Method for handling a non-3GPP access

Abstract

The present disclosure provides a method performed by a wireless device for handling a non- 3GPP access The method comprises transmitting to a gateway node, a first IKE_AUTH request message comprising a Non-Access Stratum, NAS, registration request. The NAS registration request comprises a subscriber identity, one or more NAS security parameters 5 associated with the wireless device. The first IKE_AUTH request message is sent without AUTH payload, and indicates that an EAP-based authentication for Internet Key Exchange version 2, IKEv2, mutual authentication is to be performed. The method comprises receiving from the gateway node, a first IKE_AUTH response message indicating an Extensible Authentication Protocol, EAP, success.

Description

METHOD FOR HANDLING A NON-3GPP ACCESSTECHNICAL FIELD

[0001] Present disclosure relates to methods for handling a non-3rdGeneration Partnership Project(3GPP) access, a wireless device, a gateway node, an access management node, a computer program and a computer program product that perform the methods.BACKGROUND

[0002] Non-3GPP access for a User Equipment (UE) refers to a UE’s accessing to a core network such as the 5G core network (5GC) via non-3GPP access such as Wireless LAN instead of via the 3GPP radio access network, which means that the UE is communicating with the core network via, for example, a Wireless LAN access point (AP) instead of a gNB.

[0003] There are two main aspects of non-3GPP access categories, that is the trusted non-3GPP access and the untrusted non-3GPP access. The trusted non-3GPP access where the non-3 GPP access network is trusted by the home operator and where the network provides the access point with a key to setup secure communication between the UE and the AP. The access network is configured to establish secure communication between the AP and core network, e.g. 5GC.

[0004] In the untrusted non-3GPP access network, the non-3GPP access network is not trusted by the home operator and security between UE and access network is out of scope. The UE connects to for example, 5GC and secures the connection to 5GC using Internet Protocol Security (IPsec) via a gateway called Non-3GPP Interworking Function (N3IWF). Separate IPsec tunnels are used for control plane data (also known as signaling data) and user plane data. The key used to secure the IPsec tunnels between UE and N3IWF is derived during primary authentication. Primary authentication is the network access authentication performed when attaching to 5GC and is based on subscriber credentials, e.g., credentials stored in a Subscriber Identity Module (SIM) card.

[0005] 3GPP TS 33.501 V19.1.0 introduces the establishment of the IPsec tunnels for untrusted non-3GPP access, and the Internet Key Exchange version 2 (IKEv2) protocol is used for this purpose. Secure communication (encrypted, integrity protected, and / or authenticated) is established using IKEv2 and IPsec security associations for the individual IPsec tunnels are then created using the IKEv2 security association (SA) that is the base for the IKEv2 secure communication.

[0006] The IKEv2 mutual authentication between UE and the gateway (e.g. N3IWF) is based on a shared secret key (K N3IWF) obtained from the primary authentication. The primary authentication is tunneled in IKEv2 using the Extensible Authentication Protocol (EAP). For 5G, EAP- AKA’ (Authentication and Key Agreement) is the only EAP method currently allowed for Public Land Mobile Networks (PLMN) for the primary authentication.

[0007] For standalone non-public networks (SNPN), any key generating EAP method may be used, e.g., EAP-TLS (Transport Layer Security). As an alternative to using EAP-AKA’ for the primary authentication for PLMNs, 5G AKA may be used. Both EAP-AKA’ and 5G AKA uses credentials stored in a SIM card (UICC), embedded UICC (eUICC), integrated UICC (iUICC), or integrated eUICC (ieUICC).

[0008] In 5G, the Non-Access Stratum (NAS) signaling protocol, used for signaling between a UE and 5GC when connecting over 3GPP access, is used also for the signaling between the UE and the 5GC when connecting over non-3GPP access. The protocols used for primary authentication, i.e., EAP and 5G AKA, are tunneled inside the NAS protocol. Since non-3GPP access networks (e.g. WLAN) do not support NAS, during primary authentication at initial attachment, the NAS protocol is encapsulated in EAP which is supported by WLAN APs. This encapsulation is for the transport of NAS messages between UE and the gateway (N3IWF) at initial attachment until the IPsec tunnel for signaling is established that can carry NAS messages. The EAP-5G method is used for this purpose. Thus, the EAP-5G is tunneled inside IKEv2, NAS is tunneled inside EAP-5G, and primary authentication (e.g. using EAP-AKA’) is tunneled inside NAS. The extra EAP-5G layer needs to be stripped off by the gateway (e.g. N3IWF) before forwarding to AMF of 5GC. This leads to, for example, the complex implementation in both AMF and the UE where the dual NAS stacks are required to handle both 3GPP access and non-3GPP access.

[0009] Therefore, there is a need for the reduced complexity for non-3GPP access.SUMMARY

[0010] Therefore, it is an object of the disclosure to address the above issues. A particular object is to provide a solution with reduced complexity for the wireless devices to access the core network using non-3GPP access. It is another object of the invention to enhance the process for handling the non-3GPP access.

[0011] According to a first aspect of the disclosure, a method performed by a wireless device for handling anon-3GPP access is provided. The method comprises transmitting to a gateway node, a first IKE_AUTH request message comprising a Non-Access Stratum, NAS,registration request. The NAS registration request comprises a subscriber identity, one or more NAS security parameters associated with the wireless device. The first IKE_AUTH request message is sent without AUTH payload, and indicates that an EAP-based authentication for Internet Key Exchange version 2, IKEv2, mutual authentication is to be performed. The method comprises receiving from the gateway node, a first IKE_AUTH response message indicating an Extensible Authentication Protocol, EAP, success.

[0012] According to a second aspect of the disclosure, a method performed by a gateway for handling a non-3GPP access is provided. The method comprises receiving from a wireless device, a first IKE_AUTH request message comprising a Non-Access Stratum, NAS, registration request. The NAS registration request comprises a subscriber identity, one or more NAS security parameters associated with the wireless device. The first IKE_AUTH request message is sent without AUTH payload, and indicates that an EAP-based authentication for Internet Key Exchange version 2, IKEv2, mutual authentication is to be performed. The method comprises transmitting to the wireless device, a first IKE_AUTH response message indicating an Extensible Authentication Protocol, EAP, success.

[0013] According to a third aspect of the disclosure, a method performed by an access management node for handling a non-3GPP access is provided. The method comprises receiving from a gateway node, a first N2 message comprising a Non-Access Stratum, NAS, registration request. The NAS registration request comprises a subscriber identity, one or more NAS security parameters associated with a wireless device. The method comprises transmitting to the gateway node, a second N2 message comprising an initial context setup request. The second N2 message further indicates an EAP-success and comprises a first key, wherein the first key is used for a mutual authentication of the gateway node and a wireless device before establishing an Internet Protocol Security, IPsec, Security Association, SA. The method comprises receiving from the gateway node, a third N2 message indicating an initial context setup response. The initial context setup response indicates successful establishment of the IPsec SA between the wireless device and the gateway node. The method comprises transmitting to the gateway node, a NAS security mode command message upon the successful establishment of the IPsec SA between the wireless device and gateway node. The method comprises receiving from the gateway node, a NAS security mode complete message in response to the NAS security mode command message.

[0014] According to a forth aspect of the disclosure, a wireless device for handling a non-3 GPP access is provided. The wireless device comprises processing circuitry, the processing circuitry being configured to cause the wireless device to perform the following operations:transmitting to a gateway node, a first IKE_AUTH request message comprising a Non-Access Stratum, NAS, registration request, wherein the NAS registration request comprises a subscriber identity, one or more NAS security parameters associated with the wireless device, and wherein the first IKE AUTH request message is sent without AUTH payload, and indicates that an EAP-based authentication for Internet Key Exchange version 2, IKEv2, mutual authentication is to be performed; and receiving from the gateway node, a first IKE AUTH response message indicating an Extensible Authentication Protocol, EAP, success.

[0015] According to a fifth aspect of the disclosure, a gateway node for handling a non-3GPP access is provided. The gateway node comprises processing circuitry, the processing circuitry being configured to cause the gateway node to perform the following operations: receiving from a wireless device, a first IKE AUTH request message comprising a Non-Access Stratum, NAS, registration request, wherein the NAS registration request comprises a subscriber identity, one or more NAS security parameters associated with the wireless device, and wherein the first IKE AUTH request message is sent without AUTH payload, and indicates that an EAP-based authentication for Internet Key Exchange version 2, IKEv2, mutual authentication is to be performed; and transmitting to the wireless device, a first IKE AUTH response message indicating an Extensible Authentication Protocol, EAP, success.

[0016] According to a sixth aspect of the disclosure, an access management node for handling a non-3GPP access is provided. The access management node comprises processing circuitry, the processing circuitry being configured to cause the access management node to perform following operations: receiving from a gateway node, a first N2 message comprising a Non-Access Stratum, NAS, registration request, wherein the NAS registration request comprises a subscriber identity, one or more NAS security parameters associated with a wireless device; transmitting to the gateway node, a second N2 message comprising an initial context setup request, wherein the second N2 message further indicates an EAP-success and comprises a first key, wherein the first key is used for a mutual authentication of the gateway node and a wireless device before establishing an Internet Protocol Security, IPsec, Security Association, SA; receiving from the gateway node, a third N2 message indicating an initial context setup response, wherein the initial context setup response indicates successful establishment of the IPsec SA between the wireless device and the gateway node; and transmitting to the gateway node, a NAS security mode command message upon the successful establishment of the IPsec SA between the wireless device and gateway node; and receivingfrom the gateway node, a NAS security mode complete message in response to the NAS security mode command message.

[0017] According to a seventh aspect of the disclosure, a computer program for handling a non-3GPP access is provided. The computer program comprises instructions which, when executed by processing circuity, cause the processing circuity to perform one or more the first aspect of the disclosure, the second aspect of the disclosure, the third aspect of the disclosure, as described above.

[0018] According to an eighth aspect of the invention, a computer program product for handling a non-3GPP access is provided. The computer program product comprises a computer readable storage medium. The computer readable storage medium comprises instructions which are executable by processing circuity to cause the processing circuity to perform one or more the first aspect of the disclosure, the second aspect of the disclosure, the third aspect of the disclosure, as described above.BRIEF DESCRIPTION OF DRAWINGS

[0019] The accompanying drawings, which are incorporated herein and form part of the specification, illustrate various embodiments.

[0020] Figure 1 illustrates a signaling diagram for handling a non-3GPP access according to a prior art.

[0021] Figure 2 illustrates a signaling diagram for handling a non-3GPP access according to some embodiments.

[0022] Figure 3 illustrates a schematic diagram for a wireless device for handling a non-3GPP access according to some embodiments.

[0023] Figure 4 illustrates a schematic diagram for a gateway node for handling a non-3GPP access according to some embodiments.

[0024] Figure 5 illustrates a schematic diagram for an access management node for handling a non-3GPP access according to some embodiments.

[0025] Figure 6 illustrates an example of wireless device according to some embodiments.

[0026] Figure 7 illustrates an example of gateway node according to some embodiments.

[0027] Figure 8 illustrates an example of an access management node according to some embodiments.

[0028] Figure 9 illustrates an example of a computer program product comprising computer readable means according to some embodiments.DETAILED DESCRIPTION

[0029] Generally, all terms used herein are to be interpreted according to their ordinary meaning in the relevant technical field, unless a different meaning is clearly given and / or is implied from the context in which it is used. All references to a / an / the element, apparatus, component, means, step, etc. are to be interpreted openly as referring to at least one instance of the element, apparatus, component, means, step, etc., unless explicitly stated otherwise. The steps of any methods disclosed herein do not have to be performed in the exact order disclosed, unless a step is explicitly described as following or preceding another step and / or where it is implicit that a step must follow or precede another step. Any feature of any of the embodiments disclosed herein may be applied to any other embodiment, wherever appropriate. Likewise, any advantage of any of the embodiments may apply to any other embodiments, and vice versa. Other objectives, features and advantages of the enclosed embodiments will be apparent from the following description.

[0030] The inventive concept will now be described more fully hereinafter with reference to the accompanying drawings, in which certain embodiments of the inventive concept are shown. This inventive concept may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided by way of example so that this disclosure will be thorough and complete, and will fully convey the scope of the inventive concept to those skilled in the art.

[0031] Fig.1 illustrates a signaling diagram for handling a non-3GPP access according to existing technology.

[0032] SI 01: The User Equipment (UE) 110 establishes connection with the untrusted non-3GPP access network 120 and obtains an IP address. The UE 110 selects a gateway (e.g. N3IWF) 130 to access 5GC and obtains its IP address.

[0033] S 102: The UE 110 starts the IKEv2 protocol and establishes encrypted and integrity protected communication through exchange of IKE S A INIT messages.

[0034] SI 03: The UE 110 indicates that it wants to perform EAP -based authentication for IKEv2 mutual authentication, by not including the AUTH payload in the first IKE AUTH message sent to the N3IWF, and N3IWF 130 starts the EAP-5G method.

[0035] S104: The UE 110 creates a SUCI and NAS registration request message containing the SUCI, NAS security parameters, etc.

[0036] SI 05: The NAS registration request message, optionally including S-NSSAI, and access network parameters for selecting AMF 140 are sent in an EAP-5G formatted messagefrom the UE 110 to the N3IWF 130. The N3IWF 130 selects AMF 140, extracts the NAS registration request message, and sends the NAS registration request to the selected AMF 140.

[0037] S 106: The AMF 140 extracts the SUCI from the NAS registration request and sends an authentication request containing the SUCI to the AUSF 150. The authentication request is forwarded to UDM 160 where SUCI is de-concealed to obtain SUPI and authentication method for the primary authentication is selected. The primary authentication is then performed between the UE and the AUSF 150. The authentication messages are tunneled in NAS messages between UE 110 and AMF 140, where the NAS messages are tunneled in EAP-5G messages between the UE 110 and N3IWF 130, and where the EAP-5G messages are tunneled in IKE_AUTH messages between UE 110 and N3IWF 130. Upon successful primary authentication a shared key called K SEAF is derived by the UE 110 and AUSF 150, and K SEAF and SUPI are delivered to the AMF 140. Both the UE 110 and AMF 140 derive K AMF from K SEAF.

[0038] S107: The UE 110 and AMF 140 establish NAS security based on K_AMF and agreed security algorithms to be used based on input from the UE in the NAS registration request. NAS security is established using the NAS SMC procedure. The NAS SMC procedure is the NAS Security Mode Command message from AMF 140 to UE 110 and NAS Security Mode Complete message from UE 110 to AMF 140.

[0039] SI 08: Once the NAS security is established, both the UE 110 and AMF 140 derive K N3IWF from K AMF, and K_N3IWF is sent from AMF 140 to N3IWF 130.

[0040] S109: K_N3IWF is the shared secret between UE 110 and N3IWF 130 that is used to mutually authenticate the IKEv2 connection. This is done by exchanging IKE AUTH messages containing MACs derived using K_N3IWF on the IKE_SA_INIT messages exchanged in SI 02.

[0041] SI 10: The IPsec Signaling SA is derived from the IKEv2 SA agreed in S109 and IPsec tunnel capable of carrying NAS messages between UE 110 and N3IWF 130 is now established.

[0042] Sill: The AMF 140 registers the UE 110 over non-3GPP access in the UDM 160.

[0043] SI 12: A NAS registration accept message is created by the AMF 140 and sent to the UE 110 in response to the registration request sent in SI 05.

[0044] SI 13: One or more PDU sessions are established for the UE 110 for user plane traffic and for each PDU session a new IPsec tunnel is established between UE 110 and N3IWF 130.

[0045] SI 14: Protected control plane data can now be exchanged between UE 110 and AMF 140.

[0046] SI 15: Protected user plane data can now be exchanged between UE 110 and UPF 170.

[0047] The use of NAS for both 3GPP and non-3GPP access in 5G, where the UE can be simultaneously connected to 5GC over both 3GPP and non-3GPP access, leads to complex implementations in both the AMF and in the UE where dual NAS stacks are required. This complexity has caused that non-3GPP access solutions (trusted and untrusted) defined for 5G has not yet been deployed and 4G non-3GPP solutions that does not make use of NAS is used instead.

[0048] In addition to the trusted and untrusted non-3GPP access variants for UEs, 3GPP has also defined several variants for how non-3GPP devices that do not support 3GPP specific protocols can access 5GC. For example, the NAS protocol is not supported and dedicated gateways are defined that can handle the NAS protocol on behalf of the non-3GPP devices in the interaction with 5GC.

[0049] Many different non-3GPP access methods add complexity to implementation and complicate security analysis. Thus, reducing the number of variants and simplifying solutions for 6G is important. One option to simplify is to only consider untrusted non-3GPP access and skip trusted non-3GPP access. For example, the untrusted variant for 4G is the one currently being used. Another option to reduce complexity is to only consider EAP based primary authentication. EAP can be tunneled directly in IKEv2 whereas 5G AKA cannot. Removing NAS for non-3GPP access is yet another option to reduce the complexity of non-3GPP access and get rid of the complexity of dual NAS stacks in the AMF. No NAS for non-3GPP access also means no need for EAP-5G which leads to protocol simplification.

[0050] Removing NAS for non-3GPP access in 6G can be one option to reduce complexity because current main use case for non-3GPP access, which is voice over WiFi, is still the main use case in 6G. If other use cases currently supported through NAS over 3GPP access needs to be supported also over non-3GPP access, removing NAS for non-3GPP access may not be an option. An option may then instead be to keep NAS and use dedicated AMFs for non-3GPP access separate from AMFs handling 3GPP access. This way the need for dual NAS stacks in the AMF can be removed (although dual NAS stacks are still required in the UE).

[0051] If NAS remains for non-3GPP access in 6G, the use of EAP-5G for tunneling NAS messages still adds complexity to the protocol stack and any possibility to simplify the protocol stack by removing EAP-5G is desirable.

[0052] A solution to reduce such complexity is proposed here. That is, the NAS protocol is used for non-3GPP access but where the establishment of IPsec tunnels for untrusted non-3GPP access for UEs at initial attachment is performed without the use of EAP-5G.

[0053] Hereafter, the inventive concept is described by using the terms in 5G network, however it is well understood that such inventive concept may be also applicable in other networks where applicable, for example, 6G network.

[0054] Before the IPsec Signaling Security Association (SA) is established (SI 10 of Error! Reference source not found.), the content of relevant NAS messages is exchanged between the AMF and the UE through the IKEv2 protocol messages without the use of the NAS encoded messages, except for the NAS registration request. For example, the EAP based primary authentication is tunneled directly in the IKEv2 protocol. SUCI, NAS security parameters, and optionally S-NSSAI are sent in a NAS registration request, as well as access network parameters for selecting AMF, are provided as part of the first IKEv2 AUTH message, e.g., in the initiator identification (IDi) pay load. Except for the NAS registration request, the N3IWF encodes NAS messages based on the received IKEv2 messages on behalf of the UE to be sent to the AMF and extracts EAP messages in NAS messages from AMF to the UE.

[0055] Once the IPsec tunnel for NAS messages (i.e. the IPsec Signaling SA) is established between UE and N3IWF, the UE starts sending NAS messages. At this point, the NAS SMC procedure is performed to establish the NAS security context. Note that the AMF derives the key K_N3IWF and deliver it to N3IWF before it has performed the NAS SMC procedure in order to be able to establish the IPsec tunnel and leverage it for the NAS SMC exchange.

[0056] The new and inventive concept is to remove EAP-5G as a transport of NAS messages between UE and N3IWF by sending content of relevant NAS messages for the initial attachment in IKEv2 format between the UE and N3IWF. By doing this, N3IWF is able to translate between this format and NAS message format during the interaction with the AMF. In 5G, the NAS SMC procedure is also tunneled in EAP-5G. As part of the new and inventive concept is also to delay the NAS SMC procedure until the IPsec Signaling SA has been established and the IPsec tunnel for signaling data is available that can carry NAS messages. To establish the IPsec Signaling SA, it is required that K_N3IWF is derived from K_AMF by AMF and delivered to N3IWF before the NAS SMC procedure is performed. The generation of the NAS registration request message at the UE means the protection of the initial NAS message, where the UE stores a copy of the initial NAS message comprising the registration request and can include it in the NAS SMC procedure, is still valid. The new and inventive concepts are realized by at least the UE, N3IWF, and AMF.

[0057] The advantage of the proposed solution is to remove one layer (EAP-5G) from the protocol stack which simplifies the implementation both in the UE and N3IWF and reduces message overhead. In N3IWF, at initial attachment, a translation between IKEv2 format and NAS message format in the interaction with UE and AMF is required. The proposed solution limits the primary authentication to EAP-based methods for non-3GPP access. On the other hand, having two different methods based on AKA is not necessary in 6G since it is now the time to adapt to using the EAP framework for authentication.

[0058] Fig. 2 illustrates a signaling diagram for handling a non-3GPP access according to some embodiments.

[0059] S201 a and S201b: The UE 210 establishes connection with the untrusted non-3GPP access network 220 and obtains an IP address. The UE selects a gateway (e.g. N3IWF) 230 to access 5GC and obtains its IP address.

[0060] S202: The UE 210 starts the IKEv2 protocol and establishes encrypted and integrity protected communication through exchange of IKE S A INIT messages (a first IKE SA INIT message from UE 210 to N3IWF 230 and a second IKE_SA_INIT message fromN3IWF 230 to the UE 210).

[0061] S203: The UE 210 creates a SUCI and a NAS registration request message containing the SUCI, NAS security parameters (e.g. UE security capabilities), optionally an S-NSSAI, etc. The UE 210 indicates in the IKE_AUTH request message sent to the N3IWF 230 that it wants to perform EAP-based authentication for IKEv2 mutual authentication by not including the AUTH payload in the IKE AUTH request message and puts the NAS registration request, for example, in the initiator identification (IDi) payload of the IKE AUTH request message along with access network parameters for selecting AMF 240.

[0062] S204: The N3IWF 230 selects AMF 240 based on the access network parameters received in S203.

[0063] S205: The N3IWF 230 sends the received NAS registration request in an N2 message to the selected AMF 240.

[0064] S206: The AMF 240 extracts the SUCI from the NAS registration request and sends an authentication request containing the SUCI to the AUSF 250.

[0065] S207: The authentication request is forwarded to UDM 260 where SUCI is deconcealed to obtain SUPI and authentication method for the primary authentication is selected.

[0066] S208: The primary authentication is then performed between the UE 210 and the AUSF 250 using EAP, e.g. the EAP-AKA’ method. Similar to 5G, the EAP authentication messages are tunneled in NAS messages encapsulated into N2 messages between AMF 240and N3IWF 230. In the proposed solution, the EAP messages are extracted from its corresponding NAS messages and exchanged directly in IKE AUTH request and IKE AUTH response messages between the UE 210 and the N3IWF 230. Upon successful primary authentication, a shared key called K_SEAF is derived by the UE 210 and AUSF 250, and K_SEAF, SUPI, and EAP-Success are delivered from the AUSF 250 to the AMF 240. Both the UE 210 and AMF 240 derives K AMF from K SEAF.

[0067] S209: The AMF 240 derives K_N3IWF from K AMF. Different from the 5G solution using EAP-5G, this derivation is performed before the NAS SMC procedure is performed so NAS COUNTS are zero when used in the derivation, unless NAS COUNTS are available from a previous 5GNAS security context for non-3GPP access with the same AMF 240.

[0068] S210: The derived key K_N3IWF is sent along with EAP-Success from AMF 240 to N3IWF 230 in the N2 Initial Context Setup request message.

[0069] S211: The N3IWF 230 sends an IKE AUTH response containing the EAP- Success.

[0070] S212: When the UE 210 receives EAP-Success, the UE 210 derives K_N3IWF from K AMF and calculates an AUTH payload, which is a MAC computed using K N3IWF on the first IKE_SA_INIT message (see S202) sent from the UE 210 to the N3IWF 230.

[0071] S213: The UE 210 sends an IKE AUTH request message to the N3IWF 230 containing the AUTH payload.

[0072] S214: To authenticate the UE 210, the N3IWF 230 verifies the received AUTH payload using K_N3IWF. Upon successful verification, the N3IWF calculates an AUTH payload, which is a MAC computed using K_N3IWF on the second IKE_SA_INIT message (see S202) sent from the N3IWF 230 to the UE 210.

[0073] S215: The N3IWF 230 sends an IKE AUTH response message to the UE 210 containing the AUTH payload.

[0074] S216: To authenticate the N3IWF 230, the UE 210 then verifies the received AUTH payload using K N3IWF.

[0075] S217: The IKEv2 SA is now agreed and the IPsec Signaling SA is derived from the IKEv2 SA agreed and IPsec tunnel capable of carrying NAS messages between UE 210 and N3IWF 230 is now established.

[0076] S218: The N3IWF 230 sends an N2 Initial Context Setup Response to the AMF 240.

[0077] S219: The AMF 240 can now start the NAS SMC procedure to establish NAS security between UE 210 and AMF 240 based on K_AMF and agreed security algorithms to be used based on input from the UE in the NAS registration request. The AMF 240 initiates the NAS SMC procedure by sending the NAS Security Mode Command message from AMF 240 towards the UE: NAS SMC is encapsulated in an N2 message from AMF 240 to N3IWF 230.

[0078] S220: NAS SMC is forwarded in the IPsec tunnel for signaling from N3IWF 230 to the UE 210.

[0079] S221 : The UE 210 responds with a NAS Security Mode Complete message towards the AMF 240. This message is sent in the IPsec tunnel for signaling from the UE 210 to the N3IWF 230.

[0080] S222: The message is forwarded encapsulated in an N2 message from N3IWF 230 to AMF 240.

[0081] S223 : Once the NAS security is established, the AMF 240 obtains subscription data from the UDM 260 and registers the UE 210 over non-3GPP access in the UDM 260.

[0082] S224: A NAS registration accept message is created by the AMF 240 and sent towards the UE 210 in response to the registration request sent by the UE 210 in S203. Registration accept is encapsulated in an N2 message from AMF 240 to N3IWF 230.

[0083] S225: The registration accept is forwarded in the IPsec tunnel for signaling from N3IWF 230 to the UE 210.

[0084] After the registration procedure is completed, S113-115 ofFigure 1 are performed to establish PDU sessions and IPsec tunnels for exchange of user plane data.

[0085] Note that at initial attachment the UE 210 and AMF 240 do not share an already established NAS security context. Hence, the initial NAS message, i.e., the NAS registration request, is neither encrypted nor integrity protected when sent from the UE 210 to the N3IWF 230 and further to the AMF 240. This allows for modification of the initial message by an attacker. The initial NAS message comprises a number of cleartext information elements (IES) containing information such as SUCI and NAS security parameters (e.g. UE security capabilities). In 5G, there is a possibility to protect the initial NAS message by the AMF 240 requesting (by setting a flag in NAS Security Mode Command message) the UE to include the complete initial NAS message in the NAS Security Mode Complete message sent to the AMF 240. For this reason, it is necessary that the UE 210 sends the formatted initial NAS message S203 and keeps the initial message for sending again in S221.

[0086] In the case a NAS security context is available between UE 210 and AMF 240 such that a full primary authentication is not required, it is assumed that the IPsec tunnel for signaling data is also available such that NAS messages can be exchanged from the start. If this is not the case, an initial attachment needs to be performed.

[0087] As an alternative, the NAS registration request and other parameters mentioned in S203 can be sent from UE 210 to N3IWF 230 as part of one or more other payloads of the IKE AUTH message, e.g., a Notify payload or a combination of two payload types.

[0088] Fig.3 illustrates a schematic diagram for a wireless device for handling a non-3GPP access according to some embodiments.

[0089] A wireless device (e.g. UE 210) may refer to a device capable, configured, arranged and / or operable to communicate wirelessly with network nodes and / or other wireless devices (e.g. user equipment (UE)). Examples of a wireless device include, but are not limited to, a smart phone, mobile phone, cell phone, voice over IP (VoIP) phone, wireless local loop phone, desktop computer, personal digital assistant (PDA), wireless camera, gaming console or device, music storage device, playback appliance, wearable terminal device, wireless endpoint, mobile station, tablet, laptop, laptop-embedded equipment (LEE), laptop-mounted equipment (LME), smart device, wireless customer-premise equipment (CPE), vehicle, vehicle-mounted or vehicle embedded / integrated wireless device, etc. Other examples include any wireless device identified by the 3GPP. For example, the wireless device referred to herein may be a user equipment (UE).

[0090] S301 : The wireless device 210 transmits to a gateway node 230, a first IKE AUTH request message. This procedure corresponds to S203 in Fig.2. The gateway node 230 can be any type of the gateway that handles non-3GPP access from the wireless device 210. In 5G network under 3GPP context, the gateway node 230 may be the N3IWF. An IKE AUTH request is part of the Internet Key Exchange (IKE) protocol, which is used to establish secure communication sessions between the wireless device 210 and the gateway node 230. In some embodiments, the NAS registration request is comprised in an initiator identification payload of the first IKE AUTH request message.

[0091] The first IKE_AUTH request message comprises a Non-Access Stratum, NAS, registration request. The NAS registration request comprises a subscriber identity (e.g. Subscription Concealed Identity, SUCI) of the wireless device 210, one or more NAS security parameters associated with the wireless device 210, and optionally other parameters such as S-NSSAI. The first IKE AUTH request message is sent without AUTH payload, and indicates to the gateway node 230 that an EAP -based authentication for Internet Key Exchange version2, IKEv2, mutual authentication is to be performed. The AUTH payload here refers to a component of the IKEv2 protocol used during the IKE AUTH exchange.

[0092] In some embodiments, the wireless device 210 may perform an EAP -based authentication towards an authentication node 250 without involving EAP-5G. That is, one or more EAP messages generated by the authentication node 250 and the wireless device 210 are exchanged in one or more IKE AUTH request messages and one or more IKE AUTH response messages between the wireless device 210 and the gateway node 230 without further encapsulation. That is, the one or more EAP messages are not encapsulated into EAP-5G, thus there is no extra layer for the EAP-5G. This procedure corresponds to S208 of Fig.2. The authentication node 250 can be any type of the authentication node that handles non-3GPP access from the wireless device 210. In 5G network under 3GPP context, the authentication node 250 may be AUSF.

[0093] S302: The wireless device 210 receives from the gateway node 230, a first IKE AUTH response message indicating an Extensible Authentication Protocol, EAP, success. This procedure corresponds to S211 of Fig.2.

[0094] In some embodiments, the first IKE AUTH response message comprising the EAP success is received upon a successful EAP-based authentication. In some embodiments, the wireless device 210 generates a first key based on the successful EAP-based authentication. This procedure corresponds to S212 of Fig.2. In some embodiments, the first key is K_N3IWF. The wireless device 210 then transmits to the gateway node 230, a second IKE_AUTH request message. This procedure corresponds to S213 of Fig.2. The second IKE AUTH request message may comprise a first payload, and the first payload is generated by the wireless device 210 based on the first key.

[0095] In some embodiments, the wireless device 210 receives from the gateway node 230, a second IKE AUTH response message comprising a second payload. This procedure corresponds to S215 of Fig.2. In some embodiments, the wireless device 210 verifies the second payload based on the first key so as to authenticate the gateway node 230. This procedure corresponds to S216 of Fig.2. In response to a successful authentication of the gateway node 230, the wireless device 210 establishes an Internet Protocol Security, IPSec, Security Association, SA, between the wireless device and the gateway node. This procedure corresponds to S217 of Fig.2.

[0096] In some embodiments, the wireless device 210 receives a NAS security mode command message, from an access management node 240, via the gateway node 230. In some embodiments, the wireless device 210 transmits a NAS security mode complete message, tothe access management node 240 via the gateway node 250. These procedures correspond to S220 and S221 of Fig.2, respectively. The access management node 240 can be any type of the access management node that handles non-3GPP access from the wireless device 210. In 5G network under 3GPP context, the access management node 240 may be AMF.

[0097] In some embodiments, the receiving of the NAS security mode command message and the transmitting of the NAS security mode complete message are performed after establishing the IPSec SA. That is, both the NAS security mode command message and the NAS security mode complete message are sent and received via IPSec SA tunnel. In some embodiments, the NAS security mode complete message comprises a complete initial NAS message, and the complete initial NAS message comprises the NAS registration request. In some embodiments, the NAS security mode command message, the NAS security mode complete message, or the NAS registration accept message is comprised in a N2 message between the gateway node 230 and the access management node 240. In some embodiments, the wireless device 210 receives a NAS registration accept message, from the access management node 240, via the gateway node 230. This procedure corresponds to S225 of Fig.2.

[0098] Fig.4 illustrates a schematic diagram for a gateway node for handling a non-3GPP access according to some embodiments.

[0099] S401: The gateway node 230 receives from a wireless device, a first IKE AUTH request message. This procedure corresponds to S203 in Fig.2. As described above, the first IKE_AUTH request comprises a Non-Access Stratum, NAS, registration request. The NAS registration request comprises a subscriber identity (e.g. Subscription Concealed Identity, SUCI) of the wireless device 210, one or more NAS security parameters associated with the wireless device 210, and optionally other parameters such as S-NSSAI. The first IKE_AUTH request message is sent without AUTH payload, and indicates to the gateway node 230 that an EAP -based authentication for Internet Key Exchange version 2, IKEv2, mutual authentication is to be performed.

[0100] In some embodiments, the NAS registration request is comprised in an initiator identification pay load of the first IKE AUTH request message.

[0101] S402: The gateway node 230 transmits to the wireless device 210, a first IKE AUTH response message indicating an Extensible Authentication Protocol, EAP, success. This procedure corresponds to S211 of Fig.2.

[0102] In some embodiments, the gateway node 230 performs EAP -based authentication towards an authentication node 250 without involving EAP-5G. That is, one or more EAP messages generated by the authentication node 250 and the wireless device 210 are exchangedin one or more IKE AUTH request messages and one or more IKE AUTH response messages between the wireless device 210 and the gateway node 220 without further encapsulation. This procedure corresponds to S208 of Fig.2.

[0103] In some embodiments, the gateway node 230 transmits to an access management node 240, a first N2 message comprising the NAS registration request. This procedure corresponds to S205 of Fig.2. In some embodiments, the gateway node 230 receives from the access management node 240, a second N2 message comprising an initial context setup request. This procedure corresponds to S210 of Fig.2. Upon the successful EAP -based authentication, the second N2 message further indicates an EAP-success and the first key.

[0104] In some embodiments, the first IKE AUTH response message comprising the EAP success is transmitted upon a successful EAP -based authentication. In some embodiments, the gateway node 230 receives a first key from an access management node 240. This procedure corresponds to S210 of Fig.2. In some embodiments, the first key is K_N3IWF. The gateway node 230 then receives from the wireless device 210, a second IKE_AUTH request message. This procedure corresponds to S213 of Fig.2. The second IKE AUTH request message may comprise a first payload, and the first pay load is generated by the wireless device 210 based on the first key.

[0105] In some embodiments, the first payload is verified by the gateway node 230 based on the first key to authenticate the wireless device 210. This procedure corresponds to S214 of Fig.2. The gateway node 230 transmits to the wireless device 210, a second IKE_AUTH response message indicating a second payload. The second payload is generated by the gateway node based on the first key. This procedure corresponds to S215 of Fig.2.

[0106] In some embodiments, the wireless device 210 verifies the second payload based on the first key so as to authenticate the gateway node 230. In response to a successful authentication of the gateway node 230, an Internet Protocol Security, IPSec, Security Association, SA, between the wireless device 210 and the gateway node 230 is established. This procedure corresponds to S217 of Fig.2.

[0107] In some embodiments, the gateway node 230 transmits to the access management node 240, a third N2 message indicating an initial context setup response. This procedure corresponds to S218 of Fig.2. In some embodiments, the initial context setup response is transmitted upon successful establishment of an Internet Protocol Security, IPsec, Security Association, SA, between the wireless device 210 and the gateway node 230.

[0108] In some embodiments, the gateway node 230 receives from the access management node 240, a NAS security mode command message. This procedure corresponds to S219 ofFig.2. In some embodiments, the gateway node 230 transmits to the access management node 240, a NAS security mode complete message. This procedure corresponds to S222 of Fig.2. In some embodiments, the receiving the NAS security mode command message and transmitting the NAS security mode complete message are performed after establishing an IPSec SA between the wireless device 210 and the gateway node 230.

[0109] In some embodiments, the gateway node 230 transmits to the wireless device 210, the NAS security mode command message, in an IPsec tunnel established based on the IPsec SA. This procedure corresponds to S220 of Fig.2. The gateway node 230 receives from the wireless device 210, the NAS security mode complete message, in the IPsec tunnel. This procedure corresponds to S221 of Fig.2. In some embodiments, the NAS security mode complete message comprises a complete initial NAS message, and wherein the complete initial NAS message comprises the NAS registration request.

[0110] In some embodiments, the gateway node 230 receives from the access management node 240, a NAS registration accept message. This procedure corresponds to S224 of Fig.2. The gateway node 230 then transmits to the wireless device 210, the NAS registration accept message. This procedure corresponds to S225 of Fig.2.

[0111] In some embodiments, the NAS security mode command message, the NAS security mode complete message, the NAS registration request message, or the NAS registration accept message is comprised in an N2 message between the gateway node 230 and the access management node 240.

[0112] Fig.5 illustrates a schematic diagram for an access management node for handling a non-3GPP access according to some embodiments.

[0113] S501 : The access management node 240 (e.g. AMF 240) receives from a gateway node, a first N2 message comprising a Non-Access Stratum, NAS, registration request. This procedure corresponds to S205 of Fig.2. The NAS registration request comprises a subscriber identity, one or more NAS security parameters associated with a wireless device 210.

[0114] In some embodiments, the first N2 message indicates that the gateway node that provided the NAS registration request is a non-3GPP gateway and / or indicates to the access management node that an EAP -based authentication shall be used.

[0115] In some embodiments, the access management node 240 then transmits to an authentication node 250, an authentication request comprising the subscriber identity. This procedure corresponds to S206 of Fig.2. In some embodiments, the authentication request comprises an indication to use the EAP -based authentication. The access management node 240 receives, from an authentication node 250, a message indicating the EAP success. Themessage comprises a second key and a subscriber permanent identity, SUPI. In some embodiments, the second key comprises K_SEAF or K_AMF. The access management node 240 obtains a first key based on the second key. This procedure corresponds to S209 of Fig.2.

[0116] S502: The access management node 240 transmits to the gateway node 230, a second N2 message comprising an initial context setup request. This procedure corresponds to S210 of Fig.2. The second N2 message further indicates an EAP-success and comprises the first key, wherein the first key is used for a mutual authentication of the gateway node 230 and the wireless device 210 before establishing an Internet Protocol Security, IPsec, Security Association, SA, between the gateway node 230 and the wireless device 210. In some embodiments, the first key comprises K_N3IWF. The EAP success is transmitted in second N2 message upon a successful EAP -based authentication.

[0117] S503: The access management node 240 receives from the gateway node 230, a third N2 message indicating an initial context setup response. This procedure corresponds to 5218 of Fig.2. The initial context setup response indicates successful establishment of the IPsec SA between the wireless device 210 and gateway node 230.

[0118] S504: The access management node 240 transmits to the gateway node 230, aNAS security mode command message upon indication of the successful establishment of the IPsec SA between the wireless device 210 and gateway node 230. This procedure corresponds to 5219 of Fig.2.

[0119] S505: The access management node 240 receives from the gateway node 230, a NAS security mode complete message in response to the NAS security mode command message. This procedure corresponds to S222 of Fig.2. In some embodiments, the NAS security mode complete message comprises a complete initial NAS message, and the complete initial NAS message comprises the NAS registration request. In some embodiments, the access management node 240 verifies, as part of verifying the NAS security mode complete message, that the complete initial NAS message matches the NAS registration request received in the first N2 message.

[0120] In some embodiments, the access management node 240 transmits to the gateway node 230, aNAS registration accept message. This procedure corresponds to S224 of Fig.2.

[0121] Fig. 6 schematically illustrates, in terms of a number of structural units, the components of a wireless device 600 according to an embodiment. Processing circuitry 610 is provided using any combination of one or more of a suitable central processing unit (CPU), multiprocessor, microcontroller, digital signal processor (DSP), etc., capable of executing software instructions stored in a computer program product 910a (as in Fig. 9), e.g. in the formof a storage medium 630. The processing circuitry 610 may further be provided as at least one application specific integrated circuit (ASIC), or field programmable gate array (FPGA). Particularly, the processing circuitry 610 is configured to cause the wireless device 600 to perform a set of operations, or steps, as disclosed above (e.g. the operations or steps according to Fig.2 and / or Fig.3). For example, the storage medium 630 may store the set of operations, and the processing circuitry 610 may be configured to retrieve the set of operations from the storage medium 630 to cause the wireless device 600 to perform the set of operations. The set of operations may be provided as a set of executable instructions. Thus, the processing circuitry 610 is thereby arranged to execute methods as herein disclosed. The storage medium 630 may also comprise persistent storage, which, for example, can be any single one or combination of magnetic memory, optical memory, solid state memory or even remotely mounted memory. The wireless device 600 may further comprise a communications (comm.) interface 620 for communications with other entities, functions, nodes, and devices. As such the communications interface 620 may comprise one or more transmitters and receivers, comprising analogue and digital components. The processing circuitry 610 controls the general operation of the wireless device 600 e.g. by sending data and control signals to the communications interface 620 and the storage medium 630, by receiving data and reports from the communications interface 620, and by retrieving data and instructions from the storage medium 630. Other components, as well as the related functionality, of the wireless device 600 are omitted in order not to obscure the concepts presented herein.

[0122] Fig. 7 schematically illustrates, in terms of a number of structural units, the components of a gateway node 700 according to an embodiment. Processing circuitry 710 is provided using any combination of one or more of a suitable central processing unit (CPU), multiprocessor, microcontroller, digital signal processor (DSP), etc., capable of executing software instructions stored in a computer program product 910b (as in Fig. 9), e.g. in the form of a storage medium 730. The processing circuitry 710 may further be provided as at least one application specific integrated circuit (ASIC), or field programmable gate array (FPGA). Particularly, the processing circuitry 710 is configured to cause the gateway node 700 to perform a set of operations, or steps, as disclosed above (e.g. operations or steps according to Fig.2 and / or Fig.4). For example, the storage medium 730 may store the set of operations, and the processing circuitry 710 may be configured to retrieve the set of operations from the storage medium 730 to cause the gateway node 700 to perform the set of operations. The set of operations may be provided as a set of executable instructions. Thus the processing circuitry 710 is thereby arranged to execute methods as herein disclosed. The storage medium 730 mayalso comprise persistent storage, which, for example, can be any single one or combination of magnetic memory, optical memory, solid state memory or even remotely mounted memory. The gateway node 700 may further comprise a communications interface 720 for communications with entities, functions, nodes, and devices. As such the communications interface 720 may comprise one or more transmitters and receivers, comprising analogue and digital components. The processing circuitry 710 controls the general operation of the gateway node 700 e.g. by sending data and control signals to the communications interface 720 and the storage medium 730, by receiving data and reports from the communications interface 720, and by retrieving data and instructions from the storage medium 730. Other components, as well as the related functionality, of the gateway node are omitted in order not to obscure the concepts presented herein.

[0123] The gateway node 700 may be provided as a standalone device or as a part of at least one further device. For example, the gateway node 700 may be provided in a node of the radio access network or in a node of the core network. Alternatively, functionality of the wireless device 600 may be distributed between at least two devices, or nodes. These at least two nodes, or devices, may either be part of the same network part (such as the radio access network or the core network) or may be spread between at least two such network parts. In general terms, instructions that are required to be performed in real time may be performed in a device, or node, operatively closer to the cell than instructions that are not required to be performed in real time. Thus, a first portion of the instructions performed by the gateway node 700 may be executed in a first device, and a second portion of the of the instructions performed by the gateway node 700 may be executed in a second device; the herein disclosed embodiments are not limited to any particular number of devices on which the instructions performed by the gateway node may be executed. Hence, the methods according to the herein disclosed embodiments are suitable to be performed by a gateway node 700 residing in a cloud computational environment. Therefore, although a single processing circuitry 710 is illustrated in Fig. 7 the processing circuitry 710 may be distributed among a plurality of devices, or nodes.

[0124] Fig. 8 schematically illustrates, in terms of a number of structural units, the components of an access management node 800 according to an embodiment. Processing circuitry 810 is provided using any combination of one or more of a suitable central processing unit (CPU), multiprocessor, microcontroller, digital signal processor (DSP), etc., capable of executing software instructions stored in a computer program product 910c (as in Fig. 9), e.g. in the form of a storage medium 830. The processing circuitry 810 may further be provided as at least one application specific integrated circuit (ASIC), or field programmable gate array(FPGA). Particularly, the processing circuitry 810 is configured to cause the access management node to perform a set of operations, or steps, as disclosed above (e.g. operations or steps according to Fig.2 and / or Fig.5). For example, the storage medium 830 may store the set of operations, and the processing circuitry 810 may be configured to retrieve the set of operations from the storage medium 830 to cause the access management node 800 to perform the set of operations. The set of operations may be provided as a set of executable instructions. Thus, the processing circuitry 810 is thereby arranged to execute methods as herein disclosed. The storage medium 830 may also comprise persistent storage, which, for example, can be any single one or combination of magnetic memory, optical memory, solid state memory or even remotely mounted memory. The access management node may further comprise a communications interface 820 for communications with entities, functions, nodes, and devices. As such the communications interface 820 may comprise one or more transmitters and receivers, comprising analogue and digital components. The processing circuitry 810 controls the general operation of the access management node 800 e.g. by sending data and control signals to the communications interface 820 and the storage medium 830, by receiving data and reports from the communications interface 820, and by retrieving data and instructions from the storage medium 830. Other components, as well as the related functionality, of the access management node are omitted in order not to obscure the concepts presented herein.

[0125] Fig. 9 shows one example of a computer program product 910a, 910b, 910c comprising computer readable means 930. On this computer readable means 930, a computer program 920a can be stored, which computer program 920a can cause the processing circuitry 910 and thereto operatively coupled entities and devices, such as the communications interface 620 and the storage medium 630, to execute methods according to embodiments described herein. The computer program 920a and / or computer program product 910a may thus provide means for performing any steps of the wireless device 600 as herein disclosed. On this computer readable means 930, a computer program 920b can be stored, which computer program 920b can cause the processing circuitry 710 and thereto operatively coupled entities and devices, such as the communications interface 720 and the storage medium 730, to execute methods according to embodiments described herein. The computer program 920b and / or computer program product 910b may thus provide means for performing any steps of the gateway node 700 as herein disclosed. On this computer readable means 930, a computer program 920c can be stored, which computer program 920c can cause the processing circuitry 810 and thereto operatively coupled entities and devices, such as the communications interface 820 and the storage medium 830, to execute methods according to embodiments describedherein. The computer program 920c and / or computer program product 910c may thus provide means for performing any steps of the access management node 800 as herein disclosed.

[0126] In the example of Fig. 9, the computer program product 910a, 910b, 910c is illustrated as an optical disc, such as a CD (compact disc) or a DVD (digital versatile disc) or a Blu-Ray disc. The computer program product 910a, 910b, 910c could also be embodied as a memory, such as a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), or an electrically erasable programmable readonly memory (EEPROM) and more particularly as a non-volatile storage medium of a device in an external memory such as a USB (Universal Serial Bus) memory or a Flash memory, such as a compact Flash memory. Thus, while the computer program 920a, 920b, 920c is here schematically shown as a track on the depicted optical disk, the computer program 920a, 920b, 920c can be stored in any way which is suitable for the computer program product 910a, 910b, 910c.

[0127] In certain embodiments, some or all of the functionality described herein may be provided by processing circuitry executing instructions stored on in memory, which in certain embodiments may be a computer program product in the form of a non-transitory computer-readable storage medium. In alternative embodiments, some or all of the functionality may be provided by the processing circuitry without executing instructions stored on a separate or discrete device-readable storage medium, such as in a hard-wired manner. In any of those particular embodiments, whether executing instructions stored on a non-transitory computer-readable storage medium or not, the processing circuitry can be configured to perform the described functionality. The benefits provided by such functionality are not limited to the processing circuitry alone or to other components of the computing device, but are enjoyed by the computing device as a whole, and / or by end users and a wireless network generally.

[0128] The inventive concept has mainly been described above with reference to a few embodiments. However, as is readily appreciated by a person skilled in the art, other embodiments than the ones disclosed above are equally possible within the scope of the inventive concept, as defined by the appended patent claims.

Claims

CLAIMS1. A method performed by a wireless device (210, 600) for handling a non-3GPP access, the method comprising:transmitting (S301) to a gateway node (230, 700), a first IKE_AUTH request message comprising a Non-Access Stratum, NAS, registration request, wherein the NAS registration request comprises a subscriber identity, one or more NAS security parameters associated with the wireless device, and wherein the first IKE AUTH request message is sent without AUTH payload, and indicates that an EAP -based authentication for Internet Key Exchange version 2, IKEv2, mutual authentication is to be performed; andreceiving (S302) from the gateway node, a first IKE_AUTH response message indicating an Extensible Authentication Protocol, EAP, success.

2. The method of claim 1, comprising:performing EAP -based authentication towards an authentication node (250) without involving EAP-5G, wherein one or more EAP messages generated by the authentication node and the wireless device are exchanged in one or more IKE_AUTH request messages and / or one or more IKE_AUTH response messages between the wireless device and the gateway node without further encapsulation.

3. The method of claim 1 or 2, wherein the NAS registration request is comprised in an initiator identification payload of the first IKE AUTH request message.

4. The method of any one of claims 1-3, wherein the first IKE AUTH response message comprising the EAP success is received upon a successful EAP-based authentication, the method further comprising:generating a first key based on the successful EAP-based authentication;transmitting to the gateway node, a second IKE AUTH request message comprising a first payload, wherein the first payload is generated based on the first key; andreceiving from the gateway node, a second IKE_AUTH response message comprising a second payload.

5. The method of claim 4, further comprising:verifying the second payload based on the first key so as to authenticate the gateway node; andin response to a successful authentication of the gateway node, establishing an Internet Protocol Security, IPSec, Security Association, SA, between the wireless device and the gateway node.

6. The method of claim 4 or 5, wherein the first key comprises K_N3IWF.

7. The method of any one of claims 1-6, comprising:receiving a NAS security mode command message, from an access management node (240, 800), via the gateway node;transmitting a NAS security mode complete message, to the access management node via the gateway node; andwherein the receiving the NAS security mode command message and the transmitting the NAS security mode complete message are performed after establishing the IPSec SA.

8. The method of claim 7, wherein the NAS security mode complete message comprises a complete initial NAS message, and wherein the complete initial NAS message comprises the NAS registration request.

9. The method of any one of claims 1-8, comprising:receiving a NAS registration accept message, from the access management node, via the gateway node.

10. The method of any one of claims 1-9, wherein the subscriber identity comprises Subscription Concealed Identifier, SUCI.

11. The method of any one of claims 1-10, wherein at least one of the following applies: the gateway node comprises aNon-3GPP Interworking Function, N3IWF;the access management node comprises an Access Management Function, AMF; and the authentication node comprises an Authentication Server Function, AUSF.

12. A method performed by a gateway node (230, 700) for handling a non-3GPP access, the method comprising:receiving (S401) from a wireless device (210, 600), a first IKE_AUTH request message comprising a Non-Access Stratum, NAS, registration request, wherein the NAS registration request comprises a subscriber identity, one or more NAS security parameters associated withthe wireless device, and wherein the first IKE AUTH request message is sent without AUTH payload, and indicates that an EAP -based authentication for Internet Key Exchange version 2, IKEv2, mutual authentication is to be performed; andtransmitting (S402) to the wireless device, a first IKE_AUTH response message indicating an Extensible Authentication Protocol, EAP, success.

13. The method of claim 12, comprising:performing EAP -based authentication towards an authentication node (250) without involving EAP-5G, wherein one or more EAP messages generated by the authentication node and the wireless device are exchanged in one or more IKE AUTH request messages and one or more IKE AUTH response messages between the wireless device and the gateway node without further encapsulation.

14. The method of claim 12 or 13, wherein the NAS registration request is comprised in an initiator identification pay load of the first IKE AUTH request message.

15. The method of any one of claims 12-14, wherein the first IKE AUTH response message indicating the EAP success is sent upon a successful EAP -based authentication, the method further comprising:receiving from an access management node (240, 800), a first key;receiving from the wireless device, a second IKE_AUTH request message indicating a first payload, wherein the first payload is verified by the gateway node based on the first key to authenticate the wireless device; andtransmitting to the wireless device, a second IKE_AUTH response message indicating a second pay load, wherein the second pay load is generated by the gateway node based on the first key.

16. The method of any one of claims 12-15, further comprising:transmitting to an access management node (240, 800), a first N2 message comprising the NAS registration request.

17. The method of claims 16, further comprising:receiving from the access management node, a second N2 message comprising an initial context setup request, wherein upon the successful EAP -based authentication, the second N2 message further indicates an EAP-success and the first key; andtransmiting to the access management node, a third N2 message indicating an initial context setup response, wherein the initial context setup response is transmited upon successful establishment of an Internet Protocol Security, IPsec, Security Association, SA, between the wireless device and the gateway node.

18. The method of any one of claims 15-17, wherein the first key comprises K_N3IWF.

19. The method of any one of claims 12-18, comprising:receiving from the access management node, a NAS security mode command message; transmiting to the access management node, a NAS security mode complete message; and wherein the receiving the NAS security mode command message and the transmiting the NAS security mode complete message are performed after establishing an IPSec SA between the wireless device and the gateway node.

20. The method of claim 19, further comprising:transmitting to the wireless device, the NAS security mode command message, in an IPsec tunnel established based on the IPsec SA; andreceiving from the wireless device, the NAS security mode complete message, in the IPsec tunnel.

21. The method of claim 19 or 20, wherein the NAS security mode complete message comprises a complete initial NAS message, and wherein the complete initial NAS message comprises the NAS registration request message.

22. The method of any one of claims 12-21, further comprising:receiving from the access management node, a NAS registration accept message; and transmiting to the wireless device, the NAS registration accept message.

23. The method of any one of claims 12-22, wherein at least one of the following applies: the gateway node comprises aNon-3GPP Interworking Function, N3IWF;the access management node comprises an Access Management Function, AMF; and the authentication node comprises an Authentication Server Function, AUSF.

24. A method performed by an access management node (240, 800) for handling a non-3GPPaccess, comprising:receiving (S501) from a gateway node (230, 700), a first N2 message comprising a Non-Access Stratum, NAS, registration request, wherein the NAS registration request comprises a subscriber identity, one or more NAS security parameters associated with a wireless device; transmitting (S502) to the gateway node, a second N2 message comprising an initial context setup request, wherein the second N2 message further indicates an EAP-success and comprises a first key, wherein the first key is used for a mutual authentication of the gateway node and a wireless device (210, 600) before establishing an Internet Protocol Security, IPsec, Security Association, SA;receiving (S503) from the gateway node, a third N2 message indicating an initial context setup response, wherein the initial context setup response indicates successful establishment of the IPsec SA between the wireless device and the gateway node; andtransmitting (S504) to the gateway node, a NAS security mode command message upon the successful establishment of the IPsec SA between the wireless device and gateway node; and receiving (S505) from the gateway node, a NAS security mode complete message in response to the NAS security mode command message.

25. The method of claim 24, wherein the first N2 message indicates that an EAP-based authentication shall be used, and wherein the second N2 message is transmitted upon a successful EAP-based authentication.

26. The method of claim 24 or 25, further comprising:transmitting to an authentication node (250), an authentication request comprising the subscriber identity;receiving from the authentication node, a message indicating the EAP success, wherein the message comprises a second key and a subscriber permanent identity; andobtaining a first key based on the second key.

27. The method of claim 26, wherein the authentication request comprises an indication to use the EAP-based authentication.

28. The method of any one of claims 24-27, wherein the first key comprises K_N3IWF, or the second key comprises K_SEAF or K_AMF.

29. The method of any one of claims 24-28, further comprisingtransmitting to the gateway node, a NAS registration accept message.

30. The method of any one of claims 24-29, wherein at least one of the following applies: the gateway node comprises aNon-3GPP Interworking Function, N3IWF;the access management node comprises an Access Management Function, AMF; and the authentication node comprises an Authentication Server Function, AUSF.

31. The method of any one of claims 24-30, wherein the NAS security mode complete message comprises a complete initial NAS message, and wherein the complete initial NAS message comprises the NAS registration request.

32. The method of claim 31, further comprising:verifying, as part of verifying the NAS security mode complete message, that the complete initial NAS message matches the NAS registration request received in the first N2 message.

33. A wireless device (210, 600) for handling a non-3GPP access, the wireless device comprising processing circuitry (610), the processing circuitry being configured to cause the wireless device to perform the following operations:transmitting (S301) to a gateway node (230, 700), a first IKE_AUTH request message comprising a Non-Access Stratum, NAS, registration request, wherein the NAS registration request comprises a subscriber identity, one or more NAS security parameters associated with the wireless device, and wherein the first IKE AUTH request message is sent without AUTH payload, and indicates that an EAP -based authentication for Internet Key Exchange version 2, IKEv2, mutual authentication is to be performed; andreceiving (S302) from the gateway node, a first IKE_AUTH response message indicating an Extensible Authentication Protocol, EAP, success.

34. The wireless device of claim 33, wherein the processing circuitry being configured to cause the wireless device to perform any of the operations according to claims 2-11.

35. A gateway node (230, 700) for handling a non-3GPP access, the gateway node comprising processing circuitry (710), the processing circuitry being configured to cause the gateway node to perform the following operations:receiving (S401) from a wireless device (210, 600), a first IKE_AUTH request message comprising a Non-Access Stratum, NAS, registration request, wherein the NAS registration request comprises a subscriber identity, one or more NAS security parameters associated with the wireless device, and wherein the first IKE AUTH request message is sent without AUTH payload, and indicates that an EAP -based authentication for Internet Key Exchange version 2, IKEv2, mutual authentication is to be performed; andtransmitting (S402) to the wireless device, a first IKE_AUTH response message indicating an Extensible Authentication Protocol, EAP, success.

36. The gateway node of claim 35, wherein the processing circuitry being configured to cause the gateway node to perform any of the operations according to claims 13-23.

37. An access management node (240, 800) for handling a non-3GPP access, the access management node comprising processing circuitry (810), the processing circuitry being configured to cause the access management node to perform following operations: receiving (S501) from a gateway node (230, 700), a first N2 message comprising a Non-Access Stratum, NAS, registration request, wherein the NAS registration request comprises a subscriber identity, one or more NAS security parameters associated with a wireless device; transmitting (S502) to the gateway node, a second N2 message comprising an initial context setup request, wherein the second N2 message further indicates an EAP-success and comprises a first key, wherein the first key is used for a mutual authentication of the gateway node and a wireless device (210, 600) before establishing an Internet Protocol Security, IPsec, Security Association, SA;receiving (S503) from the gateway node, a third N2 message indicating an initial context setup response, wherein the initial context setup response indicates successful establishment of the IPsec SA between the wireless device and the gateway node; andtransmitting (S504) to the gateway node, a NAS security mode command message upon the successful establishment of the IPsec SA between the wireless device and gateway node; and receiving (S505) from the gateway node, a NAS security mode complete message in response to the NAS security mode command message.

38. The access management node of claim 37, wherein the processing circuitry being configured to cause the access management node to perform any of the operations according to claims 24-32.

Images