Method, apparatus, and computer program product for authentication using a user equipment identifier
Methods, computer program products, and apparatuses are provided for enabling a user equipment (UE) to connect to the wireless access network that support non-seamless wireless local area network (WLAN) offload (NSWO), such as using the UE's fifth generation (5G) credentials. An apparatus may include a processor and a memory storing computer program code configured to cause the apparatus to request, by the UE, a wireless connection to a network entity; receive, by the UE, from the network entity, an identity request; and in response to the identity request, cause transmission, by the UE, an identity response including a UE identifier to the network entity such that the UE is configured to establish a security context with the network entity upon successful authentication using the UE identifier.
1 . A method comprising:
requesting, by a user equipment (UE), a non-seamless wireless offload (NSWO) connection to a network entity;
receiving, by the UE, from the network entity, an identity request; in response to the identity request, causing transmission, by the UE, of an identity response comprising a UE identifier to the network entity, wherein (i) the UE identifier comprises a subscription concealed identifier (SUCI), (ii) the SUCI is part of a network access identifier (NAI), and (iii) the SUCI is generated based on a public key of a home network associated with a registration of the UE;
deriving, by the UE, a master key (MSK) during authentication with the network entity; and
establishing, by the UE, a security context with the network entity upon successful authentication based on the MSK.
2 . The method according to claim 1 , wherein the NSWO connection to the network entity is during an extensible authentication protocol (EAP) procedure and the UE identifier is used for 3rd generation partnership project (3GPP) access or non-3GPP access to a fifth generation core (5GC).
3 . The method according to claim 1 , wherein the UE identifier serves as a fifth generation core (5GC) credential used in the NSWO connection.
4 . The method according to claim 1 , wherein the SUCI is generated using an elliptic curve integrated encryption scheme (ECIES)-based protection scheme.
5 . The method according to claim 1 , wherein the network entity comprises a wireless local area network (WLAN) Access Point (AP).
6 . A method comprising:
receiving, by a network function, from a network entity, a user equipment (UE) identifier;
causing transmission, by the network function, to an authentication function, of the UE identifier and a wireless connection indicator, wherein the wireless connection indicator indicates that an extensible authentication protocol (EAP) procedure is triggered for non-seamless wireless offload (NSWO) connection purposes; and
upon successful authentication using the UE identifier, sending a master key received from the authentication function to the network entity.
7 . The method according to claim 6 , further comprising storing, by the network function upon successful authentication using the UE identifier, a permanent UE identifier received from the authentication function, wherein the permanent UE identifier is a subscription permanent identifier (SUPI) derived from the UE identifier.
8 . The method according to claim 6 , wherein the authentication function is configured to determine an authentication type using the wireless connection indicator and trigger the extensible authentication protocol (EAP) procedure for the NSWO connection purposes in accordance with the authentication type.
9 . The method according to claim 6 , further comprising:
causing transmission, by the network function, to a unified data management (UDM), of a registration request message for registering the UE; and
upon receiving, at the network function, from the UDM, a deregistration message for deregistering the UE, triggering a termination of a wireless connection to the network entity.
10 . The method according to claim 6 , further comprising:
receiving, at the network function, the master key and a subscription permanent identifier (SUPI), wherein the master key is established as a result of a key derivation process based on, at least in part, a serving network name provided by the network function.
11 . The method according to claim 6 , wherein the network function is configured to be used as an access and mobility management function (AMF) proxy towards an authentication server function (AUSF) in a fifth generation core (5GC) and as an authentication, authorization, and accounting (AAA) proxy towards a wireless connection.
12 . The method according to claim 6 , wherein the UE identifier is a subscription concealed identifier (SUCI).
13 . The method according to claim 6 , wherein the UE identifier serves as a fifth generation core (5GC) credential used in a NSWO connection.
14 . An apparatus comprising:
at least one processor; and
at least one memory including computer program code, the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to at least:
request, by a user equipment (UE), a non-seamless wireless offload (NSWO) connection to a network entity;
receive, by the UE, from the network entity, an identity request;
in response to the identity request, cause transmission, by the UE, of an identity response comprising a UE identifier to the network entity, wherein (i) the UE identifier comprises a subscription concealed identifier (SUCI), (ii) the SUCI is part of a network access identifier (NAI), and (iii) the SUCI is generated based on a public key of a home network associated with a registration of the UE;
derive, by the UE, a master key (MSK) during authentication with the network entity; and
establish, by the UE, a security context with the network entity upon successful authentication based on the MSK.
15 . The apparatus according to claim 14 , wherein the NSWO connection to the network entity is during an extensible authentication protocol (EAP) procedure and wherein the UE identifier serves as a fifth generation core (5GC) credential used in the NSWO connection.
16 . The apparatus according to claim 14 , wherein the UE identifier is used for regular 3rd generation partnership project (3GPP) access or non-3GPP access to a fifth generation core (5GC).
17 . An apparatus comprising:
at least one processor; and
at least one memory including computer program code, the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to at least:
receive, by a network function, from a network entity, a user equipment (UE) identifier; cause transmission, by the network function, to an authentication function, of the UE identifier and a wireless connection indicator, wherein the wireless connection indicator indicates that an extensible authentication protocol (EAP) procedure is triggered for non-seamless wireless offload (NSWO) connection purposes; and
upon successful authentication using the UE identifier, send a master key received from the authentication function to the network entity.
18 . The apparatus according to claim 17 , wherein the at least one memory and the computer program code are further configured to, with the at least one processor, cause the apparatus, upon successful authentication using the UE identifier, to store, by the network function, a permanent UE identifier received from the authentication function, and wherein the permanent UE identifier is a subscription permanent identifier (SUPI) derived from the UE identifier.
19 . The apparatus according to claim 17 , wherein the authentication function is configured to determine an authentication type using the wireless connection indicator and trigger the extensible authentication protocol (EAP) procedure for the NSWO connection purposes in accordance with the authentication type.
20 . The apparatus according to claim 17 wherein the at least one memory and the computer program code are further configured to, with the at least one processor, cause the apparatus to at least:
cause transmission, by the network function, to a unified data management (UDM), of a registration request message for registering a UE; and
upon receiving, at the network function, from the UDM, a deregistration message for deregistering the UE, trigger a termination of the wireless connection to the network entity.
21 . The apparatus according to claim 17 , wherein the at least one memory and the computer program code are further configured to, with the at least one processor, cause the apparatus to at least:
receive, at the network function, the master key and a subscription permanent identifier (SUPI), wherein the master key is established as a result of a key derivation process based on, at least in part, a serving network name provided by the network function.
22 . The apparatus according to claim 17 , wherein the network function is configured to be used as an access and mobility management function (AMF) proxy towards an authentication server function (AUSF) in a fifth generation core (5GC) and as an authentication, authorization, and accounting (AAA) proxy towards the wireless connection.
23 . The apparatus according to claim 17 , wherein the UE identifier is a subscription concealed identifier (SUCI).
24 . The apparatus according to claim 17 , wherein the UE identifier serves as a fifth generation core (5GC) credential used in a NSWO connection.