Network Slice Authentication Across Multi-PLMN AMF Selection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing network slice authentication and authorization mechanism does not support scenarios where User Equipment (UE) accesses different Public Land Mobile Networks (PLMNs) through 3GPP and non-3GPP access, leading to challenges in determining the appropriate Access and Mobility Management Function (AMF) for authentication and authorization.
Innovation Solution
A method and apparatus for controlling network slice authentication involve obtaining identification information about third network elements, such as Allowed NSSAI and IDs, and transmitting authentication and authorization notifications to determine the appropriate AMF for UE authentication, ensuring successful execution in scenarios with multiple service management function entities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the conventional authentication mechanism is used, then the authentication procedure can be performed in single PLMN scenarios, but it cannot determine the correct AMF when UE accesses multiple PLMNs through different access technologies
Solution Approach 1:
The patent applies preliminary action by having the UDM store identification information about multiple AMFs (including AMF1 and AMF2) in advance before authentication is needed. When authentication is triggered, the AUSF retrieves this pre-stored identification information to determine which AMF should handle the authentication, avoiding the need to search or guess the correct AMF during the authentication process itself.
Solution Approach 2:
The patent introduces the UDM as an intermediary that stores and provides identification information about multiple AMFs. The UDM acts as a mediator between the AUSF and the multiple AMFs, enabling the AUSF to determine the correct target AMF without directly managing multiple AMF connections or complex routing logic.
2Reliability
If multiple AMFs are involved in multi-PLMN access, then comprehensive service coverage is achieved, but the AUSF cannot determine which AMF to initiate authentication with
Solution Approach 1:
The UDM performs preliminary action by storing the identification information (such as AMF IDs and associated S-NSSAI mappings) of multiple AMFs in advance. This pre-stored information enables the AUSF to quickly and accurately determine the correct target AMF without facing identification difficulties during the authentication process.
Solution Approach 2:
The system implements feedback through the UDM providing identification information back to the AUSF based on the S-NSSAI received during authentication. This feedback mechanism allows the AUSF to determine the correct AMF by receiving relevant identification information from the UDM, solving the AMF identification difficulty.
3Reliability
If authentication notifications are sent to multiple AMFs, then all possible AMFs are covered, but unnecessary authentication attempts increase system overhead
Solution Approach 1:
By having the UDM pre-store and provide identification information about the correct AMF(s) associated with the S-NSSAI, the system avoids sending authentication notifications to multiple AMFs unnecessarily. The AUSF uses this pre-provided identification information to target the specific correct AMF, ensuring authentication completeness while minimizing system resource consumption.
Solution Approach 2:
The UDM acts as an intermediary that filters and directs authentication requests to the correct AMF based on pre-stored identification information. This intermediary function ensures that authentication notifications are sent only to the appropriate AMF(s), maintaining reliability while reducing unnecessary system overhead and resource consumption.
Data Source
AI summary
The present disclosure provides a method, a device and an apparatus for controlling network slice authentication, and a storage medium. The method includes: obtaining identification information about a third network element from a second network element; and transmitting an authentication and authorization notification to the third network element in accordance with the identification information.