Service-based 5G core authentication endpoints

Patent metadata

Field	Value
Publication number	US-11284254-B2
Application number	US-201917047533-A
Country	US
Kind code	B2
Filing date	Apr 12, 2019
Priority date	Apr 14, 2018
Publication date	Mar 22, 2022
Grant date	Mar 22, 2022

Abstract

Systems and methods that are particularly well-suited for service-based core network endpoint authentication are disclosed. In some embodiments, a method of operation of a network node implementing a second network function in a core network of a cellular communications system comprises receiving, at a main service of the second network function, a request from a first network function for a desired service via Hypertext Transfer Protocol/Representational State Transfer (HTTP/REST) signaling. The request comprises information that identifies one or more delegate endpoints of the first network function that expose one or more delegate services, respectively, of the first network function for providing the desired service using one or more different communication styles. The method further comprises initiating the desired service using a selected delegate endpoint from the one or more delegate endpoints identified by the information comprised in the request.

First claim

What is claimed is:

1. A method of operation of a network node implementing a second network function in a core network of a cellular communications system, comprising:
receiving, at a main service of the second network function, a request from a first network function for a desired service via Hypertext Transfer Protocol/Representational State Transfer, HTTP/REST, signaling, the request comprising information that identifies one or more delegate endpoints of the first network function that expose one or more delegate services, respectively, of the first network function for providing the desired service using one or more different communication styles; and
initiating the desired service using a selected delegate endpoint from the one or more delegate endpoints identified by the information comprised in the request.

2. The method of claim 1 wherein the communication style used by the selected delegate endpoint is a communication style that is different than HTTP/REST such that initiating the desired service using the selected delegate endpoint switches the communication style for signaling related to the desired service from HTTP/REST to the communication style used by the selected delegate endpoint.

3. The method of claim 1 wherein the communication style used by the selected delegate endpoint is a communication style that supports binary message exchange over a binary channel.

4. The method of claim 3 wherein the communication style used by the selected delegate endpoint is HTTP/2, Quick User Datagram Protocol Internet Connection, QUIC, stream, Server Push, Websocket, gRPC Remote Procedure Call, gRPC, based messaging, or a native communication style over sockets.

5. The method of claim 1 wherein the one or more delegate endpoints for providing the desired service using the one or more different communication styles comprise:
a first delegate endpoint that uses a first communication style for the desired service; and
a second delegate endpoint that uses a second communication style for the desired service.

6. The method of claim 5 wherein at least one of the first communication style and the second communication style is a communication style that supports binary message exchange over a binary channel.

7. The method of claim 1 wherein:
the desired service is authentication of a particular User Equipment, UE;
the first network function is an Access Management Function, AMF, in a serving network of the UE; and
the second network function is an Authentication Service Function, AUSF, in front of a User Data Manager, UDM, in a home network of the UE.

8. The method of claim 7 wherein:
the one or more delegate endpoints comprise a delegate endpoint for an Extensible Authentication Protocol, EAP, authentication relay service for relaying EAP related messages between the UE and the AUSF using a communication style that supports binary message exchange over a binary channel; and
the selected delegate endpoint is the delegate endpoint for the EAP authentication relay service.

9. The method of claim 8 wherein the communication style that supports binary message exchange over a binary channel is HTTP/2, Quick User Datagram Protocol Internet Connection, QUIC, stream, Server Push, Websocket, gRPC Remote Procedure Call, gRPC, based messaging, or a native communication style over sockets.

10. The method of claim 8 wherein initiating the desired service using the selected delegate endpoint comprises:
sending, to a delegate endpoint of the AUSF, a request to launch the authentication of the UE using the selected delegate endpoint of the AMF; and
sending, to a main endpoint of the AMF that exposes the main service of the AMF via HTTP/REST signaling, a message that indicates launch of EAP authentication of the UE.

11. The method of claim 10 further comprising:
receiving, from the delegate endpoint of the AUSF, a response that indicates that the authentication of the UE was successful;
sending, to the main endpoint of the AMF via HTTP/REST signaling, a message that indicates that the authentication of the UE was successful; and
receiving, from the main endpoint of the AMF via HTTP/REST signaling, an acknowledgement.

12. The method of claim 8 wherein initiating the desired service using the selected delegate endpoint comprises sending, to a main endpoint of the AMF that exposes the main service of the AMF via HTTP/REST signaling, a message that indicates launch of EAP authentication of the UE.

13. The method of claim 12 further comprising:
sending, to the selected delegate endpoint of the AMF via the communication style that supports binary message exchange over a binary channel, an EAP Request/Challenge to be relayed to the UE;
receiving, from the selected delegate endpoint of the AMF via the communication style that supports binary message exchange over a binary channel, an EAP response relayed from the UE;
sending, to the selected delegate endpoint of the AMF via the communication style that supports binary message exchange over a binary channel, an EAP Success message to be relayed to the UE;
sending, to the main endpoint of the AMF via HTTP/REST signaling, a message that indicates that the authentication of the UE was successful; and
receiving, from the main endpoint of the AMF via HTTP/REST signaling, an acknowledgement.

14. The method of claim 7 wherein:
the one or more delegate endpoints of the AMF comprise:
a first delegate endpoint for an EAP authentication relay service for relaying EAP related messages between the UE and the AUSF using a first communication style that supports binary message exchange over a binary channel; and
a second delegate endpoint for a Fifth Generation, 5G, Authentication and Key Agreement, AKA, authentication endpoint service for exchanging 5G AKA related messages with the AUSF or another endpoint associated with the AUSF using a second communication style; and

the method further comprises:
determining whether an EAP authentication scheme or a 5G AKA authentication scheme is to be used to authenticate the UE;
selecting the first delegate endpoint of the AMF if the EAP authentication scheme is determined to be used for authenticating the UE; and
selecting the second delegate endpoint of the AMF if the 5G AKA authentication scheme is determined to be used for authenticating the UE.

15. The method of claim 14 wherein the EAP authentication scheme is determined to be used for authenticating the UE, and initiating the desired service using the selected delegate endpoint of the AMF comprises:
sending a message to a delegate endpoint of the AUSF to request launch of the authentication of the UE using the selected delegate endpoint of the AMF; and
sending, to a main endpoint of the AMF that exposes the main service of the AMF, a message to launch the authentication of the UE using the selected delegate endpoint of the AMF.

16. The method of claim 15 further comprising:
receiving, from the delegate endpoint of the AUSF, a response that indicates that the authentication of the UE was successful;
sending, to the main endpoint of the AMF via HTTP/REST signaling, a message that indicates that the authentication of the UE was successful; and
receiving, from the main endpoint of the AMF via HTTP/REST signaling, an acknowledgement.

17. The method of claim 14 wherein the EAP authentication scheme is determined to be used for authenticating the UE, and initiating the desired service using the selected delegate endpoint of the AMF comprises sending, to a main endpoint of the AMF that exposes the main service of the AMF v

Assignees

• Ericsson Telefon Ab L M

Inventors

• Rune Göran
• Arkko Jari
• De-Gregorio-Rodriguez Jesus-Angel
• Eriksson Göran
• Westerlund Magnus

Classifications

• H04L63/0884

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title

• H04W12/06 Primary

  Authentication · CPC title