5G Slice Access Control Using Localized AMF and EIR
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current 5G networks lack efficient mechanisms to control device access to network slices, particularly for low-latency use cases, as existing systems rely on centralized EIRs that create bottlenecks and do not support fine-grained per-slice access control policies, leading to potential unauthorized access and increased latency.
Innovation Solution
Implement a localized AMF network function with a co-located EIR database that caches PEI/IMEI, SUPI/IMSI mappings, denylists, and per-slice access control policies, enabling local checks and reducing reliance on centralized databases for immediate authorization and policy enforcement.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If centralized EIR databases are used for access control, then network security is maintained through centralized management, but latency increases and access efficiency deteriorates
Solution Approach 1:
The patent segments the centralized EIR database functionality by deploying local EIR database instances at edge locations and AMF network functions. This segmentation allows access control checks to be performed locally rather than requiring constant communication with a centralized database, thereby reducing latency while maintaining security through distributed enforcement of access control policies.
Solution Approach 2:
The patent implements preliminary action by pre-caching PEI/IMEI and SUPI/IMSI mappings in local EIR databases before they are needed for access control decisions. This pre-caching ensures that when access requests occur, the necessary data is already available locally, eliminating the need for real-time queries to centralized databases and thus reducing access latency.
2Device complexity
If centralized EIR databases are used for access control, then centralized management is simplified, but access efficiency and throughput decrease due to bottlenecks
Solution Approach 1:
The patent divides the monolithic centralized EIR database into multiple distributed local EIR database instances deployed at edge locations and AMF network functions. This segmentation distributes the access control workload across multiple nodes, eliminating the single-point bottleneck and improving overall system throughput and access efficiency while maintaining manageable complexity through standardized interfaces.
Solution Approach 2:
The patent introduces local EIR database instances as intermediaries between UEs and the core network. These intermediaries handle access control checks locally, reducing the burden on centralized databases and improving access efficiency. The intermediaries maintain synchronization with centralized authorities through standardized interfaces, balancing distributed efficiency with centralized coordination.
3Reliability
If fine-grained per-slice access control is implemented, then unauthorized access is prevented, but system complexity increases
Solution Approach 1:
The patent applies local quality by implementing slice-specific access control policies at local EIR database instances and AMF network functions closest to the relevant network slices. This allows fine-grained control to be enforced locally without requiring complex centralized policy management for each slice, reducing overall system complexity while maintaining security through localized policy enforcement.
Solution Approach 2:
The patent creates a universal local EIR database architecture that can handle multiple functions: PEI/IMEI verification, SUPI/IMSI mapping, denylist checks, and per-slice access control. This multi-functional design consolidates what could be separate complex systems into a single versatile component, reducing overall system complexity while enabling fine-grained access control across different network slices.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
5G introduces the concept of network slices. Although the 5G standard contemplates some form of slice access control, it is premised on subscriber identity-based checks. Because subscriber identities are associated with/maintained via subscriber identity module (SIM) cards, and because SIM cards can be swapped from one device (user equipment) to another, slice access control based on subscriber identities can fail to prevent unauthorized device access. Systems and methods are provided for enhanced slice access control vis-à-vis an enhanced access and mobility management (AMF), and equipment identity register (EIR) functions. In some embodiments, a localized EIR function can reduce latency/messaging overhead.