AKMA Identifier Routing for Secure Wireless App Sessions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing wireless communication networks face challenges in establishing secure communications between user equipment and application function entities due to insufficient identification of the proper authentication server function instance, leading to incomplete secure communication setups.
Innovation Solution
The implementation of an AKMA anchor function (AAnF) that generates and manages AKMA identifiers (AKMAID) using mobile country code (MCC), mobile network code (MNC), routing indicator, and random number (RAND) to establish secure communications, ensuring proper authentication and key management for applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication methods are used in wireless networks, then device compatibility is maintained, but security is insufficient for application sessions
Solution Approach 1:
The authentication system is segmented into two distinct phases: primary authentication (for network access) and application session authentication (for secure application communications). This segmentation allows each phase to use appropriate authentication mechanisms without burdening the entire system, improving security for applications while maintaining simplicity for basic network access.
Solution Approach 2:
An Application Function entity is introduced as an intermediary between the user equipment and the data network. This intermediary manages application session authentication and key derivation, enabling enhanced security for application communications without requiring complex authentication logic in the user equipment itself.
2Productivity
If primary authentication is repeated for each application session, then security is maintained, but efficiency decreases
Solution Approach 1:
The system performs preliminary primary authentication to establish a secure context before application sessions begin. Authentication credentials and cryptographic keys are derived in advance during this primary authentication phase, so that subsequent application sessions can be established efficiently without repeating the full authentication process, while still maintaining security through the pre-established credentials.
Solution Approach 2:
The system changes authentication parameters by deriving application-specific cryptographic keys from the primary authentication credentials. Instead of using the same authentication parameters for each application session, the system generates unique keys for each application context, maintaining security while enabling efficient session establishment through key derivation rather than re-authentication.
3Ease of operation
If simple identification methods are used, then ease of operation is improved, but the ability to identify proper authentication server instances deteriorates
Solution Approach 1:
The system uses identifier copies and derivations to maintain simplicity while improving accuracy. The Application Function entity receives identifiers from user equipment and derives or validates them against stored authentication context, enabling simple operation at the user interface while achieving precise server instance identification through cryptographic verification of identifier validity.
Data Source
AI summary
Methods, apparatus, and systems to establish a secure communication in a wireless network are described. In one example aspect, a wireless communication method includes generating, by a first function entity, a first identifier configured to be used to establish a secure communication for a first device, using at least a mobile country code, a mobile network code, and a random number, and transmitting the first identifier to the first device.