Edge Client Authentication for Roaming Edge Service Authorization

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing systems fail to authenticate and authorize edge enabler clients (EECs) effectively in roaming scenarios, particularly when visiting edge computation services in visited public land mobile networks (VPLMNs, necessitating improved security measures.

Innovation Solution

A method involving edge enabler clients (EECs) transmitting authentication and authorization information to edge enabler servers (EESs) to request service authorization, utilizing keys and identifiers for secure communication and identity verification, including steps for mutual identity authentication and transport layer security (TLS) establishment.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If authentication and authorization information is transmitted between EEC and EES, then security of edge services is improved, but device complexity increases

Engineering Contradiction:

Improvesecurity of edge servicesVSAvoidcomplexity of authentication system

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The authentication and authorization system is divided into separate functional components: EEC (edge enabler client) for client-side authentication, EES (edge enabler server) for server-side authorization, Zn-Proxy for proxy authentication, and BSF for bootstrap authentication. This segmentation allows each component to handle specific security tasks independently, improving overall system security while maintaining manageable complexity through modular architecture.

Inventive Principle:

Principle #1Segmentation

2Measurement precision

If multiple authentication steps are implemented for roaming users, then authorization accuracy is improved, but loss of time increases

Engineering Contradiction:

Improveauthorization accuracyVSAvoidauthentication time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The system performs preliminary authentication actions during the bootstrap phase before the actual service access is needed. The BSF (bootstrap server function) establishes authentication context and generates authentication vectors in advance. When the roaming user needs to access edge services, the pre-established authentication context can be reused, reducing the time required for subsequent authentication steps while maintaining high authorization accuracy.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system implements feedback mechanisms where the EES receives authentication and authorization information from the EEC, processes it against stored authentication vectors, and returns authorization decisions. This feedback loop allows the system to verify authentication accuracy in real-time and adjust the authentication process dynamically, balancing time consumption with authorization precision.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS20250373440A1Method, communication device and storage medium for authenticating and authorizing

Publication Date: 2025.12.04 BEIJING XIAOMI MOBILE SOFTWARE CO LTD

AI summary

Provided in the embodiments of the present disclosure is a method for authenticating and authorizing. The method is performed by an edge enabler client (EEC). The method includes: sending authentication and authorization information to an edge enabler server (EES), wherein the authentication and authorization information is used for requesting the EES to authorize an EES service. Compared with the method of using an unauthorized process, the present disclosure can improve the security of an edge service.