NSWO Authentication Using Serving Network Name Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The need for enhanced security authentication in the non-seamless WLAN offload (NSWO) networking mode, where terminal devices access a 3GPP network through a non-3GPP network, is not adequately addressed, posing security risks.
Innovation Solution
An authentication method that includes generating a serving network name using configuration information, determining appropriate EAP authentication methods based on network identifiers, and deriving keys using the serving network name to verify network access, thereby improving access security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the terminal device accesses the 3GPP network through the non-3GPP network in NSWO mode, then the network access flexibility is improved, but the security authentication is insufficient
Solution Approach 1:
The patent segments the authentication process into distinct phases: initial network access through non-3GPP, followed by a separate authentication phase using EAP methods. This allows the terminal to first connect flexibly via non-3GPP networks, then undergo rigorous security verification, resolving the contradiction between access flexibility and security authentication.
Solution Approach 2:
The patent implements preliminary security measures by establishing authentication mechanisms before full network access is granted. The terminal device performs authentication procedures in advance during the NSWO process, ensuring security is built-in from the beginning rather than added later, thus maintaining both flexibility and security.
2Measurement precision
If the serving network name includes the identifier of the serving network, then the network verification capability is improved, but the information processing complexity increases
Solution Approach 1:
The patent introduces the serving network name as an intermediary element that encapsulates the serving network identifier. This intermediary allows the terminal device to verify network identity without directly handling complex identifier formats, simplifying the verification process while maintaining precision. The serving network name acts as a readable, manageable representation of the network identity.
Data Source
AI summary
An authentication method and an apparatus are provided. The method includes: obtaining an identifier of a serving network and an identifier of a terminal device, and generating a serving network name, where the serving network is a network accessed by a terminal device in a non-3GPP access mode, the serving network provides a service of an NSWO, and the serving network name includes information about the NSWO and the identifier of the serving network; and sending a first request message to an authentication service functional entity, where the first request message is used to request to authenticate the terminal device, and the first request message includes the serving network name and the identifier of the terminal device.