NPN Access Credential Delivery via PLMN-Mediated Encryption

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing technologies face challenges in enabling secure access of user equipment (UE) to non-public networks (NPNs) without relying on public land mobile networks (PLMNs, particularly in stand-alone NPNs (SNPNs), which require mechanisms for terminals to obtain and securely use independent security credentials.

Innovation Solution

A method where UE obtains encrypted security credentials for NPNs through a public network (PLMN) and decrypts them using default credentials, allowing secure access to SNPNs by modifying communication procedures within the PLMN to transmit and authenticate these credentials.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If UE directly accesses SNPN without PLMN, then access independence is improved, but security credential distribution becomes complex

Engineering Contradiction:

Improveaccess independenceVSAvoidsecurity credential distribution

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent introduces PLMN as an intermediary to distribute security credentials for SNPN access. The AMF in PLMN receives encryption information from UDN and forwards it to UE, simplifying the credential distribution process while maintaining access independence to SNPNs

Inventive Principle:

Principle #24Intermediary (Mediator)

2Ease of manufacture

If security credentials are transmitted through PLMN, then credential distribution is simplified, but security risk increases

Engineering Contradiction:

Improvecredential distributionVSAvoidsecurity risk

Core Design Contradiction:

Ease of manufactureVSObject-affected harmful factors

Solution Approach 1:

The patent applies preliminary encryption to security credentials before transmission through PLMN. The encryption information is prepared in advance by UDN and securely transmitted through PLMN's AMF to UE, which then decrypts it using default credentials, ensuring security throughout the distribution process

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The AMF acts as a secure intermediary that receives encrypted credentials from UDN and forwards them to UE without exposing the plaintext credentials, thereby simplifying distribution while maintaining security through controlled intermediate handling

Inventive Principle:

Principle #24Intermediary (Mediator)

3Reliability

If encryption information is used for credential protection, then security is improved, but decryption complexity increases

Engineering Contradiction:

Improvecredential securityVSAvoiddecryption process

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent enables UE to autonomously decrypt the received encryption information using its pre-configured default credentials. This self-service decryption mechanism maintains high security through encryption while keeping the decryption process simple and automated without requiring complex external intervention

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS12549372B2Network access method, user equipment, network entity, and storage medium

Publication Date: 2026.02.10 ALIBABA GROUP HOLDING LTD

AI summary

The present application discloses a method, device, and system for providing security credentials to access a non-public network. The method includes receiving, by a terminal, an identifier of a first network and corresponding encryption information. The first network includes a non-public network. The encryption information includes encrypted security credentials for the first network. The terminal receives the identifier of the first network and the corresponding encryption information from a second network that is different from the first network. The method further includes decrypting, by the terminal, the encryption information. The encryption information is decrypted based at least in part on default credentials corresponding to the identifier of the first network. The security credentials of the first network are obtained based at least in part on the decrypted encryption information.