EAP-TLS Authentication with Concealed Identities in 5G Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing technologies face challenges in efficiently supporting EAP-TLS authentication in 5G networks, particularly in verifying server certificates and managing different cryptographic algorithms and parameters across various devices and wireless networks, which can lead to authentication failures and security vulnerabilities.
Innovation Solution
The system and method involve a device, a mobile network operator, a network, and a device provider working together to support EAP-TLS authentication using a subscription concealed identifier. The device records necessary identifiers and certificates, and the network uses these to decrypt the subscription concealed identifier and verify the device's credentials without requiring internet access or manual intervention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If EAP-TLS authentication is implemented in 5G networks with traditional certificate verification methods, then authentication security is improved, but device complexity and authentication failure rate increase due to diverse cryptographic algorithms and parameters across different devices and networks
Solution Approach 1:
The patent segments the cryptographic parameter management by introducing separate configuration mechanisms for different network types (5G vs non-5G). The device maintains distinct parameter sets for different network domains, avoiding the need to manage all possible cryptographic variations simultaneously. This segmentation reduces complexity while maintaining security for each specific network type.
Solution Approach 2:
The patent introduces an intermediary mechanism in the form of a proxy or gateway that handles certificate verification for devices. This intermediary abstracts the complex cryptographic parameter management from the end device, allowing the device to authenticate without directly managing diverse cryptographic algorithms. The intermediary translates between different cryptographic standards, reducing device complexity while maintaining authentication security.
2Reliability
If traditional certificate verification methods are used in EAP-TLS authentication, then authentication thoroughness is improved, but authentication speed and user experience deteriorate due to manual intervention requirements and internet access dependencies
Solution Approach 1:
The patent implements preliminary action by pre-configuring cryptographic parameters and certificate authorities during device provisioning or before network connection is needed. The device downloads and stores necessary CA certificates and cryptographic parameters in advance, so that when EAP-TLS authentication is required, the verification can proceed immediately without needing to access the internet or wait for manual configuration. This eliminates authentication delays while maintaining thorough verification.
3Adaptability or versatility
If devices store multiple certificate authorities and cryptographic parameters for different networks, then authentication compatibility is improved, but device memory and processing requirements increase
Solution Approach 1:
The patent applies local quality by configuring cryptographic parameters specifically for specific network types rather than universally. The device stores different cryptographic configurations localized to different network domains (5G networks versus non-5G networks). This allows the device to have optimized parameter sets for each network type, maintaining broad compatibility without storing all possible cryptographic variations, thus reducing overall storage requirements while preserving adaptability.
Data Source
AI summary
A device, mobile operator, network, and a device provider can exchange messages for EAP-TLS authentication. The network can include an authentication server function (AUSF). A device and a device provider can record both a device certificate and a device provider certificate. The network can receive an encrypted identity for the device and forward the identity to the device provider. The device provider can send the device certificate and the device provider certificate to the network. The network can (i) receive a “client hello”, (ii) select a network public key and private key, and (iii) send a certificate signing request to the device provider with the network public key, and (iv) receive a network certificate verified by the device provider certificate. The network can receive the device certificate from the device in a TLS handshake and mutually authenticate with the device using the received network certificate and the device certificate.