UPF-Triggered Secondary Authentication During Active PDU Sessions

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing communication networks face limitations in triggering secondary authentication beyond new PDU session establishment or re-authentication processes, restricting the scenarios where secondary authentication can be initiated.

Innovation Solution

The UPF entity monitors user plane traffic for requests to access application services and initiates secondary authentication processes, sending notifications to the SMF entity to trigger authentication as needed, allowing secondary authentication to occur on a per-need basis.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If secondary authentication is triggered only during new PDU session establishment or re-authentication processes, then the authentication process remains simple and manageable, but the scenarios where secondary authentication can be initiated are restricted

Engineering Contradiction:

Improveauthentication trigger scenariosVSAvoidauthentication process complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent makes the authentication trigger dynamic by enabling the UPF entity to monitor user plane traffic and dynamically initiate secondary authentication based on real-time service requests, rather than following fixed trigger conditions. This allows the system to adapt authentication timing to actual network usage patterns and service requirements.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The patent introduces the UPF entity as an intermediary between the data network and the SMF entity. The UPF monitors traffic and sends notifications to the SMF to initiate authentication, acting as a mediator that enables new authentication trigger scenarios without directly complicating the core authentication process between SMF and UE.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If the UPF entity monitors user plane traffic to trigger secondary authentication, then authentication can be initiated in more scenarios including service requests during existing PDU sessions, but the monitoring and notification process increases system complexity

Engineering Contradiction:

Improveauthentication initiation flexibilityVSAvoidmonitoring and notification mechanism

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The UPF entity performs self-service by autonomously monitoring user plane traffic and autonomously deciding when to trigger secondary authentication based on observed service requests. This self-service capability enables flexible authentication initiation without requiring constant external control, reducing the operational complexity despite the added monitoring functionality.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS20260082223A1Initiation of secondary authentication for a subscriber entity

Publication Date: 2026.03.19 TELEFONAKTIEBOLAGET LM ERICSSON (PUBL)

AI summary

There is provided techniques for initiating a secondary authentication process for a subscriber entity. A method is performed by a UPF entity. The method includes monitoring user plane traffic of an already established PDU session for the subscriber entity. The user plane traffic is monitored for a request from the subscriber entity to access an application service of a data network. Observing the request triggers the UPF entity to initiate the secondary authentication process for the subscriber entity for allowing the subscriber entity to access the application service. The method includes sending a notification to an SMF entity to initiate the secondary authentication process for the subscriber entity upon having observed the trigger.