Direct UE-UPF Access Authentication via Non-3GPP Access Points
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current 5G security specifications lack a procedure for authenticating a user equipment (UE) before establishing a direct connection to a User Plane Function (UPF) via a non-3GPP access network, compromising network security and privacy.
Innovation Solution
A method for authenticating a UE via an access point of a different network type, including sending a registration request message indicating support for non-integrated non-network access, deriving an encryption key, and establishing a direct communication connection using a UPF key, which is derived similarly to existing access network keys but distinguished by setting the Uplink NAS COUNT to 0 for UPF key generation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a direct connection is established between UE and UPF via non-3GPP access network, then network access flexibility and connectivity options are improved, but network security and authentication reliability deteriorate due to lack of authentication procedure
Solution Approach 1:
The patent applies preliminary action by establishing an authentication procedure before the UE connects to the UPF. The AMF performs authentication with the UE using 5G-AKA or EAP-AKA' methods, and securely delivers the UPF address to the UE only after successful authentication. This pre-authentication step ensures security is established before direct connectivity is permitted.
Solution Approach 2:
The AMF acts as an intermediary between the UE and UPF in the authentication process. It receives the registration request from the UE, performs authentication, derives the UPF key, and selectively provides the UPF address to the authenticated UE. This intermediary role ensures that security validation occurs before direct UE-UPF connectivity is established.
2Reliability
If authentication procedure is implemented for UE-UPF direct connection, then network security and authentication reliability are improved, but system complexity and procedural overhead increase
Solution Approach 1:
The patent leverages existing universal authentication mechanisms (5G-AKA and EAP-AKA') that are already implemented in 5G networks. By reusing these established procedures rather than creating new authentication protocols, the system maintains security without adding significant complexity. The same AMF and security infrastructure handle both traditional and direct UPF access scenarios.
Solution Approach 2:
The patent modifies existing key derivation parameters by setting the Uplink NAS COUNT to 0 specifically for UPF key generation. This parameter change allows the system to derive a dedicated UPF key from existing authentication materials without requiring entirely new authentication protocols, thus maintaining security while minimizing procedural complexity.
3Reliability
If UPF key is derived with Uplink NAS COUNT set to 0, then key differentiation and security are improved for direct access, but compatibility with existing authentication procedures may be compromised
Solution Approach 1:
The patent applies local quality by making a specific parameter modification (Uplink NAS COUNT = 0) only in the context of UPF key derivation, while leaving all other authentication procedures unchanged. This localized parameter change ensures differentiated security for direct UPF access without affecting the compatibility and operation of existing 5G authentication mechanisms for other access types.
Data Source
AI summary
Various aspects of the present disclosure relate to establishing a direct communication connection to a network via an access point of a network of a different type. The establishment of the direct communication connection can include the performance of an authentication procedure with the network, via the access point of the network of the different type, wherein the authentication procedure includes sending a registration request message to the network via the access point of the network of the different type, which indicates support for non-integrated non-network access. A request response from the network can then be received, which includes an address of a network entity with which a user equipment (UE) can establish a direct communication connection within the network. The UE can then communicate with the network entity via the established direct communication connection using the received address.