5G Non-3GPP Authentication Using DIDs for Slice-Specific Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods for non-SIM IoT devices accessing a 5G Core Network face challenges in securely managing encryption keys and certificates, leading to potential unauthorized access and unmanageable certificate and key management for diverse authentication protocols.
Innovation Solution
A method for pre-authenticating non-SIM UE devices to a specialized network slice using decentralized identities (DIDs) and a data registry, coupled with network functions like AAA-S and NSSAAF, to perform slice-specific authentication and authorization, avoiding the need for managing various encryption keys and certificates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication methods with encryption keys and certificates are used for non-SIM IoT devices, then authentication capability is provided, but security management becomes complex and unauthorized access risks increase
Solution Approach 1:
The patent extracts the authentication credentials from traditional encryption keys and certificates, replacing them with decentralized identifiers (DIDs) that are stored in a data registry. This removes the complex key management burden while maintaining authentication capability, directly resolving the contradiction between security and management complexity.
Solution Approach 2:
The patent changes the fundamental parameter of authentication credentials from cryptographic keys and certificates to decentralized identifiers. This parameter change simplifies the authentication mechanism while improving security management, as DIDs can be verified without managing private keys or certificate chains.
2Adaptability or versatility
If diverse authentication protocols are supported for different non-SIM devices, then device compatibility is improved, but authentication protocol management becomes unmanageable
Solution Approach 1:
The patent implements a universal authentication mechanism using decentralized identifiers that can serve multiple authentication protocols and device types. The data registry stores DIDs that can be used across different authentication scenarios, providing multi-functionality without requiring separate management for each protocol, thus resolving the contradiction between versatility and ease of operation.
3Adaptability or versatility
If non-SIM devices authenticate to 5G Core Network, then network access capability is provided, but unauthorized access risks increase due to security management challenges
Solution Approach 1:
The patent introduces an intermediary layer - the data registry - that mediates between non-SIM devices and the 5G Core Network authentication system. This intermediary stores and verifies decentralized identifiers, providing a secure bridge that enables network access while mitigating unauthorized access risks through simplified credential verification.
Data Source
AI summary
A core network server for defining authentication credentials and authenticating a wireless communication device according to WIFI communication protocols includes a central processing unit (CPU) and a non-transitory memory comprising executable instructions that when executed by the CPU, causes the core network server to receive an encrypted authentication request from a wireless communication device; send the encrypted authentication request to an authentication server based on one or more attributes in the encrypted authentication request; receive an indicator of a specialized network slice associated with the wireless communication device based on sending the encrypted authentication request; communicate authentication messages to the wireless communication device according to one or more network functions of the specialized network slice; and authenticate the wireless communication device according to the specialized network slice responsive to communicating the authentication messages.