Authentication device, network device, communication system, authentication method, and non-transitory computer readable medium

Patent metadata

Field	Value
Publication number	US-11902776-B2
Application number	US-202218078174-A
Country	US
Kind code	B2
Filing date	Dec 9, 2022
Priority date	Mar 17, 2017
Publication date	Feb 13, 2024
Grant date	Feb 13, 2024

Abstract

Provided is an authentication device capable of generating a master key suited to a UE in a 5GS. The authentication device (10) includes a communication unit (11) configured to, in registration processing of user equipment (UE), acquire UE key derivation function (KDF) capabilities indicating a pseudo random function supported by the UE, a selection unit (12) configured to select a pseudo random function used for generation of a master key related to the UE by use of the UE KDF capabilities, and a key generation unit (13) configured to generate a master key related to the UE by use of the selected pseudo random function.

First claim

The invention claimed is:

1. A communication system comprising:
a non-3GPP access network (AN) connecting to user equipment (UE);
a Non-3GPP Inter Working Function (N3IWF) node connecting to the non-3GPP AN;
an Access and Mobility Function (AMF) node connecting to the N3IWF node;
an Authentication Server Function (AUSF) node connecting to the AMF node via a Security Anchor Function (SEAF); and
an Unified Data Management (UDM) node connecting to the AUSF node,
wherein the N3IWF node receives a Registration Request message including a Key Set Identifier (KSI) and UE Security Capabilities from the UE via the non-3GPP AN,
wherein the N3IWF node forwards the Registration Request message to the AMF node,
wherein the AMF node sends, to the AUSF node, information for performing an authentication procedure for the UE, wherein the information is based on the received Registration Request message,
wherein the AUSF node receives an Authentication Vector (AV) including an expected response (XRES) from the UDM node,
wherein the AUSF node receives a response (RES) from the UE via the SEAF, and
wherein the AUSF node authenticates the UE by comparing the RES with the XRES.

2. The communication system according to claim 1 ,
wherein if authentication is successful, the AUSF node sends a Success message to the UE via the SEAF.

3. The communication system of claim 1 , wherein the RES from the UE is based on the AV.

4. A method for authenticating user equipment (UE) comprising:
sending, from the UE to a Non-3GPP Inter Working Function (N3IWF) node via a non-3GPP access network (AN), a Registration Request message including Key Set Identifier (KSI) and UE Security Capabilities;
forwarding, from the N3IWF node to an Access and Mobility Function (AMF) node, the Registration Request message;
sending, from the AMF node to an Authentication Server Function (AUSF) node, information for performing an authentication procedure for the UE, wherein the information is based on the received Registration Request message;
receiving, by the AUSF node from a Unified Data Management (UDM) node, an Authentication Vector (AV) including an expected response (XRES);
receiving, by the AUSF node, a response (RES) from the UE via a Security Anchor Function (SEAF); and
authenticating, by the AUSF node, the UE by comparing the RES with the XRES.

5. The method according to claim 4 further comprising:
if authentication is successful, sending, from the AUSF node to the UE via the SEAF, a Success message.

6. The method of claim 4 , wherein the RES from the UE is based on the AV.

7. A method for an Authentication Server Function (AUSF) node comprising:
receiving information for performing an authentication procedure for user equipment (UE) from an Access and Mobility Function (AMF) node that received a Registration Request message sent from the UE via a non-3GPP access network (AN) and a Non-3GPP Inter Working Function (N3IWF) node;
receiving an Authentication Vector (AV) including an expected response (XRES) from an Unified Data Management (UDM) node;
receiving a response (RES) from the UE via a Security Anchor Function (SEAF); and
authenticating the UE by comparing the RES with the XRES,
wherein the Registration Request message includes a Key Set Identifier (KSI) and UE Security Capabilities.

8. The method according to claim 7 further comprising:
if authentication is successful, sending a Success message to the UE via the SEAF.

9. An Authentication Server Function (AUSF) node comprising:
a receiver configured to
receive information for performing an authentication procedure for user equipment (UE) from an Access and Mobility Function (AMF) node that received a Registration Request message sent from the UE via a non-3GPP access network (AN) and a Non-3GPP Inter Working Function (N3IWF) node,
receive an Authentication Vector (AV) including an expected response (XRES) from an Unified Data Management (UDM) node, and
receive a response (RES) from the UE via a Security Anchor Function (SEAF); and
a processor configured to authenticate the UE by comparing the RES with the XRES,
wherein the Registration Request message includes a Key Set Identifier (KSI) and UE Security Capabilities.

10. The AUSF node according to claim 9 further comprising:
a transmitter configured to send a Success message to the UE via the SEAF if authentication is successful.

Assignees

• Nec Corp

Inventors

• BASKARAN Sheeba Backia Mary
• Prasad Anand Raghawa
• Arumugam Sivabalan
• LAKSHMINARAYANAN Sivakamy
• Ito Hironori
• Kunz Andreas

Classifications

• H04W12/0431 Primary

  Key distribution or pre-distribution; Key agreement · CPC title

• G06F7/582

  Pseudo-random number generators · CPC title

• H04L9/32

  including means for verifying the identity or authority of a user of the system {or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials} · CPC title

• H04L12/04

  Switchboards · CPC title

• H04L12/06

  Answer-back mechanisms or circuits · CPC title