MEC Key Hierarchy for Secure Roaming Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods for mobile edge computing networks are inadequate in protecting communication paths and do not effectively handle local MEC services during roaming, particularly in visited networks, and lack secure communication protocols between edge network entities.
Innovation Solution
A key-derivation hierarchy based on the AMF key KAMF is established, deriving subsequent keys for edge network entities like ECS and EAS, ensuring mutual authentication and integrity protection of messages through IPsec tunnels, using UE identifiers for secure communication setup.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If preconfigured certificates are used for authentication, then authentication can be performed, but the system becomes vulnerable to man-in-the-middle attacks and requires complex certificate management
Solution Approach 1:
The patent extracts the authentication security function from complex certificate-based authentication and implements it through a simplified key-derivation hierarchy. The core authentication mechanism is separated from the cumbersome certificate management, retaining security while reducing complexity.
Solution Approach 2:
The patent changes the authentication parameter from certificates to derived keys. By transforming the authentication mechanism from certificate-based to key-based with hierarchical derivation, the system maintains security properties while eliminating certificate management complexity.
2Reliability
If traditional authentication methods are used, then authentication is performed, but communication paths lack effective protection against interception
Solution Approach 1:
The patent implements a nested key-derivation hierarchy where keys are derived in layers from the AMF key through intermediate keys to application-specific keys. Each layer nests within the previous, providing progressive security protection for different communication paths while maintaining a unified authentication structure.
Solution Approach 2:
The patent segments the authentication mechanism into distinct key derivation stages corresponding to different network functions (AMF, EES, EAS). Each segment handles specific authentication requirements, providing targeted protection for different communication paths without requiring a single complex authentication system.
3Reliability
If key-based authentication is implemented for all edge network entities, then security is improved, but the key management complexity increases
Solution Approach 1:
The patent performs preliminary key derivation at the AMF level before communication with edge network entities. The AMF key is derived first and serves as the foundation for all subsequent key derivations, preparing the authentication infrastructure in advance to simplify real-time authentication operations.
Solution Approach 2:
The patent creates a universal AMF key that serves multiple functions: it authenticates the user equipment to the core network, serves as the root for deriving all edge network keys, and enables authentication across multiple edge network entities (EES, EAS) through hierarchical derivation, reducing the need for separate key management for each entity.
Data Source
AI summary
Apparatuses, methods, and systems are disclosed for key-based authentication for a mobile edge computing network. One method (800) includes deriving (805), at a user equipment, a first network key after authentication with a network function of a wireless core network, deriving (810) a second network key based on the first network key, the second network key for a first network function of a mobile edge computing network, sending (815) a registration request message to the first network function of the mobile edge computing network, the registration request message integrity protected with the second network key, receiving (820) a registration response message from the first network function, and, in response to verifying the integrity of the registration response message using the second network key, establishing (825) a secure communication with the first network function of the mobile edge computing network based on the second network key.