Secure Chip Card Slice Authentication for User-Specific 5G Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods for network slices, particularly in 5G, fail to differentiate between users accessing company networks, allowing unauthorized access and lacking the ability to influence user authentication beyond network registration.
Innovation Solution
A secure chip card with a slice authentication application generates an application user identifier based on slice identification, interacts with a slice authentication server to verify user eligibility, and manages access to network slices independently of cellular network authentication, using encryption for secure data transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the cellular network handles authentication alone, then the authentication process is simple and centralized, but it cannot differentiate between users accessing company networks and cannot influence user authentication
Solution Approach 1:
The authentication system is segmented into two independent parts: cellular network authentication (for device access) and slice authentication server authentication (for user access to company networks). This allows user differentiation without complicating the overall system, as each part can operate independently with its own authentication logic.
Solution Approach 2:
A slice authentication server is introduced as an intermediary component between the user equipment and the cellular network. This mediator handles user-specific authentication for company networks, enabling user differentiation while maintaining the simplicity of the existing cellular network authentication infrastructure.
2Reliability
If network slices are introduced for company networks, then service differentiation is enabled, but existing authentication methods allow unauthorized access and lack user-specific verification
Solution Approach 1:
The slice authentication server performs preliminary user verification before allowing access to company network slices. The server checks user credentials and authorization status in advance, ensuring that only authorized users can access the slice. This preliminary action enhances security without requiring complex authentication operations at the point of access.
Solution Approach 2:
User authentication functionality is extracted from the cellular network authentication process and placed in a separate slice authentication server. This extraction allows specialized user verification for company networks without affecting the general cellular network access authentication, thereby enhancing security while maintaining operational simplicity.
3Adaptability or versatility
If a slice authentication server is introduced for user verification, then user-specific access control is achieved, but the authentication process becomes more complex
Solution Approach 1:
The authentication process is segmented into distinct phases: device authentication to the cellular network (handled by the network) and user authentication for company slices (handled by the slice authentication server). This segmentation provides user authentication flexibility while keeping each phase relatively simple and independent.
Solution Approach 2:
The slice authentication server is designed with multi-functionality, handling various authentication scenarios for different company networks and service types. This universal approach provides flexible user-specific access control without requiring separate complex authentication processes for each scenario, as the server can adapt to different authentication requirements.
Data Source
Figure 1
Figure 2
AI summary
The present invention relates to a method to operate a secure chip card for connecting to a user equipment operating in a cellular network comprising a plurality of network slices, wherein for at least one network slice a slice authentication server is operational, the secure chip card comprising a secured memory with at least one slice authentication application, the method comprising the steps of: - retrieving a slice authentication configuration message comprising a slice identification from the user equipment, - generating an application user identifier considering the slice identification, - sending a slice attachment request comprising the application user identifier to the slice authentication server, - receiving a user verification request from the slice authentication server, - sending a user verification result to the slice authentication server, - receiving a slice authentication success message.