Unified authentication for integrated small cell and Wi-Fi networks
Multi-RAT UEs currently have 2 independent paths to authenticate with HSS (either via the MME or the 3GPP AAA Server causing repeated authentication messages to HSS. The use of one unified authentication path between the UE and HSS for Small Cell and Wi-Fi authentication is described. First, a new 3GPP EPC-TWAN interworking architecture has the MME manage all the authentication requests from multi-RAT UEs. Second, new unified authentication procedures are added, which allow the ISWN-based multi-RAT UE to be authenticated directly with the HSS, irrespective of its current access network (TWAN or HeNB). Third, new fast re-authentication procedures for Inter-RAT handover scenarios are done. Finally, the needed extensions to the various standard protocol messages to execute the authentication procedures are described.
1. An apparatus comprising a processor and a memory, the apparatus further including computer-executable instructions stored in the memory of the apparatus which, when executed by the processor of the apparatus, cause the apparatus to:
connect to a network through a first access point that uses a first radio access technology, wherein upon a connection to the network through the first access point, the apparatus does a full authentication; and
thereafter, switch to a connection to the network through a second access point that uses a second radio access technology, wherein upon a connection to the network through the second access point, the apparatus does a fast authentication, wherein the fast authentication does not do at least one authentication step done in the full authentication, wherein in both the fast authentication and the full authentication the apparatus interacts with a Mobility Management Entity (MME) rather than a Home Subscriber Server (HSS),
wherein one of the first and second access points is a WiFi access point and another of the first and second access points is a cellular access point.
2. The apparatus of claim 1 , wherein the WiFi access point is for a trusted or an untrusted WLAN.
3. The apparatus of claim 1 , wherein the cellular access point is for an eNodeB.
4. The apparatus of claim 1 , wherein the request from the apparatus to connect to the first access point includes an indication that authentication is desired with both the first and second access points.
5. The apparatus of claim 1 , wherein the first access point provides a re-authentication ID to the apparatus and the re-authentication ID is provided to the second access point during fast re-authentication.
6. The apparatus of claim 1 , wherein the first and second access points are combined in a single box as an Integrated Services Wireless Network (ISWN).
7. The apparatus of claim 1 , wherein one of the first and second access points is a WiFi access point wherein the apparatus uses an interface that connects between the WiFi access point and the MME.
8. The apparatus of claim 1 , wherein the apparatus is user equipment.
9. An apparatus comprising a processor and a memory, the apparatus further including computer-executable instructions stored in the memory of the apparatus which, when executed by the processor of the apparatus, cause the apparatus to:
upon a connection with user equipment through one of a first access point that uses a first radio access technology and a second access point that uses a second radio access technology, perform a full authentication with the user equipment; and
thereafter, upon switching to a connection through another of the first and second access point, perform a fast authentication, wherein the fast authentication does not require a mutual authentication step between the apparatus and user equipment, wherein in both the fast authentication and the full authentication the apparatus interacts with a Mobility Management Entity (MME) rather than a Home Subscriber Server (HSS),
wherein one of the first and second access points is a WiFi access point and another of the first and second access points is a cellular access point.
10. The apparatus of claim 9 , wherein, in the full authentication, the apparatus provides the user equipment with at least one of a re-authentication-ID and an access network identity.
11. The apparatus of claim 9 , wherein, in the fast authentication, the apparatus does not run an Authentication and Key Agreement (AKA).
12. The apparatus of claim 9 , wherein the apparatus executes an implementation of a Network Function of the core network.
13. The apparatus of claim 12 , wherein one of the first and second access points is a WiFi access point and wherein the Network Function uses an interface that connects between the WiFi access point and the Network Function.
14. A method for use by an apparatus, wherein the apparatus comprises a processor and memory, and wherein the apparatus further includes computer-executable instructions stored in the memory which, when executed by the processor, perform functions of a method comprising:
connecting to a network through a first access point that uses a first radio access technology, wherein upon a connection to the network through the first access point, the apparatus does a full authentication; and
thereafter, switching to a connection to the network through a second access point that uses a second radio access technology, wherein upon a connection to the network through the second access point, the apparatus does a fast authentication, wherein the fast authentication does not do at least one authentication step done in the full authentication, wherein in both the fast authentication and the full authentication the apparatus interacts with a Mobility Management Entity (MME) rather than a Home Subscriber Server (HSS),
wherein one of the first and second access points is a WiFi access point and another of the first and second access points is a cellular access point.
15. The method of claim 14 , wherein the apparatus is user equipment.
16. A method for use by an apparatus, wherein the apparatus comprises a processor and memory, and wherein the apparatus further includes computer-executable instructions stored in the memory which, when executed by the processor, perform functions of a method comprising:
upon a connection with user equipment through one of a first access point that uses a first radio access technology and a second access point that uses a second radio access technology, performing a full authentication with the user equipment; and
thereafter, upon switching to a connection through another of the first and second access point, performing a fast authentication, wherein the fast authentication does not require a mutual authentication step between the apparatus and user equipment, wherein in both the fast authentication and the full authentication the apparatus interacts with a Mobility Management Entity (MME) rather than a Home Subscriber Server (HSS).