5G NSWO Authentication Using EAP-AKA' Without AAA Server
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The challenge of implementing authentication for Non-Seamless WLAN Offload (NSWO) service in a 5G network is exacerbated by the absence of a 3GPP AAA server and the use of different authentication algorithms compared to 4G networks, leading to potential authentication failures.
Innovation Solution
A method utilizing the EAP-AKA' authentication algorithm is employed, with the SUCI containing service indication information to facilitate authentication, and key management strategies to avoid impacting existing key architectures, reducing air interface messages and ensuring compatibility across networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the 5G network uses different authentication algorithms compared to 4G networks, then the network can support advanced security features, but authentication failures occur due to algorithm incompatibility
Solution Approach 1:
The patent changes the authentication algorithm parameter from 5G AKA to EAP-AKA' for NSWO services, allowing the network to adapt to different service requirements while maintaining security. This parameter change resolves the contradiction by selecting the appropriate algorithm based on service type rather than using a fixed algorithm for all services.
Solution Approach 2:
The authentication algorithm is made dynamic rather than static. The network can switch between 5G AKA and EAP-AKA' algorithms based on the service requirements, making the system adaptable to different scenarios while ensuring authentication success for NSWO services that require EAP-AKA'.
2Device complexity
If the 5G network does not include a 3GPP AAA server, then the network architecture is simplified, but authentication for NSWO service becomes complex
Solution Approach 1:
The patent introduces an intermediary authentication procedure between the AN device and NSWO network element that uses EAP-AKA' algorithm. This intermediary mechanism simplifies the overall architecture by avoiding the need for 3GPP AAA server while providing a clear, manageable authentication flow for NSWO services.
Solution Approach 2:
The authentication function is segmented and distributed. Instead of requiring a centralized 3GPP AAA server, the authentication is performed locally at the AN device using the EAP-AKA' algorithm, dividing the authentication task into manageable segments that can be executed without complex centralized coordination.
3Reliability
If EAP-AKA' authentication algorithm is used for NSWO service, then authentication reliability is improved, but key management complexity increases
Solution Approach 1:
The patent implements key management that discards old keys after use and recovers new keys through the EAP-AKA' authentication process. This approach maintains security by ensuring keys are updated and managed systematically, reducing complexity through automated key lifecycle management rather than manual key handling.
Solution Approach 2:
The authentication and key management system performs self-service through automated key derivation and management. The EAP-AKA' algorithm automatically generates and manages keys without requiring complex manual intervention, reducing key management complexity while maintaining high security standards.
4Adaptability or versatility
If traditional authentication messages are used in 5G network, then compatibility with existing systems is maintained, but message overhead increases
Solution Approach 1:
The patent changes the message parameter set for EAP-AKA' authentication to optimize for 5G network conditions. By adjusting message parameters specifically for NSWO services, the system reduces unnecessary overhead while maintaining compatibility with existing 5G infrastructure, achieving a balance between compatibility and efficiency.
Data Source
Figure 1~2
Figure 3
Figure 4A
AI summary
Embodiments of this application are applicable to the field of communication technologies, and provide a method for authentication for an NSWO service, a device, and a storage medium, applicable to a 5G network. The method for authentication for an NSWO service includes: After determining to perform the NSWO service, the UE sends a SUCI to an AN device. The AN device sends a second request message to an NSWO network element. After determining to perform authentication for the NSWO service, the NSWO network element sends a first authentication request message to an AUSF. After determining to perform authentication for the NSWO service, the AUSF sends a second authentication request message to a UDM. The UDM determines to use an EAP-AKA' authentication method. Then, the UDM, the AUSF, the NSWO network element, the AN device, and the UE sequentially complete an authentication procedure based on EAP-AKA' authentication. In this way, authentication for the NSWO service is implemented in a 5G network.