IPSec Mobility Authentication Using MOBIKE in 5G Non-3GPP Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The process of re-authentication in both trusted and untrusted non-3GPP access environments within a 5G network architecture presents challenges, particularly in maintaining seamless mobility and session continuity while ensuring security, especially when a device moves between different access points.
Innovation Solution
The implementation of the Mobility and Multihoming Protocol (MOBIKE) is used to optimize Internet Protocol Security (IPSec) session re-establishment by exchanging capability data between user equipment and network gateway functions, enabling or disabling MOBIKE operations based on compatibility, thereby reducing the need for full re-authentication and maintaining secure connections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If full re-authentication is performed when UE moves between access points, then security is ensured, but latency increases and user experience deteriorates
Solution Approach 1:
The patent segments the authentication process by introducing MOBIKE as a separate, optimized pathway for mobility handling. Instead of performing full re-authentication for every mobility event, the system uses MOBIKE to handle IP address changes and mobility-specific parameters separately, allowing the core authentication to be maintained while reducing the overhead of mobility transitions.
Solution Approach 2:
The patent implements preliminary action by establishing MOBIKE capability exchange during the initial IKEv2 association setup. The UE and network equipment exchange MOBIKE support indicators beforehand, so that when mobility events occur, the optimized MOBIKE procedures can be immediately invoked without delaying the authentication process.
2Productivity
If MOBIKE operations are enabled for all devices, then IPSec session re-establishment is optimized, but compatibility issues arise with devices that do not support MOBIKE
Solution Approach 1:
The patent applies local quality by making MOBIKE support optional and device-specific. Each UE and network equipment independently indicates its MOBIKE capability through exchange indicators during IKEv2 setup. The system then applies MOBIKE optimization only to those devices that support it, while maintaining standard procedures for devices that do not, ensuring both optimized performance and broad compatibility.
Solution Approach 2:
The patent implements dynamics by making the MOBIKE operational mode flexible and adaptive. Based on the exchanged capability indicators, the system dynamically determines whether to enable MOBIKE operations for each UE-network equipment pair. This allows the system to adapt its behavior to match the capabilities of the connected devices, optimizing performance where possible while maintaining compatibility elsewhere.
3Reliability
If capability exchange is performed during IKEv2 association setup, then MOBIKE support is established, but additional signaling overhead is introduced
Solution Approach 1:
The patent merges the MOBIKE capability exchange with the existing IKEv2 association setup process. By integrating the MOBIKE support indicator exchange into the already-necessary IKEv2 signaling flow, the system establishes MOBIKE support without requiring separate, additional signaling transactions. This combining approach ensures reliable capability establishment while minimizing incremental overhead.
Data Source
AI summary
The disclosed method and system optimize IPSec connectivity and security association establishment in trusted and/or untrusted non-3GPP access scenarios, such as non-3GPP access with a Trusted Non-3GPP Gateway Function (TNGF) and/or Non-3GPP Interworking Function (N3IWF) in a 5G network architecture. The method involves initiating an Internet Key Exchange (IKE) protocol initiation communication from the User Equipment (UE) to the TNGF or N3IWF, which includes a MOBIKE_SUPPORT indicator to signal the UE's MOBIKE capability. The TNGF or N3IWF, in response to the MOBIKE_SUPPORT indicator, enables the use of MOBIKE to optimize an Internet Protocol Security (IPSec) session re-establishment when the UE moves to a different Trusted Non-3GPP Access Point (TNAP) connected to the same TNGF. The system includes the UE and TNGF configured to perform the method. The method and system minimize disruptions and latency during IPSec session re-establishment.