AIoT Authentication via EAP-AKA' for Direct Network Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
AIoT devices, lacking support for NAS protocols, face challenges in directly authenticating with a network and establishing secure connections, leading to latency and inefficiencies when relying on gateway nodes.
Innovation Solution
AIoT devices perform an authentication procedure using EAP-AKA' authentication method with AIoT network functions, deriving an access network security key to establish a direct secure connection without gateway node intervention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If AIoT devices rely on gateway nodes for authentication and connection establishment, then devices without NAS protocol support can access the network, but latency increases and connection efficiency deteriorates
Solution Approach 1:
The patent extracts the authentication function from the gateway node and implements it directly in the AIoT device through the EAP-AKA' protocol. The device performs authentication procedures directly with the network function, removing the gateway node's mandatory intermediary role in the authentication process, thereby reducing latency while maintaining network access capability for devices without NAS protocol support
Solution Approach 2:
The patent introduces the EAP-AKA' authentication protocol as a new intermediary mechanism that enables direct authentication between AIoT devices and network functions. This protocol acts as a mediator that bridges the capability gap, allowing devices without NAS protocol support to authenticate directly without requiring gateway node intervention, thus reducing authentication latency
2Productivity
If AIoT devices use EAP-AKA' authentication method directly with network functions, then authentication efficiency improves and latency reduces, but device complexity increases
Solution Approach 1:
The patent segments the authentication process into distinct EAP-AKA' protocol steps (identity request, authentication challenge, key derivation) that can be implemented modularly in the AIoT device. This segmentation allows the device to implement only the necessary authentication functions without requiring full NAS protocol support, improving authentication efficiency while managing device complexity through modular implementation
Solution Approach 2:
The patent changes the authentication parameters from NAS protocol-based to EAP-AKA' protocol-based, allowing AIoT devices to use different authentication mechanisms suited to their capabilities. This parameter change enables direct authentication with network functions, improving efficiency while the device complexity is managed by selecting appropriate protocol parameters and implementation depth
3Speed
If AIoT devices establish direct secure connections with network functions, then connection speed improves and gateway dependency is reduced, but security key derivation complexity increases
Solution Approach 1:
The patent implements preliminary key derivation during the authentication phase, where the device derives the access network security key (KAIOTF) along with other security parameters before establishing the secure connection. This preliminary action allows the device to have all necessary security materials ready, enabling faster connection establishment without requiring complex real-time key derivation, thus improving speed while managing complexity through advance preparation
Data Source
AI summary
Various aspects of the present disclosure relate to authentication and connection establishment for reduced capability devices. An apparatus, such as an ambient internet of things (AIoT) device, receives a broadcast message from a reader function of a network. The AIoT device performs an authentication procedure with a server function of the network using the reader function and a network function of the network. The authentication procedure utilizes an extensible authentication protocol (EAP) authentication and key agreement prime (EAP-AKA′) authentication method. Based on the authentication procedure, the AIoT device derives an access network security key and uses the access network security key to establish a secure connection with the reader function or the network function. An application function (AF) may subscribe to registration of new AIoT devices. The AF may receive one or more parameters associated with the AIoT device after the AIoT device successfully authenticates and connects to the network.