User Authentication Session Management in Mobile Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication methods in mobile communications primarily focus on subscription information of SIM/USIM cards, neglecting user authentication, which can lead to unauthorized use of terminal devices, compromising security.
Innovation Solution
Implementing a user authentication method where a session management function entity establishes a dedicated session for user authentication before allowing service data transmission, involving a session management function entity, user plane function entity, and AAA server to verify user identity through a separate authentication session.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authentication is performed only on SIM/USIM card subscription information, then the authentication process is simple and quick, but security is compromised allowing unauthorized users to use terminal devices
Solution Approach 1:
The authentication process is segmented into two independent parts: device authentication (using SIM/USIM card subscription information) and user authentication (using username/password). This segmentation allows each authentication layer to be performed separately, maintaining security while managing complexity through modular design. The network can authenticate the device first, then independently authenticate the user, resolving the contradiction between security requirements and process simplicity.
Solution Approach 2:
Device authentication using SIM/USIM card subscription information is performed as a preliminary action before user authentication. This preliminary device authentication establishes a secure baseline, allowing subsequent user authentication to occur within an already-secured context. This approach maintains high security while managing complexity by breaking the authentication process into staged steps rather than requiring all checks simultaneously.
2Reliability
If user authentication is integrated into existing third-party applications, then user authentication can be performed, but the applications are independent and do not provide system-wide security management
Solution Approach 1:
The user authentication mechanism is designed as a universal system that operates independently of specific applications. The authentication protocol can be used across different services and applications within the communication system, providing system-wide security management. This universal authentication framework allows the same authentication mechanism to serve multiple functions and applications, resolving the contradiction between providing comprehensive security management and maintaining application independence.
3Reliability
If a dedicated user authentication session is established before service data transmission, then unauthorized users are prevented from communication, but additional session management overhead is introduced
Solution Approach 1:
Communication sessions are segmented into authentication sessions and service data sessions. The authentication session is a dedicated, temporary session established solely for user verification purposes. Once authentication is complete, this session is terminated and a separate service data session is established for actual communication. This segmentation ensures communication security by isolating authentication from data transmission, while managing complexity through clear session boundaries and purposes.
Solution Approach 2:
User authentication is performed as a preliminary action through a dedicated authentication session before any service data transmission occurs. This preliminary authentication session verifies user credentials and establishes security context in advance. By completing authentication beforehand, the system ensures that only authorized users can establish service data sessions, maintaining communication security while managing complexity through a structured two-phase approach.
Data Source
AI summary
This application provides a user authentication method and an apparatus. Before establishing, for a terminal device, a session used to transmit service data, an SMF entity receives a session establishment request message; determines, based on the session establishment request message, to perform user authentication on a user using the terminal device; and sends a session establishment message to a UPF entity, where the session establishment message is used to establish a first session for the terminal device, and a session attribute of the first session is: a session used to transmit only a user authentication message. Subsequently, the terminal device and an AAA server transmit the user authentication message through the first session, to complete user authentication.