Network Slice Authentication With UE Criteria Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing 5G network slicing technologies lack robust mechanisms for ensuring secure and controlled network slice authentication, particularly when user equipment is roaming or when slice ownership is shared between different service providers, leading to potential confidentiality breaches and unauthorized access.
Innovation Solution
Implementing a method where user equipment (UE) verifies specific criteria, such as S-NSSAI values, Slice Service Types, or geographical restrictions, within the EAP-AKA' authentication process to ensure authorized network slice access, using AT_KDF_INPUT attributes to validate slice authenticity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If network slicing is implemented to provide differentiated services, then service quality and deployment speed are improved, but security and authentication control become more complex
Solution Approach 1:
The authentication system is segmented into multiple independent components: AMF for access management, NSSAAF for slice-specific authentication, and AAA-S for centralized authorization. This segmentation allows each component to handle specific authentication tasks independently, reducing overall system complexity while maintaining robust security control across multiple network slices.
Solution Approach 2:
The NSSAAF acts as an intermediary between the AMF and AAA-S, specifically handling slice-specific authentication operations. This intermediary component simplifies the authentication flow by centralizing slice verification logic, allowing the AMF to focus on access management while the AAA-S maintains centralized authorization control.
2Reliability
If slice authentication is performed for each S-NSSAI, then security is improved, but authentication time and processing overhead increase
Solution Approach 1:
The system performs preliminary slice authentication during the initial registration process, establishing authentication results and security contexts in advance. This preliminary action allows subsequent slice access to benefit from pre-established authentication states, reducing the time required for repeated authentication operations while maintaining security verification for each S-NSSAI.
3Adaptability or versatility
If roaming users are supported across multiple networks, then service accessibility is improved, but slice identification and authentication accuracy deteriorate
Solution Approach 1:
The system implements feedback mechanisms where the AMF provides information about the allocated slice to the AAA-S, and the AAA-S returns authentication results and authorization decisions. This feedback loop ensures accurate slice identification and authentication even for roaming users by continuously verifying slice allocation information and updating authentication states based on real-time network conditions and user context.
Data Source
Figure 1
Figure 2
AI summary
The invention concerns a method for network slice-specific authentication and authorization in a telecommunication network, the method comprising: - sending from a AAA-S 24 to a UE 20 in the AT_KDF_INPUT attribute of an EAP message at least one criterion instead of Network Name that the UE 20 has to verify; - verifying at the UE that the criterion matches with a corresponding criterion stored at the UE 20, and - if the criterion matches, authorizing the UE 20 to proceed to an authentication per EAP-AKA' with the AAA-S 24 and, if the criterion does not match, abort the authentication.