Methods and systems for authentication and establishment of secure connection for edge computing services
Methods and systems for authentication and establishment of secure connection for accessing edge computing services are provided. The method includes dynamically deriving a pre-shared key (PSK) and use the dynamically derived PSK for the authentication, while performing or before performing a secure connection establishment or while or before establishing a secure interface between a user equipment (UE), and a server, wherein the UE includes an Edge Enabler Client (EEC), and the server is an Edge Configuration Server (ECS). The method further includes deriving the PSK based on an Authentication and Key Management for Applications (AKMA) application key.
1. A method performed by a user equipment (UE) for accessing an edge computing service, the method comprising:
performing a network access authentication procedure;
deriving an authentication and key management for applications (AKMA) key;
transmitting, to an edge configuration server (ECS), a provisioning request message including an identifier (ID) of the AKMA key;
receiving, from the ECS, a message related to authentication;
obtaining a pre-shared key (PSK); and
performing, with the ECS, an establishment procedure of a transport layer security (TLS) session with the PSK based on authentication for mutual authentication.
2. The method of claim 1 , wherein the UE includes an edge enabler client (EEC).
3. The method of claim 1 , wherein the network access authentication procedure is a primary network access procedure.
4. The method of claim 1 , wherein the ID of the AKMA key is used by the ECS for contacting an entity corresponding to an AKMA anchor function (AAnF) to obtain an edge configuration server specific key (K ECS ).
5. The method of claim 1 ,
wherein the PSK is derived as an output of a key derivation function (KDF), and
wherein inputs of the KDF include an edge configuration server specific key (K ECS ) and parameters including at least one of, a Function Code (FC) value, a Generic Public Subscription Identifier (GPSI), an edge enabler client (EEC) ID, an ECS ID, a text string like “PSK”, or a freshness parameter.
6. The method of claim 5 , wherein the freshness parameter is a counter value maintained by the EEC of the UE.
7. A User Equipment (UE) in an edge computing system comprising:
a memory; and
a controller coupled to the memory and configured to:
perform a network access authentication procedure,
derive an authentication and key management for applications (AKMA) key,
transmit, to an edge configuration server (ECS), a provisioning request message including an identifier (ID) of the AKMA key,
receive, from the ECS, a message related to authentication,
obtain a pre-shared key (PSK), and
perform, with the ECS, an establishment procedure of a transport layer security (TLS) session with the PSK based on authentication for mutual authentication.
8. An edge configuration server (ECS) in an edge computing system comprising:
a memory; and
a controller coupled to the memory configured to:
receive, from a user equipment (UE), a provisioning request message including an identifier (ID) of an authentication and key management for applications (AKMA) key,
obtain an edge configuration server specific key (K ECS ) by contacting an entity corresponding to an AKMA anchor function (AAnF) based on the ID of the AKMA key,
derive a pre-shared key (PSK) based on the edge configuration server specific key (K ECS ), and
perform, with the UE, an establishment procedure of a transport layer security (TLS) session with the PSK based on authentication for mutual authentication.
9. A method performed by an edge configuration server (ECS) for an edge computing service, the method comprising:
receiving, from a user equipment (UE), a provisioning request message including an identifier (ID) of an authentication and key management for applications (AKMA) key;
obtaining an edge configuration server specific key (K ECS ) by contacting an entity corresponding to an AKMA anchor function (AAnF) based on the ID of the AKMA key;
deriving a pre-shared key (PSK) based on the edge configuration server specific key (K ECS ); and
performing, with the UE, an establishment procedure of a transport layer security (TLS) session with the PSK based on authentication for mutual authentication.
10. The method of claim 9 , further comprising:
transmitting, to the entity corresponding to the AAnF, a key request; and
receiving, from the entity corresponding to the AAnF, a key response including the edge configuration server specific key (K ECS ),
wherein the edge configuration server specific key (K ECS ) corresponds to the ID of the AKMA key.
11. The method of claim 9 , wherein the ECS provides configuration information to the UE to connect with an edge application server (EAS) for accessing edge computing services.