Systems and methods of supporting device triggered re-authentication of slice-specific secondary authentication and authorization

Patent metadata

Field	Value
Publication number	US-12219356-B2
Application number	US-202318485215-A
Country	US
Kind code	B2
Filing date	Oct 11, 2023
Priority date	Feb 15, 2019
Publication date	Feb 4, 2025
Grant date	Feb 4, 2025

Abstract

Various aspects of the present disclosure include methods, network servers or components and user equipment devices configured to authorize network slices that are associated with services provided by external providers. Various aspects enable access and use of network slices by user equipment devices connected to a network (e.g., 5G or New Radio network) via network components associated with a service provider by generating an allowed network slice selection assistance information (Allowed NSSAI) and an Unauthorized NSSAI, and sending the Allowed NSSAI and Unauthorized NSSAI to a user equipment device.

First claim

What is claimed is:

1. A method for network slice authentication, comprising:
generating, by one or more processors of an access and mobility management function (AMF), a network slice selection assistance information element (NSSAI IE) that:
identifies one or more network slices for which a slice-specific secondary authentication (SSSA) procedure has failed; and
includes a list of single network slice selection assistance information (S-NSSAI) elements that identify network slices for which authentication has not been authorized; and

transmitting the NSSAI IE from the AMF to a user equipment (UE).

2. The method of claim 1 , further comprising:
updating, by the AMF, a network slice authentication status based on a result of the SSSA procedure; and
initiating a UE configuration update procedure to communicate the updated network slice authentication status.

3. The method of claim 2 , wherein the updating of the network slice authentication status based on the result of the SSSA procedure comprises:
adding S-NSSAIs to an allowed NSSAI responsive to the SSSA procedure succeeding; and
retaining or adding S-NSSAIs in a pending NSSAI responsive to the SSSA procedure failing.

4. The method of claim 1 , further comprising:
encrypting the NSSAI IE, and wherein transmitting the NSSAI IE from the AMF to the UE comprises:
sending the encrypted NSSAI IE via a secure channel established between the AMF and the UE.

5. The method of claim 1 , further comprising:
monitoring, by the AMF, for a user or service provider action that authorizes a previously unauthorized S-NSSAI; and
automatically triggering a slice-specific secondary authentication (SSSA) procedure for an authorized S-NSSAI upon detection of an authorization action.

6. The method of claim 1 , further comprising:
receiving, by the AMF, a request for access to a network slice from the UE, wherein the request includes a requested NSSAI that includes one or more S-NSSAIs;
determining, by the AMF, whether the S-NSSAIs in the requested NSSAI match the S-NSSAIs identified in the NSSAI IE as awaiting authentication; and
granting temporary access to the requested network slice based on a policy decision responsive to the S-NSSAI matching an S-NSSAI in the NSSAI IE that is awaiting authentication.

7. An apparatus comprising:
one or more processors configured with processor-executable instructions to:
by an access and mobility management function (AMF):
generate a network slice selection assistance information element (NSSAI IE) that:
identifies one or more network slices for which a slice-specific secondary authentication (SSSA) procedure has failed; and
includes a list of single network slice selection assistance information (S-NSSAI) elements that identify network slices for which authentication has not been authorized; and

transmitting the NSSAI IE to a user equipment (UE).

8. The apparatus of claim 7 , wherein the one or more processors is further configured with processor-executable instructions to:
update a network slice authentication status based on a result of the SSSA procedure; and
initiate a UE configuration update procedure to communicate the updated network slice authentication status.

9. The apparatus of claim 8 , wherein the one or more processors are configured with processor-executable instructions to update the network slice authentication status based on the result of the SSSA procedure by:
adding S-NSSAIs to an allowed NSSAI responsive to the SSSA procedure succeeding; and
retaining or adding S-NSSAIs in a pending NSSAI responsive to the SSSA procedure failing.

10. The apparatus of claim 7 , wherein the one or more processors are configured with processor-executable instructions to:
encrypt the NSSAI IE, and wherein the processor-executable instructions to transmit the NSSAI IE from the AMF to the UE include processor-executable instructions to:
send the encrypted NSSAI IE via a secure channel established between the AMF and the UE.

11. The apparatus of claim 7 , wherein the one or more processors are further configured with processor-executable instructions to:
monitor for a user or service provider action that authorizes a previously unauthorized S-NSSAI; and
automatically trigger a slice-specific secondary authentication (SSSA) procedure for an authorized S-NSSAI upon detection of an authorization action.

12. The apparatus of claim 7 , wherein the one or more processors are further configured with processor-executable instructions to:
receive a request for access to a network slice from the UE, wherein the request includes a requested NSSAI that includes one or more S-NSSAIs;
determine whether the S-NSSAIs in the requested NSSAI match the S-NSSAIs identified in the NSSAI IE as awaiting authentication; and
grant temporary access to the requested network slice based on a policy decision responsive to the S-NSSAI matching an S-NSSAI in the NSSAI IE that is awaiting authentication.

13. A method for network slice selection and user equipment (UE) configuration update in a 5G system, comprising:
generating, by one or more access and mobility management function (AMF) processors within a network, a network slice selection assistance information element (NSSAI IE) that includes:
one or more single network slice selection assistance information (S-NSSAI) elements corresponding to network slices for which network slice-specific authentication and authorization procedures are to be initiated;
S-NSSAIs relating to network slices that are subject to authentication and authorization procedures;

encrypting the NSSAI IE to secure its transmission across the network;
transmitting, by the AMF, the encrypted NSSAI IE from the AMF to a UE through a secure channel;
receiving, by the AMF from the UE, a request for network slice access that includes a requested NSSAI with one or more S-NSSAIs;
determining, by the AMF, whether the S-NSSAIs in the Requested NSSAI match those in the NSSAI IE identified as pending authentication or unauthorized;
granting, by the AMF, temporary access to a network slice associated with the request for network slice access, based on a policy decision responsive to an S-NSSAI in the requested NSSAI matching an S-NSSAI in the NSSAI IE identified as pending authentication;
updating, by the AMF, a network slice authentication status based on a result of the network slice-specific authentication and authorization procedures; and
initiating, by the AMF, a UE configuration update procedure to communicate the updated network slice authentication status.

Assignees

• Qualcomm Inc

Inventors

• Faccin Stefano
• Watfa Mahmoud

Classifications

• H04W48/18

  Selecting a network or a communication service · CPC title

• H04W12/037

  of the control plane, e.g. signalling traffic · CPC title

• H04W12/08 Primary

  Access security · CPC title

• H04W12/06 Primary

  Authentication · CPC title

• H04W48/02

  Access restriction performed under specific conditions · CPC title