Secondary Authentication of a User Equipment

Patent metadata

Field	Value
Publication number	US-2018317086-A1
Application number	US-201715761835-A
Country	US
Kind code	A1
Filing date	Dec 22, 2017
Priority date	Jan 27, 2017
Publication date	Nov 1, 2018
Grant date	—

Abstract

A user equipment ( 18 ) is configured to receive an extensible authentication protocol, EAP, request ( 28 ) from a session management function, SMF, ( 14 ) that serves as an EAP authenticator for secondary authentication of the user equipment ( 18 ). The secondary authentication is authentication of the user equipment ( 18 ) in addition to primary authentication of the user equipment ( 18 ). The user equipment ( 18 ) is also configured to, responsive to the EAP request ( 28 ), transmit an EAP response ( 30 ) to the SMF ( 14 ).

First claim

1 - 38 . (canceled)

39 . A method for secondary authentication of a user equipment, wherein the method comprises:
receiving, by the user equipment, an extensible authentication protocol, EAP, request from a session management function, SMF, that serves as an EAP authenticator for secondary authentication of the user equipment, wherein the secondary authentication is authentication of the user equipment in addition to primary authentication of the user equipment; and responsive to the EAP request, transmitting an EAP response from the user equipment to the SMF.

40 . The method of claim 39 , wherein the SMF is configured to forward the EAP request and the EAP response between the user equipment and an EAP server that executes an EAP authentication method for the EAP authenticator.

41 . The method of claim 40 , wherein the user equipment and the SMF are configured for use in a wireless communication network, wherein the EAP server is in a data network with which the user equipment requests a user plane session, wherein the secondary authentication of the user equipment is authentication of the user equipment to establish the user plane session, wherein the secondary authentication is delegated by the wireless communication network to the data network.

42 . The method of claim 40 , wherein the EAP request and the EAP response are transmitted between the SMF and the EAP server via a user plane function selected by the SMF.

43 . The method of claim 39 , wherein the EAP request and the EAP response are encapsulated within respective non-access stratum (NAS) protocol messages between the SMF and the UE.

44 . The method of claim 39 , wherein a session establishment request transmitted from the user equipment triggers the secondary authentication of the user equipment, wherein the session establishment request includes a secondary identity of the user equipment used for the secondary authentication, and wherein a session establishment response transmitted to the user equipment includes either an EAP success message indicating success of the secondary authentication or an EAP failure message indicating failure of the secondary authentication.

45 . A method for secondary authentication of a user equipment, wherein the method comprises:
transmitting an extensible authentication protocol, EAP, request from a session management function, SMF, to a user equipment, wherein the SMF serves as an EAP authenticator for secondary authentication of the user equipment, wherein the secondary authentication is authentication of the user equipment in addition to primary authentication of the user equipment; and responsive to the EAP request, receiving at the SMF an EAP response from the user equipment.

46 . The method of claim 45 , wherein the SMF is configured to forward the EAP request and the EAP response between the user equipment and an EAP server that executes an EAP authentication method for the EAP authenticator.

47 . The method of claim 46 , wherein the user equipment and the SMF are configured for use in a wireless communication network, wherein the EAP server is in a data network with which the user equipment requests a user plane session, wherein the secondary authentication of the user equipment is authentication of the user equipment to establish the user plane session, wherein the secondary authentication is delegated by the wireless communication network to the data network.

48 . The method of claim 46 , wherein the EAP request and the EAP response are transmitted between the SMF and the EAP server via a user plane function selected by the SMF.

49 . The method of claim 45 , wherein the EAP request and the EAP response are encapsulated within respective non-access stratum (NAS) protocol messages between the SMF and the UE.

50 . The method of claim 45 , wherein a session establishment request transmitted from the user equipment triggers the secondary authentication of the user equipment, wherein the session establishment request includes a secondary identity of the user equipment used for the secondary authentication, and wherein a session establishment response transmitted to the user equipment includes either an EAP success message indicating success of the secondary authentication or an EAP failure message indicating failure of the secondary authentication.

51 . A method for secondary authentication of a user equipment, wherein the method comprises:
transmitting an extensible authentication protocol, EAP, request from an EAP server to the user equipment via a session management function, SMF, wherein the SMF serves as an EAP authenticator for secondary authentication of the user equipment, wherein the secondary authentication is authentication of the user equipment in addition to primary authentication of the user equipment and wherein the EAP server is configured to execute an EAP authentication method for the EAP authenticator; and responsive to the EAP request, receiving at the EAP server via the SMF an EAP response from the user equipment.

52 . The method of claim 51 , wherein the user equipment and the SMF are configured for use in a wireless communication network, wherein the EAP server is in a data network with which the user equipment requests a user plane session, wherein the secondary authentication of the user equipment is authentication of the user equipment to establish the user plane session, wherein the secondary authentication is delegated by the wireless communication network to the data network.

53 . The method of claim 51 , wherein the EAP request and the EAP response are transmitted between the SMF and the EAP server via a user plane function selected by the SMF.

54 . The method of claim 51 , wherein the EAP request and the EAP response are encapsulated within respective non-access stratum (NAS) protocol messages between the SMF and the UE.

55 . The method of claim 51 , wherein a session establishment request transmitted from the user equipment triggers the secondary authentication of the user equipment, wherein the session establishment request includes a secondary identity of the user equipment used for the secondary authentication, and wherein a session establishment response transmitted to the user equipment includes either an EAP success message indicating success of the secondary authentication or an EAP failure message indicating failure of the secondary authentication.

56 . A user equipment comprising:
processing circuitry and memory, the memory containing instructions executable by the processing circuitry whereby the user equipment is configured to:
receive an extensible authentication protocol, EAP, request from a session management function (SMF) that serves as an EAP authenticator for secondary authentication of the user equipment, wherein the secondary authentication is authentication of the user equipment in addition to primary authentication of the user equipment; and
responsive to the EAP request, transmit an EAP response from the user equipment to the SMF.

57 . The user equipment of claim 56 , wherein the SMF is configured to forward the EAP request and the EAP response between the user equipment and an EAP server that executes an EAP authentication method for the EAP authenticator.

58 . The user equipment of claim 19 , wherein the user equipment and the SMF are configured for use in a wireless communication network, wherein the EAP server is in a data network with which the user equipment requests a user plane session, wherein the secondary authentic

Assignees

• Ericsson Telefon Ab L M

Inventors

• Ben Henda Noamen
• Castellanos Zamora David
• Torvinen Vesa

Classifications

• H04L63/164

  at the network layer · CPC title

• H04L9/0844 Primary

  with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys · CPC title

• H04W76/25

  Maintenance of established connections · CPC title

• H04L63/061

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title

• H04W88/023

  with message or information receiving capability · CPC title