Network Slice Authentication Across PLMNs Without Key Confusion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication systems face inefficiencies in slice authentication when a terminal device accesses a network slice through different networks or network functions, leading to potential confusion and incorrect key updates.
Innovation Solution
A method and apparatus that include network functions initiating slice authentication by carrying identification information of the network, slice, and terminal device, enabling the authentication server to distinguish between slice authentications initiated by different PLMNs, thereby preventing confusion and ensuring accurate key management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If slice authentication is initiated without carrying network identification information, then the authentication process is simpler, but the authentication server cannot distinguish between slice authentications initiated by different PLMNs, leading to confusion and incorrect key updates
Solution Approach 1:
The authentication request is segmented to include distinct identification elements: PLMN identification information and slice authentication information are separated and transmitted independently to the authentication server, allowing the server to distinguish between different PLMNs while maintaining a structured authentication process
Solution Approach 2:
The network function acts as an intermediary that carries PLMN identification information through the authentication request, enabling the authentication server to differentiate between different PLMNs without directly interacting with the terminal device, thus resolving the confusion issue
2Reliability
If slice authentication is performed separately for each access manner, then authentication accuracy is maintained, but authentication efficiency decreases due to repeated authentication
Solution Approach 1:
The authentication mechanism is designed with universal applicability across different access manners. By including PLMN identification information in the authentication request, the system enables the authentication server to recognize and reuse authentication results across multiple access manners within the same PLMN, eliminating redundant authentication while maintaining security
3Device complexity
If the authentication server updates keys without distinguishing PLMNs, then key management is simpler, but security is compromised due to incorrect key updates
Solution Approach 1:
Key management is segmented by PLMN identification. The authentication server uses the carried PLMN identification information to separately manage and update keys for different PLMNs, ensuring that key updates are applied to the correct PLMN context and preventing security compromises from incorrect key updates
Data Source
AI summary
This application provides a slice authentication method and an apparatus. One example method includes: initiating, by a first network function (NF), slice authentication between a terminal device and an authentication server for a slice; sending, by the first NF, identification information of a first network, identification information of the slice, and identification information of the terminal device to the authentication server, wherein the first NF is an NF in the first network; and receiving, by the first NF, a slice authentication result for the slice, the identification information of the slice, and the identification information of the terminal device from the authentication server.