Serving Network Name Authentication for Secure NSWO Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing 3GPP network's non-seamless WLAN offload (NSWO) networking mode lacks effective security authentication mechanisms, particularly when a terminal device accesses the network through a non-3GPP network.
Innovation Solution
An authentication method that involves generating a serving network name including the identifier of the serving network, determining appropriate EAP authentication methods based on network identifiers, and using the serving network name for key derivation to enhance security, ensuring the terminal device does not access unauthorized non-3GPP networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the terminal device accesses the network through non-3GPP network in NSWO mode, then network access flexibility is improved, but security authentication capability deteriorates
Solution Approach 1:
The patent applies preliminary action by performing security authentication before allowing network access. The AUSF performs 3GPP security authentication on the terminal device prior to granting access through the non-3GPP network, ensuring that security verification is completed in advance rather than during data transmission
Solution Approach 2:
The patent introduces an intermediary mechanism by using the NSWOF as a bridge between the terminal device and the 3GPP authentication system. The NSWOF receives authentication requests from the non-3GPP network, forwards them to the AUSF for 3GPP authentication, and relays the authentication results back, thereby enabling security verification through an intermediate entity
2Ease of operation
If conventional authentication methods are used in NSWO mode, then authentication process simplicity is maintained, but access security deteriorates
Solution Approach 1:
The patent applies parameter changes by modifying the authentication parameters used in NSWO mode. Instead of using traditional non-3GPP authentication parameters, the system uses 3GPP authentication parameters (such as 5G-GUTI, 5G-SUCI, or decorated NAI formats) to perform authentication, thereby changing the security parameters while maintaining the authentication process flow
3Device complexity
If the serving network name does not include network identifier, then authentication message simplicity is improved, but network verification capability deteriorates
Solution Approach 1:
The patent applies preliminary action by embedding the network identifier (PLMN ID or SNPN ID) in advance within the serving network name parameter before authentication. This allows the network verification to be performed during the authentication process itself, rather than requiring separate verification steps afterward
Solution Approach 2:
The patent merges multiple functions into the serving network name parameter by combining both the network identification function and the verification function into a single parameter. The serving network name not only identifies the network but also serves as a verification element that the terminal device can check against the actual network it is accessing
Data Source
Figure 1
Figure 2A~2B
Figure 3A~3B
AI summary
An authentication method and an apparatus are provided. The method includes: obtaining an identifier of a serving network and an identifier of a terminal device, and generating a serving network name, where the serving network is a network accessed by a terminal device in a non-3GPP access mode, the serving network provides a service of an NSWO, and the serving network name includes information about the NSWO and the identifier of the serving network; and sending a first request message to an authentication service functional entity, where the first request message is used to request to authenticate the terminal device, and the first request message includes the serving network name and the identifier of the terminal device. The foregoing design allows the serving network name to include the identifier of the serving network, enabling verification of the network accessed by the terminal device in the non-3GPP access mode, and optimizing an authentication process of the terminal device.