalents and substitutes in addition to those which are particularly set out in the accompanying drawings. Although the terms first, second, etc. may be used herein to describe various elements, these elements should not be limited by these terms. These terms are generally only used to distinguish one element from another.

[0055] Referring now to the drawings and more particularly to FIG. 3 through 15, where similar reference characters denote corresponding features consistently throughout the figures, there are shown preferred embodiments.

[0056] Accordingly, the embodiment herein discloses a method for authenticating a user behind a User Equipment (UE) for a metaverse service. The method includes receiving, by an application-function (AF) entity, a session establishment request message to access a metaverse service from a user of the UE. The session establishment request message includes a UE-identifier (ID) identifying the UE through which the metaverse service is accessed, an AF-ID, an external identity provider ID identifying a 3rdparty identity service provider though which the user utilizing the service is authenticated. Further, the method includes identifying, by the AF entity, a home network based on the UE-ID. Further, the method includes sending, by the AF entity, a user authentication request to a User Authentication Function (UAF) entity for verifying a user behind the UE requesting for the metaverse service based on the identification. Further, the method includes receiving, by the AF entity, a user authentication response from the UAF entity based on the user authentication request, wherein the user authentication response comprises a user authentication and a derived user-identity. Further the method includes performing the user authentication via a Non-Access Stratum (NAS) message or via an Authentication, Authorization, and Accounting (AAA) protocol based Network Slice Specific Authentication and Authorization (NSSAA).

[0057] FIG. 1 illustrates (S100) a mobile as an enabler of Digital-Identification. The network operators offers the digital asset management services for the users, with which some information (e.g. IDs) can be certified by the operator. The digital asset management services can also include the management of the digital asset container is performed according to the applicable regulations and the digital asset container has security properties (cannot be spoofed, access control with a policy determined by the user, etc.).

[0058] In the case of immersive eXtended Reality (XR) media services, the user can choose, in the digital asset container, his / her digital representation and the related information, for example, the digital representation of the user (e.g. avatar), electronic money and associated financial services, identity, purchased items (the format of this information is at application layer and is not studied in 3GPP). This information can be used when accessing immersive XR media services or for real life services as the presentation of the identity.

[0059] FIG. 2 illustrates (S200) roles a Mobile Network Operators (MNO) plays in accelerating Digital-ID ecosystem. Where the MNOs can play various roles in accelerating digital identity ecosystem.

[0060] The mobile Metaverse media support among multiple users and there can be multiple devices accessing the network for better XR experience and the device and / or the UE can be bounded with multiple users. In mobile Metaverse services, such as Metaverse conference, the user and user's digital representations, and multiple devices which belongs to the same user should be identified and authenticated. Multiple users can request for the Metaverse services from the same UE / device and network may authenticate the UE not the user and provides the services with the current existing 3GPP authentication procedure and security mechanism. In such cases, the users are getting the services which they are not authenticated to and this is a security gap / violation in 5G (5thGeneration) Metaverse.

[0061] Likewise, there are multiple scenarios where a security analysis required as follows:

[0062] a) It is required to verify / authenticate the user behind the UE, including scenarios when there are multiple user connecting via the same device for the Metaverse service.

[0063] b) It is also required to study how to verify multiple user devices belonging to the same user (e.g. a secondary device mapping to the primary device after authenticating the primary device and its exposure) and Metaverse service is not exposed to an unauthenticated user.

[0064] According to the embodiment herein, the Digital-ID Authentication as a new service of Mobile operators and security aspects of Digital-ID authentication and Authentication of user behind the UE needs further study and security aspects needs to be proposed.

[0065] According to the embodiment herein is a system and method to authenticate a user behind a User Equipment (UE) for a metaverse services. Where as described in the TR 22.856, a User-Identity is an information representing a user in a specific context. It is assumed that the Digital-ID is pre-configured at the UE. The user authenticates own-self using the biometric information, when there is a request from the network for the user authentication behind the UE. The system and method are to authenticate / verify the user behind the UE for the Metaverse services. Further, includes assigning a User-Identity for the user to carry out / to be used with external AF for the Metaverse service. Furthermore, includes authorizing the Digital-ID to forward the result of authentication to the 5GC and exposing the Digital-ID and the authentication result with the 3rd party entity.

[0066] FIG. 3 is a flow chart (S300) illustrating an Application-Function (AF) requesting a 5G core (5GC) to perform the user authentication, according to the embodiments as disclosed herein. FIG. 3 illustrates a 3GPP core network authenticating the user. At step 3-0, the UE (102) is pre-configured with credentials for accessing 3GPP network, for bio-metric verification of the user(s) and optionally with credentials for Digital-ID. It may also be preconfigured with the Digital-ID of user(s) for obtaining the Metaverse services. The primary authentication is performed as described in clause 6.1 of 3GPP TS 33.501 and the UE (102) is authenticated with the 3GPP core network.

[0067] At step 3-1, the UE (102) sends session establishment request to the AF entity (110) to access metaverse services. The message may include the UE-ID identifying the terminal through which services are accessed, the AF-ID, and / or an External-Identity-Provider-ID identifying a 3rd party identity service provider though which user utilizing the service can be authenticated. The UE (102) may additionally include the User-ID and / or Session-ID and other possible parameters in the session establishment request message. The User-ID is an identity uniquely identifying the user. Session-ID is a randomly generated identity for the session, which can be used if the User-Identity needs to be hidden until identity verification. The User-ID / Session-ID are especially useful when multiple users are present behind the UE.

[0068] At step 3-2, the AF entity (110) identifies the home network based on, e.g. UE-ID, and sends a User Authentication Request to verify the user behind the UE (102) requesting for the Metaverse service. The request may be sent via a Network Exposure Function (NEF) entity (e.g., NEF entity (116) in Fig. 9) if the AF entity (110) is not trusted by the network. The request may be directly sent to a new network entity called a User Authentication Function (UAF) entity(106), or via an existing entity, e.g. UDM entity (108) or an Authentication and Key Management for Applications (AKMA) Anchor Function (AAnF) entity (e.g., AAnF entity (114) in Fig. 6) which then routes it to the UAF entity (106). The UAF entity (106) is responsible for performing User authentication. The UAF entity functionality may be co-located with an existing entity.

[0069] In an embodiment, the UAF entity (106) is also responsible for identifying the third party / external provider. In another embodiment, the UAF entity (106) is responsible for deriving a new user identity to the authenticating user for accessing the Metaverse services. In another embodiment, the UAF entity (106) is responsible in selecting which biometric the UE (102) should be performing (e.g. facial image or the fingerprint). In another embodiment, the UAF entity (106) is also responsible for selecting and interfacing with User Information Database Function (UIDF) for triggering User Authentication.

[0070] At step 3-3, upon receiving the User Authentication Request from the AF entity (110), the UAF entity (106) initiates the user authentication procedure by sending the User Authentication Request to the UE. The message could be sent e.g. via an Access and Mobility management Function (AMF) entity (104)(Over the NAS message), or using an AAA (with UAF entity (106) playing role of AAA Server), or any other protocol. The request may include UE ID and other possible parameters and it may include a Session-ID / User-ID if provided in Step 3-1.

[0071] At step 3-4, upon receiving the user authentication message, the UE (102) initiates the user authentication. The user may be identified using User-ID or Session-ID. The UE (102) performs the biometric verification (e.g. face images and / or the fingerprints of the user) and generates result. The result may then be encrypted to generate a User-ID Token, or may be sent directly. The user ID token may include information on which application the user is allowed / trying to access. In another embodiment, the user ID token should have some restriction on application for particular user based on the subscription.

[0072] At step 3-5a and / or step 3-5b, the UE (102) sends the user authentication response to the UAF entity (106) over, e.g. a NAS message (via the AMF entity (104)) or an AAA message (via NSSAAF). The message includes the result of user-authentication, and / or a User-ID token generated by the UE (102) during the verification process. The message may additionally contain User-ID and / or Session-ID.

[0073] In an embodiment, NAS based slice authentication (for e.g., NSSAA) is used for authenticating the user behind the UE.

[0074] In an embodiment, the UE (102) also provides the Digital-ID of the user to the UAF entity (106) in the user authentication response message. The Digital-ID represents the Avatar used for his / her Metaverse service and this ID will be used by the user for any access to the Metaverse service.

[0075] In another embodiment, if the user is mapped with multiple digital IDs, in the user authentication response message, the user will only indicate the particular avatar ID / digital ID which the user is accessing the Metaverse service from this AF / Metaverse service provider. The other digital IDs associated with the user remains anonymous to the network and / or the AF.

[0076] At step 3-6a and / or 3-6b, after receiving the user authentication response message from the UE (102), the UAF entity (106) may request the UDM entity (108) and / or a user AAA entity (112) and / or the third party to verify the User-ID Token provided by the UE (102) in-order to further verify / authenticate, e.g. the freshness of bio-metric authentication of the user behind the UE (102) and / or additional information relating to bio-metric verification. Alternatively, it may validate the token based on locally available information.

[0077] In an embodiment, the user profile information can be configured / stored at the UDM / Unified Data Repository (UDR) / User Information Database Function (UIDF).

[0078] In another embodiment, it is assumed that the User ID is linked to a UE subscription data in the UDM / UDR, and the UE is pre-configured with User ID authorization information.

[0079] In an embodiment, the user 3rdparty entity pre-configures the User-Id token and user profile information for the users engaging for the Metaverse services.

[0080] At step 3-7a and step 3-7b, the UDM entity (108) and / or the user AAA entity (112) and / or the user 3rdparty verify the User-ID token and validates whether there is a real user behind the UE (102) as claimed.

[0081] At step 3-8a and / or step 3-8b, the UDM entity (108) and / or the user AAA entity (112) and / or 3rd party entity provides the User Authentication response to the UAF entity (106). The verification response message includes the success / failure indication.

[0082] In an embodiment, if the UE (102) had sent only Session-ID (and not the User-ID) in step 3-1 of the Fig. 3, the 3rd party or the UDM entity (108) now provides the User-ID to the UAF entity (106) in the verification response. Alternatively, the response contains the User-ID and a Transport Layer Security (TLS)-type certificate indicating the User-ID verification is signed by a Certificate Authority (CA), and is valid for certain duration.

[0083] At step 3-9, if the UAF entity (106) receives success indication in any of the step 3-5, 3-8a, or 3-8b, then the UAF entity (106) may derive a new User-Identity to be used by external world (e.g. AF) for the user. The user ID provided in the step 3-1 is an ID which uniquely identifies the user. Whereas the new identity (Verified User Identity) derived at the UAF entity (106) in step 3-9 is the identity provided by the 5G core network (e.g., UAF entity (106) or the like) to the authenticated user to be used by external AF, who offers the Metaverse service.

[0084] In an embodiment, the User-Identity of the subscriber is mapped with the Avatar (Digital-ID) for accessing the Metaverse services.

[0085] User-Identity = Key Derivation Function (KDF) (UE-ID, Digital-ID, External-Identity-Provider-ID, and KAUSFand other possible parameters)

[0086] In another embodiment, the User-Identity can be derived as follows:

[0087] a) The User-Identity = KDF (UE-ID, User-ID token, Digital-ID, External-Identity-Provider-ID, and KAUSFand other possible parameters).

[0088] b) The input key to the KDF is KAUSF, whereinKAUSFis a key associated with an AUthentication Server Function (AUSF).

[0089] In an embodiment, the UE-ID could be Subscription Permanent Identifier (SUPI) / Generic Public Subscription Identifier (GPSI). SUPI is the globally unique subscription permanent identifier.

[0090] In another embodiment, during the registration request, the UE (102) can provide the Digital-ID to the network. The Digital-ID could be the avatar ID assigned to his / her avatar to be used in Metaverse.

[0091] In another embodiment, the External-Identity-Provider-ID is a unique-IDentifier of the external provider who is the provider for the UE.

[0092] In another embodiment, the AF ID could be one of the input parameter for the key derivation as follows:

[0093] a) The User-Identity = KDF (UE-ID, Digital-ID, External-Identity-Provider-ID, AF ID, KAUSFand other possible parameters).

[0094] b) The User-Identity = KDF (UE-ID, User-ID token, Digital-ID, External-Identity-Provider-ID, AF ID, KAUSFand other possible parameters).

[0095] c) User ID can take a Network Access Identifier (NAI) format.

[0096] In another embodiment, the KDF can take any other possible parameters other than those mentioned above.

[0097] In an embodiment, in case if the mobile metaverse server can have one or more mobile metaverse service to a user access, and for certain scenarios, in order to authenticate a User Identity to a service with a User Identifier, the user identity should contain the service name and / or the service ID. The user ID can be derived at the UAF entity (106) and / or at the 5GC network as follows:

[0098] a) User Identity = KDF (KAUSF, SUPI, Digital ID, external provider ID, user ID Token, Service name and / or service ID and other possible parameters)

[0099] In an embodiment, the user ID can take the format of NAI and the realm part includes the service name / service ID.

[0100] In another embodiment, the UAF entity (106) generates a TLS-type certificate indicating the User-ID verification is signed by a Certificate Authority, and is valid for certain duration.

[0101] At step 3-10, after successfully deriving the User-Identity, the UAF entity (106) may send a notification message to the UE. In this message, the UAF entity (106) provide(s) the User-Identity derived for the authenticated User to access the Metaverse services and / or the accompanying certificate.

[0102] At step 3-11, after successfully deriving the User-Identity and performing user authentication, the UAF entity (106) sends the user authentication response to the AF entity (110) including result of user authentication and / or the new derived user-identity. This message may additionally include the Digital-ID (his / her avatar ID) obtained from the UE (102) and other possible parameters. The response may be sent via the NEF entity (116) if the AF (110) is external and / or untrusted.

[0103] In an embodiment, the network level user authentication result includes the context information, e.g. location information of the participants and / or the users.

[0104] FIG. 4 is a flow chart (S400) illustrating the AF entity (110) requesting the 5GC and the 5GC requesting the third party to initiate the user authentication, according to the embodiments as disclosed herein.

[0105] Once the AF entity (110) sends the user authentication request to the UAF entity (106), the UAF entity (106) redirect / request the user authentication to be performed by the 3rd party entity (user AAA entity (112)).

[0106] At step 4-0, the UE (102) is pre-configured with credentials for accessing the 3GPP network, for bio-metric verification of the user(s) and optionally with credentials for the Digital-ID. It may also be preconfigured with the Digital-ID of user(s) for obtaining the Metaverse services. Also, the primary authentication is performed as described in clause 6.1 in 3GPP TS 33.501 and the UE (102) is authenticated with the 3GPP core network.

[0107] At step 4-1, the UE (102) sends session establishment request to the application-function (AF) to access Metaverse services. The message may include UE-ID identifying the terminal through which services are accessed, AF-ID, and / or an External-Identity-Provider-ID identifying a 3rd party identity service provider though which user utilizing the service can be authenticated, and also includes other possible parameters. The UE (102) may additionally include the User-ID and / or Session-ID in the session establishment request message. User-ID is an identity uniquely identifying the user. Session-ID is a randomly generated identity for the session, which can be used if the User-Identity needs to be hidden until identity verification. User-ID / Session-ID are especially useful when multiple users are present behind the UE.

[0108] At step 4-2, the AF entity (110) identifies the home network based on, e.g. UE-ID, and sends a User Authentication Request to verify the user behind the UE (102) requesting for the Metaverse service. The request may be sent via a NEF entity (e.g. the NEF entity (116) in Fig. 9) if the AF entity (110) is not trusted by the network. The request may be directly sent to a new network entity called User Authentication Function (UAF) entity (106), or via an existing entity, e.g. UDM entity (108) or an AAnF entity (e.g., the AAnF entity (114) in Fig. 6) which then routes it to the UAF entity (106). The UAF entity (106) is responsible for performing User authentication. The UAF entity functionality may be co-located with an existing entity.

[0109] At step 4-3, the upon receiving the User Authentication Request from the AF, the UAF entity (106) initiates the user authentication procedure by sending the User Authentication Request to the 3rd party Identity Service Provider (e.g., the user AAA entity (112)). The request may include a Session-ID / User-ID if provided in Step 4-1 of the Fig. 4.

[0110] At step 4-4a and / or step 4-4b and / or step 4-4c, upon receiving the User Authentication Request from the UAF entity (106), the user AAA entity (112) (or 3rdparty service provider) initiates the user authentication procedure with the UE (102) using, e.g. AAA protocol. The procedure may involve exchange of User-ID token as specified in Fig. 3 (Steps 3-4, 3-5).

[0111] At step 4-5, post successful authentication, the 3rd Party (e.g., the user AAA entity (112)) could derive a new User-Identity for the User. This step is similar to Step 3-9 of Fig. 3. For example, the identity could be:

[0112] a) User-Identity = UE-ID||External-Identity-Provider-ID||KAF|| User-Id token||Digital-ID and other possible parameters.

[0113] In another embodiment, if the mobile metaverse server can have one or more mobile metaverse service to a user access, and for certain scenarios, in order to authenticate a User Identity to a service with a User Identifier, the user identity should contain the service name and / or the service ID. The Third party can derive a user identity for such case as follows:

[0114] a) User-Identity = UE-ID||External-Identity-Provider-ID||KAF|| User-ID token||Digital-ID||service name and / or service ID and other possible parameters, wherein KAFis a key associated with the AAnF entity.

[0115] In an embodiment, the user ID can take the format of NAI and the realm part includes the service name / service ID.

[0116] At step 4-6, the user AAA entity (112) and / or the 3rd party sends result of authentication to the UAF entity (106). The message can optionally include the User-ID, User-ID Token and / or TLS-type certificate for certifying the authentication along with the result of authentication.

[0117] At step 4-7, the UAF entity (106) stores the result locally for future interaction. It may optionally provide the certificate details to the UE (102) for use in future interaction with Metaverse services.

[0118] At step 4-8, the UAF entity (106) sends result of authentication to the AF entity (110). The message may include result of authentication, User-Identity and / or the Digital-ID and other possible parameters.

[0119] FIG. 5 is a flow chart (S500) illustrating the AF entity (110) requests the Identity provider to initiate the user authentication, according to the embodiments as disclosed herein. The AF entity (110) contacts the user Identity Provider directly for the user Authentication. Where it is the AF entity (110) directly asks the User AAA entity (112) to initiate the user authentication for the Metaverse services.

[0120] At step 5-0, the UE (102) is pre-configured with credentials for accessing 3GPP network, for bio-metric verification of the user(s) and optionally with credentials for Digital-ID. It may also be preconfigured with the Digital-ID of user(s) for obtaining the Metaverse services. Also, the primary authentication is performed as described in clause 6.1 in 3GPP TS 33.501 and the UE (102) is authenticated with the 3GPP core network.

[0121] At step 5-1, the UE (102) sends session establishment request to the application-function (AF) entity (110) to access Metaverse services. The message may include UE-ID identifying the terminal through which services are accessed, AF-ID, and / or an External-Identity-Provider-ID identifying a 3rd party identity service provider though which user utilizing the service can be authenticated. The UE (102) may additionally include the User-ID and / or Session-ID and other possible parameters in the session establishment request message. User-ID is an identity uniquely identifying the user. Session-ID is a randomly generated identity for the session, which can be used if the User-Identity needs to be hidden until identity verification. User-ID / Session-ID are especially useful when multiple users are present behind the UE.

[0122] At step 5-2, the AF entity (110) identifies the Identity Provider based on, e.g. the External-Identity-Provider-ID, and sends a User Authentication Request to verify the user behind the UE (102) requesting for the Metaverse service. The request may include the UE-ID, AF-ID, External-Identity-Provider-ID and / or the User-ID / Session-ID as received in Step 5-1 of FIG. 5.

[0123] At step 5-3, upon receiving the User Authentication Request from the AF entity (110), the User-AAA entity (112) (3rdparty) initiates the user authentication procedure with the UE (102) using, e.g. AAA protocol. The procedure may involve exchange of User-ID token as specified in FIG. 3 (Steps 3-4 and 3-5).

[0124] At step 5-4, post successful authentication, the User-AAA entity (112) and / or the 3rdParty could derive a new User-Identity for the User. This step is similar to Step 3-9 of Fig. 3. For example, the identity could be:

[0125] a) User-Identity = UE-ID||External-Identity-Provider-ID||KAF|| User-ID token||Digital-ID.

[0126] At step 5-5, the user AAA entity (112) and / or the 3rd party sends result of authentication to the AF entity (110). The message can optionally include the User-ID, User-ID Token and / or TLS-type certificate for certifying the authentication along with the result of authentication.

[0127] At step 5-6, the user AAA entity (112) and / or the 3rd party may send result of authentication to the UAF entity (106).

[0128] At step 5-7, the user AAA entity (112) and / or the 3rdparty may additionally store the result of authentication into the UAF entity (106) for future use by the 5GC, which can further store the same in the UE.

[0129] FIG. 6 is a flow chart (S600) illustrating the AF entity (110) requests the AAnF entity (114) to indicate user authentication and the UAF entity (106) initiates the user authentication, according to the embodiments as disclosed herein. FIG. 6 illustrates the extension to an Authentication and Key Management for Application (AKMA) functionality for the User Verification. Where the AKMA extends functionality to additionally perform the user verification / authentication behind the UE.

[0130] At step 6-0a, the UE (102) is pre-configured with credentials for accessing 3GPP network, for bio-metric verification of the user(s) and optionally with credentials for Digital-ID. It may also be preconfigured with the Digital-ID of user(s) for obtaining the Metaverse services. At step 6-0b, the primary authentication is performed as described in clause 6.1 in 3GPP TS 33.501 and the UE (102) is authenticated with the 3GPP core network.

[0131] At step 6-1, the UE (102) sends session establishment request to the application-function (AF) entity (110) to access Metaverse services. The message may include UE-ID identifying the terminal through which services are accessed, AF-ID, and an External-Identity-Provider-ID identifying a 3rd party identity service provider though which user utilizing the service can be authenticated. The UE (102) may additionally include the User-ID and / or Session-ID and other possible parameters in the session establishment request message. User-ID is an identity uniquely identifying the user. Session-ID is a randomly generated identity for the session, which can be used if the User-Identity needs to be hidden until identity verification. User-ID / Session-ID are especially useful when multiple users are present behind the UE.

[0132] At step 6-2, the AF entity (110) identifies the home network based on the UE-ID (A-KID), and sends the Naanf_AKMA_ApplicationKey_Get request to the AAnF entity (114), additionally including a request to perform user-authentication. The request may be sent via a NEF entity (e.g., the NEF entity (116) in FIG. 9) if the AF entity (110) is not trusted by the network.

[0133] At step 6-3, the AAnF entity (114), after validating the AKMA request, sends a User Authentication Request to the UAF entity (106). The UAF entity (106) is responsible for performing the User authentication.

[0134] At step 6-4, the UAF entity (106) initiates the user authentication procedure by sending the User Authentication Request to the UE (102). The message could be sent e.g. via the AMF entity (104) (Over the NAS message), or using AAA (with UAF entity (106) playing role of AAA Server), or any other protocol. The request may include a Session-ID / User-ID if provided in Step 6-1 of the FIG. 6.

[0135] At step 6-5, upon receiving the user authentication message, the UE (102) initiates the user authentication. The user may be identified using User-ID or Session-ID. The UE (102) performs the biometric verification (face images and the fingerprints of the user) and generates result. The result may then be encrypted to generate a User-ID Token, or may be sent directly.

[0136] At step 6-6a and / or step 6-6b, the UE (102) sends the user authentication response to the UAF entity (106) over, e.g. a NAS message (via the AMF entity (104)) or an AAA message. The message includes the result of user-authentication, and / or a User-ID token generated by the UE (102) during the verification process. The message may additionally contain User-ID and / or Session-ID.

[0137] In an embodiment, the UE (102) also provides the Digital-ID of the user to the UAF entity (106) in the user authentication response message. The Digital-ID represents the Avatar used for his / her Metaverse service and this ID will be used by the user for any access to the Metaverse service.

[0138] At step 6-7a and / or step 6-7b, after receiving the user authentication response message from the UE (102), the UAF entity (106) may request the UDM entity (108) and / or the user AAA entity (112) and / or the third party to verify the User-ID Token provided by the UE (102) in-order to further verify / authenticate, e.g. the freshness of bio-metric authentication of the user behind the UE (102) and / or additional information relating to bio-metric verification. Alternatively, it may validate the token based on locally available information.

[0139] In an embodiment, the user 3rd party entity pre-configures the User-ID token and user information for the users engaging for the Metaverse services.

[0140] At step 6-8a and / or step 6-8b, the UDM entity (108) and / or the user AAA entity (112) and / or the user 3rd party verify the User-ID token and validates whether there is a real user behind the UE (102) as claimed. At step 6-9a and / or step 6-9b, the UDM entity (108) and / or the user AAA entity (112) and / or 3rd party entity provides the User Authentication response to the UAF entity (106). The verification response message includes the success / failure indication and other possible parameters.

[0141] In an embodiment, if in step 6-1 of the FIG. 6, the UE (102) had sent only Session-ID (and not the User-ID), the 3rd party or the UDM entity (108) now provides the User-ID to the UAF entity (106) in the verification response.

[0142] In an embodiment, the response contains the User-ID and a TLS-type certificate indicating the User-ID verification is signed by a Certificate Authority, and is valid for certain duration.

[0143] At step 6-10, if the UAF entity (106) receives success indication in any of step 6-5, 6-8a, or 6-8b, then the UAF entity (106) may derive a new User-Identity to be used by external world (e.g. AF) for the user. This Step is similar to Step 3-9 of the FIG. 3.

[0144] At step 6-11, after successfully deriving the User-Identity, the UAF entity (106) may send a notification message to the UE (102). In this message, the UAF entity (106) provides the User-Identity derived for the authenticated User to access the Metaverse services.

[0145] At step 6-12, the after successfully deriving the User-Identity and performing user authentication, the UAF entity (106) sends the user authentication response to the AAnF entity (114) including result of user authentication and / or the new derived user-identity and other possible parameters. This message may additionally include the Digital-ID (his / her avatar ID) obtained from the UE.

[0146] At step 6-13, the AAnF entity (114) provides the response to Naanf_AKMA_ApplicationKey Get request to the AF entity (110), including the AKMA Keys and the result of the User authentication. The response may be sent via the NEF entity (116) if the AF entity (110) is external and / or untrusted.

[0147] In an embodiment, instead of sending a new message for user authentication, the AF entity (110) re-uses the existing message with an additional indication Naanf_AKMA_ApplicationKey Get request (A-KID, AF_ID). The AF entity (110) includes an indication to the AAnF entity (114) to start the user authentication in addition to the AKMA key retrieval / generation.

[0148] FIG. 7 is a flow chart (S700) illustrating the UE (102) initiates user authentication and the UAF entity (106) provides the certificate to the user, according to the embodiments as disclosed herein.

[0149] The FIG. 7 illustrates the UE (102) initiating the user authentication procedure for using validation certificate in Metaverse. Where the user authenticates another option. At step 7-0a, the UE (102) is pre-configured with credentials for accessing 3GPP network, bio-metric verification of the user(s) and optionally credentials for Digital-ID. It may also be preconfigured with the Digital-ID of user(s) for obtaining the Metaverse services. At step 7-0b, the primary authentication is performed as described in clause 6.1 in 3GPP TS 33.501 and the UE (102) is authenticated with the 3GPP core network. Also, the User performs local bio-metric verification and generates result and / or a token representing anonymized result.

[0150] At step 7-1, the UE (102) sends the user authentication request to the AMF / Session Management Function (SMF) entity (104). The message may include UE-ID, Digital-ID, and either the User-ID or the Session-ID, the result of biometric user-verification and / or the token representing the result of biometric user-verification and other possible parameters. The request can also be sent directly to the UAF entity (106). The UAF entity information may be pre-configured into the UE (102), or provided during registration procedure, or learnt via other means. At step 7-2, the AMF / SMF entity (104) forwards the user authentication request to the UAF entity (106).

[0151] At step 7-3, upon receiving the user authentication request the network verifies the user, post successful validation, UAF entity (106) / network generates a short-term identity certificate to claim the real user. The certificate indicates that User behind the UE (102) has been verified by the network, and hence signed by a CA, and is valid for a certain duration. This step may involve User verification as specified in other alternatives, or it can directly use the Authentication result provided in Step 7-1.

[0152] In an embodiment, the certificate can be pre-configured or network signs the certificate and provides to the UE (102) via NAS message to verify the real User which it is claimed to be. The certificate is generated when the UE (102) initiates the user authentication request with the network.

[0153] At step 7-4, the UAF entity (106) sends the user authentication response message to the AMF / SMF entity (104). The message includes the certificate (certificate_user) for the verified user. The message may also be sent directly to the UE over, e.g. data-path. At step 7-5, the AMF / SMF entity (104) forwards the user authentication response message to the UE (102). The message includes the certificate (certificate_user) for the verified user. At step 7-6, the UE (102) sends the session establishment request to the AF entity (110) for obtaining the Metaverse service. The message includes the UE-ID, certificate_user and the Digital-ID of the avatar which he / she owns and other possible parameters. At step 7-7, the AF entity (110) verifies the certificate provided by the UE (102) and confirms the real user and provides the Metaverse service.

[0154] In an embodiment, the AF is in possession (pre-configured) of the credentials to verify the UE certificate.

[0155] In an embodiment, whenever the user connects to the Metaverse network, the user provides the certificates. User can indicate that he / she has a certificate provided by the network and say he / she is the real user. The third party / AF can verify the user using the certificate.

[0156] FIG. 8 is a flow chart (S800) illustrating the UE (102) initiates binding request and the UAF entity (106) initiates the user authentication, according to the embodiments as disclosed herein.

[0157] FIG. 8 illustrates the network initiates the user authentication procedure and the 3rd party provides the certificate. Where the UE (102) initiates the user authentication request and provides the UE-ID, Digital-ID and External-Identity-Provider-ID to the UAF entity (106).

[0158] The term "External-Identity-Provider-ID" and / or "External Provider ID" are interchangeably used to address the User identity provider's ID. The term "External provider", "User AAA", "3rdparty entity" "user 3rdparty" are interchangeably used to address the user identity provider for the Metaverse service.

[0159] At step 8-0a, the UE (102) is pre-configured with credentials for accessing 3GPP network, bio-metric verification of the user(s) and optionally credentials for Digital-ID. It may also be preconfigured with the Digital-ID of user(s) for obtaining the Metaverse services.

[0160] In an embodiment it is assumed that the primary authentication is performed as described in 6.1 clause of TS 33.501 and the UE (102) is successfully authenticated with the core network.

[0161] At step 8-1, the UE (102) sends the user authentication request to the AMF / SMF entity (104). The message may include UE-ID, Digital-ID, and either the User-ID or the Session-ID, the result of biometric user-verification and / or the token representing the result of biometric user-verification and other possible parameters. The request can also be sent directly to the UAF entity (106). The UAF information may be pre-configured into the UE, or provided during registration procedure, or learnt via other means.

[0162] In another embodiment, the user ID of the user is sent by the UE either in the registration request and / or PDU session establishment request.

[0163] At step 8-2, the AMF / SMF entity (104) and / or a SEcurity Anchor Function (SEAF) sends the user authentication request to the User Authentication Function (UAF) entity (106). In an embodiment, the UAF entity (106) is the new network function assigned by the 3GPP network to perform the user authentication functionality. The UE (102) can exchange messages with the UAF entity (106) over the NAS and the external AF can reach out to the UAF entity (106) via the NEF entity (116).

[0164] At step 8-3, upon receiving the user authentication request, the User Authentication Function (UAF) entity (106) may initiate the authentication procedure towards UE. After that, the UAF entity (106) sends the user authentication request to the external ID provider / user AAA entity (112).

[0165] At step 8-4, the user 3rd party entity and / or the user AAA entity (112) may validate the information received and generate a User Certificate / Token which can be presented by User to AF. The certificate indicates that User behind the UE (102) has been verified by the network, and hence signed by a CA, and is valid for a certain duration.

[0166] In an embodiment, the 3rd party and / or the user AAA entity (112) may pre-configure the User-Id token and user information for the users engaging for the Metaverse services. The user 3rd party verifies the pre-configured information of user and verifies the User Authentication Request.

[0167] The step may involve User verification as specified in other alternatives, or it can directly use the result provided in previous step. After successfully performing the User Authentication, the AF entity (110) and / or the user 3rd party sends the User Authentication Response message to the UAF entity (106). This message includes the user validation certificate and / or user ID token and / or the AF ID which provides the Metaverse service to the user.

[0168] At step 8-5a and / or step 8-5b, upon receiving the user authentication response message from the 3rd party, the UAF entity (106) stores the User ID token and Digital ID for future use. The UAF entity (106) may also derives a new user identity as described in FIG. 3 of this document and binds the user ID with digital ID.

[0169] In an embodiment, the UAF entity (106) requests the UDM entity (108) to update the records by adding the binding of digital ID with 3GPP subscription, external provider id and with user identity for the Metaverse services (for example, at step 8-6a).

[0170] In an embodiment, the UAF entity (106) sends the User Authentication Response message to the UE (102) (via the AMF entity (104)(for example, at step 8-6b). This message includes the user identity and / or the new certificate and other possible parameters.

[0171] In another embodiment, if the UAF entity (106) is aware of AF ID by any means, the Common API Framework (CAPIF) API exposure as described in TS 33.122, clause 6, is performed between the UAF entity (106) and the external AF. The authentication methods are selected as described in 3GPP TS 33.122 clause 6.5.2.

[0172] FIG. 9 is a flow chart (S900) illustrating the UDM entity (108) initiates user authentication and the UDM entity (108) provides the User-ID for authenticated user, according to the embodiments as disclosed herein.

[0173] The UDM entity (108) performs the user authentication based on the request from the AF, where the UDM entity (108) initiates user authentication and provides the User-ID. At step 9-0a, the UE (102) is pre-configured with credentials for accessing 3GPP network, bio-metric verification of the user(s) and optionally credentials for Digital-ID. It may also be preconfigured with the Digital-ID of user(s) for obtaining the Metaverse services. At step 9-0b, the primary authentication is performed as described in clause 6.1 in 3GPP TS 33.501 and the UE (102) is authenticated with the 3GPP core network.

[0174] At steps 9-1a 9-1b, the AF entity (110) sends the user authentication request to the UDM entity (108) via the NEF entity (116). This message includes UE ID, session ID and other possible parameters.

[0175] At step 9-2, upon receiving the user authentication request, the UDM entity (108) sends the user authentication request to the AMF entity (104). This message includes UE ID, session ID and other possible parameters.

[0176] At step 9-3, upon receiving the User Authentication Request, the AMF entity (104) identifies the UE (102) based on the UE ID and sends the User Authentication request to the UE. This message includes UE ID, session ID and other possible parameters. In an embodiment, the User Authentication message also includes the AF ID.

[0177] At steps 9-4a and 9-4b, the UE (102) performs the biometric verification (face images and the fingerprints of the user) and generates result. The result may then be encrypted to generate a User-ID Token, or may be sent directly. The user ID token includes which application the user is allowed to access. At step 9-5, the UE (102) sends the user authentication response to the AMF entity (104) over, e.g. a NAS message. The message includes the result of user-authentication, and / or a User-ID token generated by the UE (102) during the verification process. At step 9-6, the AMF entity (104) forwards the User Authentication Response to the UDM entity (108) over, e.g. a NAS message. The message includes the result of user-authentication, and / or a User-ID token generated by the UE (102) during the verification process.

[0178] In an embodiment, an existing NAS message and / or a new NAS message can be used for sending the user Authentication request / response.

[0179] At step 9-7, upon receiving the User Authentication Response, the UDM entity (108) initiates the user verification from network side. The UDM entity (108) may verify may verify the locally stored user profile information with the User ID token / result received in step 9-6 and provide a user ID. The UDM may include the User profile information.

[0180] In an embodiment, if the user ID provider is different from the UDM entity (108), the UDM entity (108) includes the ID provider's ID in its records for future use.

[0181] At steps 9-8a and 9-8b, once the verification at the UDM entity (108) is successful, the UDM entity (108) sends a notification message to the UE (102) via the AMF entity (104). This message includes the User ID provided by the UDM. At steps 9-9a and 9-9b, the UDM entity (108) also sends the User Authentication Response to the AF entity (110) via the NEF entity (116). This message includes the result of user authentication and / or user ID of the authenticated user to be used for the metaverse service and other possible parameters.

[0182] The UDM entity (108) initiates user authentication and the AMF entity (104) derives the user ID, where the user verification is successful at the UDM entity (108), it indicates the AMF entity (104) to provide / assign a user ID. That is, based on the indication from the UDM entity (108), the AMF entity (104) derives / assigns a user ID to the authenticated user to be used with external entity for the metaverse.

[0183] FIG. 10 shows various hardware components of the AF entity (110), according to the embodiments as disclosed herein. In an embodiment, the AF entity (110) includes a processor (1010), a communicator (1020), a memory (1030) and an authentication controller (1040). The processor (1010) is coupled with the communicator (1020), the memory (1030) and the authentication controller (1040). The processor (1010) and / or the authentication controller (1040) may perform at least one of the operations of the the AF entity (110) as described with reference to Figs. 3 to 9.

[0184] The authentication controller (1040) receive the session establishment request message to access the metaverse service from the user of the UE (102). The session establishment request message includes the UE-ID identifying the UE (102) through which the metaverse service is accessed, the AF-ID, an external identity provider ID identifying the 3rdparty identity service provider though which the user utilizing the service is authenticated, the session ID and the anonymous user ID. Further, the authentication controller (1040) identifies the home network based on the UE-ID. Further, the authentication controller (1040) sends the user authentication request to the UAF entity (106) for verifying a user behind the UE (102) requesting for the metaverse service based on the identification. Further, the authentication controller (1040) receives the user authentication response from the UAF entity (106) based on the user authentication request. The user authentication response includes the user authentication result and the derived user-identity.

[0185] The authentication controller (1040) is implemented by analog and / or digital circuits such as logic gates, integrated circuits, microprocessors, microcontrollers, memory circuits, passive electronic components, active electronic components, optical components, hardwired circuits and the like, and may optionally be driven by firmware.

[0186] The processor (1010) may include one or a plurality of processors. The one or the plurality of processors may be a general-purpose processor, such as a central processing unit (CPU), an application processor (AP), or the like, a graphics-only processing unit such as a graphics processing unit (GPU), a visual processing unit (VPU), and / or an AI-dedicated processor such as a neural processing unit (NPU). The processor (1010) may include multiple cores and is configured to execute the instructions stored in the memory (1030).

[0187] Further, the processor (1010) is configured to execute instructions stored in the memory (1030) and to perform various processes. The communicator(1020) is configured for communicating internally between internal hardware components and with external devices via one or more networks. The memory (1030) also stores instructions to be executed by the processor (1010). The memory (1030) may include non-volatile storage elements. Examples of such non-volatile storage elements may include magnetic hard discs, optical discs, floppy discs, flash memories, or forms of electrically programmable memories (EPROM) or electrically erasable and programmable (EEPROM) memories. In addition, the memory (1030) may, in some examples, be considered a non-transitory storage medium. The term "non-transitory" may indicate that the storage medium is not embodied in a carrier wave or a propagated signal. However, the term "non-transitory" should not be interpreted that the memory (1030) is non-movable. In certain examples, a non-transitory storage medium may store data that can, over time, change (e.g., in Random Access Memory (RAM) or cache).

[0188] In an embodiment, the communicator (1020) includes an electronic circuit specific to a standard that enables wired or wireless communication. The communicator (1020) is configured to communicate internally between internal hardware components of the AF entity (110) and with external devices via one or more networks.

[0189] Although the FIG. 10 shows various hardware components of the AF entity (110) but it is to be understood that other embodiments are not limited thereon. In other embodiments, the AF entity (110) may include less or more number of components. Further, the labels or names of the components are used only for illustrative purpose and does not limit the scope of the invention. One or more components can be combined together to perform same or substantially similar function in the AF entity (110).

[0190] FIG. 11 shows various hardware components of the UAF entity (106), according to the embodiments as disclosed herein. In an embodiment, the UAF entity (106) includes a processor (1110), a communicator (1120), a memory (1130) and an authentication controller (1140). The processor (1110) is coupled with the communicator (1120), the memory (1130) and the authentication controller (1140). The processor (1110) and / or the authentication controller (1140) may perform at least one of the operations of the UAF entity (106) as described with reference to Figs. 3 to 9.

[0191] The authentication controller (1140) receives the user authentication request from the AF entity (110) for verifying the user behind the UE (102) requesting for the metaverse service. The user authentication request includes the UE ID, the session ID, the anonymous user ID and the external identity provider ID identifying the 3rdparty identity service provider though which the user utilizing the service is authenticated. Further, the authentication controller (1140) sends the user authentication request to the UE via the existing NAS message or using the new NAS message. Further, the authentication controller (1140) receives the user authentication response comprising the user ID token and the authentication result from the UE as a result of biometric verification. Further, the authentication controller (1140) sends another user authentication request comprising the user ID token and the authentication result to at least one of a UDM entity (108) and a third party service provider. Further, the authentication controller (1140) receives the user authentication response from at least one of: the UDM entity (108) and the third party service provider. Further, the authentication controller (1140) derives the user-identity based on the user authentication response received from at least one of: the UDM entity (108) and the third party service provider. Further, the authentication controller (1140) sends the user authentication response to the AF entity (110) based on the user authentication request. The user authentication response includes the user authentication results and the derived user-identity.

[0192] The authentication controller (1140) is implemented by analog and / or digital circuits such as logic gates, integrated circuits, microprocessors, microcontrollers, memory circuits, passive electronic components, active electronic components, optical components, hardwired circuits and the like, and may optionally be driven by firmware.

[0193] The processor (1110) may include one or a plurality of processors. The one or the plurality of processors may be a general-purpose processor, such as a central processing unit (CPU), an application processor (AP), or the like, a graphics-only processing unit such as a graphics processing unit (GPU), a visual processing unit (VPU), and / or an AI-dedicated processor such as a neural processing unit (NPU). The processor (1110) may include multiple cores and is configured to execute the instructions stored in the memory (1130).

[0194] Further, the processor (1110) is configured to execute instructions stored in the memory (1130) and to perform various processes. The communicator(1120) is configured for communicating internally between internal hardware components and with external devices via one or more networks. The memory (1130) also stores instructions to be executed by the processor (1110). The memory (1130) may include non-volatile storage elements. Examples of such non-volatile storage elements may include magnetic hard discs, optical discs, floppy discs, flash memories, or forms of electrically programmable memories (EPROM) or electrically erasable and programmable (EEPROM) memories. In addition, the memory (1130) may, in some examples, be considered a non-transitory storage medium. The term "non-transitory" may indicate that the storage medium is not embodied in a carrier wave or a propagated signal. However, the term "non-transitory" should not be interpreted that the memory (1130) is non-movable. In certain examples, a non-transitory storage medium may store data that can, over time, change (e.g., in Random Access Memory (RAM) or cache).

[0195] In an embodiment, the communicator (1120) includes an electronic circuit specific to a standard that enables wired or wireless communication. The communicator (1120) is configured to communicate internally between internal hardware components of the UAF entity (106) and with external devices via one or more networks.

[0196] Although the FIG. 11 shows various hardware components of the UAF entity (106) but it is to be understood that other embodiments are not limited thereon. In other embodiments, the UAF entity (106) may include less or more number of components. Further, the labels or names of the components are used only for illustrative purpose and does not limit the scope of the invention. One or more components can be combined together to perform same or substantially similar function in the UAF entity (106).

[0197] FIG. 12 shows various hardware components of the UDM entity (108), according to the embodiments as disclosed herein. In an embodiment, the UDM entity (108) includes a processor (1210), a communicator (1220), a memory (1230) and an authentication controller (1240). The processor (1210) is coupled with the communicator (1220), the memory (1230) and the authentication controller (1240). The processor (1210) and / or the authentication controller (1240) may perform one or more operations performed by the UDM entity (108) as described in Figs. 3 to 9.

[0198] The authentication controller (1240) receives the user authentication request from the AF entity (110) for verifying the user behind the UE (102) requesting for the metaverse service. The user authentication request includes the UE ID and the session ID. Further, the authentication controller (1240) sends the user authentication request to the UE (102) through the AMF entity (104). Further, the authentication controller (1240) receives the user authentication response comprising a user ID token and an authentication result from the UE (102) through the AMF entity (104). Further, the authentication controller (1240) initiates the user verification at a network side by verifying the locally stored user profile information with the user ID token received from the UE via the AMF. Further, the authentication controller (1240) sends the user authentication response to the AF entity (110) based on the user authentication request. The user authentication response includes the user authentication result and the derived user-identity.

[0199] In an embodiments, the UE sends the user authentication request to at least one of: the AMF entity (104), the SMF entity and the UAF entity (106) via at least one of: a registration request and a PDU session establishment request by receiving, by at least one of: the AMF entity (104), the SMF entity and the UAF entity (106), the user authentication request from the UE (102) comprising an user ID and a UE ID, initiating, by the UAF entity (106), a user verification by verifying a locally stored user profile information, generating, by the UAF entity (106), a short-term identity certificate where the short-term identity certificate indicates that user behind the UE (102) has been verified by the network, so that the short-term identity certificate is signed by a CA, and is valid for a certain duration, initiating, by the UDM entity (108), a user verification by verifying a locally stored user profile information, and generating, by the UDM entity (108), a user ID for the user to be provided for an application server or metaverse server for further communication to perform the legitimate user verification.

[0200] The authentication controller (1240) is implemented by analog and / or digital circuits such as logic gates, integrated circuits, microprocessors, microcontrollers, memory circuits, passive electronic components, active electronic components, optical components, hardwired circuits and the like, and may optionally be driven by firmware.

[0201] The processor (1210) may include one or a plurality of processors. The one or the plurality of processors may be a general-purpose processor, such as a central processing unit (CPU), an application processor (AP), or the like, a graphics-only processing unit such as a graphics processing unit (GPU), a visual processing unit (VPU), and / or an AI-dedicated processor such as a neural processing unit (NPU). The processor (1210) may include multiple cores and is configured to execute the instructions stored in the memory (1230).

[0202] Further, the processor (1210) is configured to execute instructions stored in the memory (1230) and to perform various processes. The communicator(1220) is configured for communicating internally between internal hardware components and with external devices via one or more networks. The memory (1230) also stores instructions to be executed by the processor (1210). The memory (1230) may include non-volatile storage elements. Examples of such non-volatile storage elements may include magnetic hard discs, optical discs, floppy discs, flash memories, or forms of electrically programmable memories (EPROM) or electrically erasable and programmable (EEPROM) memories. In addition, the memory (1230) may, in some examples, be considered a non-transitory storage medium. The term "non-transitory" may indicate that the storage medium is not embodied in a carrier wave or a propagated signal. However, the term "non-transitory" should not be interpreted that the memory (230) is non-movable. In certain examples, a non-transitory storage medium may store data that can, over time, change (e.g., in Random Access Memory (RAM) or cache).

[0203] In an embodiment, the communicator (1220) includes an electronic circuit specific to a standard that enables wired or wireless communication. The communicator (1220) is configured to communicate internally between internal hardware components of the UDM entity (108) and with external devices via one or more networks.

[0204] Although the FIG. 12 shows various hardware components of the UDM entity (108) but it is to be understood that other embodiments are not limited thereon. In other embodiments, the UDM entity (108) may include less or more number of components. Further, the labels or names of the components are used only for illustrative purpose and does not limit the scope of the invention. One or more components can be combined together to perform same or substantially similar function in the UDM entity (108).

[0205] FIG. 13 is a flow chart (S1300) illustrating a method, implemented by the AF entity (110), for authenticating the UE (102) for the metaverse service, according to the embodiments as disclosed herein. The operations (S1302-S1308) are handled by the authentication controller (1040).

[0206] At S1302, the method includes receiving the session establishment request message to access the metaverse service from the user of the UE. The session establishment request message includes the UE-ID identifying the UE (102) through which the metaverse service is accessed, the AF-ID, the external identity provider ID identifying the 3rdparty identity service provider though which the user utilizing the service is authenticated, the session ID and the anonymous user ID. At S1304, the method includes identifying the home network based on the UE-ID. At S1306, the method includes sending the user authentication request to the UAF entity (106) for verifying the user behind the UE (102) requesting for the metaverse service based on the identification. At S1308, the method includes receiving the user authentication response from the UAF entity (106) based on the user authentication request. The user authentication response comprises the user authentication result and a derived user-identity.

[0207] FIG. 14 is a flow chart (S1400) illustrating a method, implemented by the UAF entity (106), for authenticating the UE (102) for the metaverse service, according to the embodiments as disclosed herein. The operations (S1402-S1414) are handled by the authentication controller (1140).

[0208] At S1402, the method includes receiving the user authentication request from the AF entity for verifying the user behind the UE (102) requesting for the metaverse service. The user authentication request includes the UE ID, the session ID, the anonymous user ID, and an external identity provider ID identifying the 3rdparty identity service provider though which the user utilizing the service is authenticated. At S1404, the method includes sending the user authentication request to the UE (102) via the existing NAS message or using the new NAS message. At S1406, the method includes receiving the user authentication response comprising the user ID token and an authentication result from the UE as a result of biometric verification. At S1408, the method includes sending another user authentication request comprising the user ID token and the authentication result to at least one of a UDM entity (108) and a third party service provider.

[0209] At S1410, the method includes receiving the user authentication response from at least one of: the UDM entity (108) and the third party service provider. At S1412, the method includes deriving the user-identity based on the user authentication response received from at least one of: the UDM entity (108) and the third party service provider. At S1414, the method includes sending the user authentication response to the AF entity (110) based on the user authentication request. The user authentication response comprises the user authentication result and the derived user-identity.

[0210] FIG. 15 is a flow chart (S1500) illustrating a method, implemented by the UDM entity (108), for authenticating the UE (102) for the metaverse service, according to the embodiments as disclosed herein. The operations (S1502-S1510) are handled by the authentication controller (1240).

[0211] At S1502, the method includes receiving the user authentication request from the AF entity (110) for verifying the user behind the UE (102) requesting for the metaverse service. The user authentication request includes the UE ID and the session ID. At S1504, the method includes sending the user authentication request to the UE (102) through the AMF entity (104). At S1506, the method includes receiving the user authentication response comprising the user ID token and the authentication result from the UE (102) through the AMF entity (104). At S1508, the method includes initiating the user verification at a network side by verifying the locally stored user profile information with the user ID token received from the UE via AMF. At S1510, the method includes sending the user authentication response to the AF entity (110) based on the user authentication request, wherein the user authentication response comprises the user authentication result and the derived user-identity.

[0212] The various actions, acts, blocks, steps, or the like in the flow charts (S1300-S1500) may be performed in the order presented, in a different order or simultaneously. Further, in some embodiments, some of the actions, acts, blocks, steps, or the like may be omitted, added, modified, skipped, or the like without departing from the scope of the invention.

[0213] The foregoing description of the specific embodiments will so fully reveal the general nature of the embodiments herein that others can, by applying current knowledge, readily modify and / or adapt for various applications such specific embodiments without departing from the generic concept, and, therefore, such adaptations and modifications should and are intended to be comprehended within the meaning and range of equivalents of the disclosed embodiments. It is to be understood that the phraseology or terminology employed herein is for the purpose of description and not of limitation. Therefore, while the embodiments herein have been described in terms of preferred embodiments, those skilled in the art will recognize that the embodiments herein can be practiced with modification within the scope of the embodiments as described herein.

Claims

1.A method for authenticating a User Equipment (UE) (102), comprising:receiving, by an Application-Function (AF) entity (110), a session establishment request message from a user of the UE (102);sending, by the AF entity (110), a user authentication request to a User Data Management (UDM) entity (108) based on the session establishment request message; andreceiving, by the AF entity (110), a user authentication response from the UDM entity (108) based on the user authentication request, wherein the user authentication response comprises a user authentication result.2.The method as claimed in claim 1, wherein the user authentication request is sent to the UDM entity (108) via a Network Exposure Function (NEF) entity (116).3.The method as claimed in claim 1, wherein the session establishment request message comprises a UE-identifier (ID), a session ID and an anonymous user ID.4.The method as claimed in claim 1, wherein the user authentication request comprises a UE identifier (ID).5.A method for authenticating a User Equipment (UE) (102), comprising:receiving, by a User Data Management (UDM) entity (108), a user authentication request from an Application-Function (AF) entity (110);sending, by the UDM entity (108), the user authentication request to an Access and Mobility management Function (AMF) entity (104);receiving, by the UDM entity (108), a user authentication response comprising a user identifier (ID) token and an authentication result provided by the UE (102) from the AMF entity (104);initiating, by the UDM entity (108), a user verification from a network side; andsending, by the UDM entity (108), a user authentication response to the AF entity (110) based on the user authentication request, wherein the user authentication response comprises a user authentication result.6.The method as claimed in claim 5, wherein the user authentication request is received from the AF entity (110) via a Network Exposure Function (NEF) entity (116).7.The method as claimed in claim 5, wherein the user authentication response is sent to the AF entity (110) via a Network Exposure Function (NEF) NEF entity (116).8.The method as claimed in claim 5, wherein the user authentication request comprises a UE ID and a session ID.9.The method as claimed in claim 5, wherein initiating the user verification comprises verifying a locally stored user profile information with the authentication result.10.The method as claimed in claim 5, wherein the authentication result provided by the UE (102) is associated with a biometric verification performed by the UE (102).11.A User Data Management (UDM) entity (108) for authenticating a User Equipment (UE) (102), comprising:a memory (1230);a processor (1210); andan authentication controller (1240), communicatively coupled to the memory (1230) and the processor (1210), configured to:receive a user authentication request from an Application-Function (AF) entity (110);send the user authentication request to an Access and Mobility management Function (AMF) entity (104);receive a user authentication response comprising a user identifier (ID) token and an authentication result provided by the UE (102) from the AMF entity (104);initiate a user verification from a network side; andsend a user authentication response to the AF entity (110) based on the user authentication request, wherein the user authentication response comprises a user authentication result.12.The UDM entity as claimed in claim 11, wherein the user authentication request is received from the AF entity (110) via a Network Exposure Function (NEF) entity (116).13.The UDM entity as claimed in claim 11, wherein the user authentication response is sent to the AF entity (110) via a Network Exposure Function (NEF) entity (116).14.The UDM entity as claimed in claim 11, wherein the user authentication request comprises at least one of a UE ID, a User ID, a Session-ID or an anonymous user identity.15.The UDM entity as claimed in claim 11, wherein the authentication controller (1240) is further configured to verify a locally stored user profile information with the authentication result.

Images