Methods and systems for identifying AUSF and accessing related keys in 5G prose
Methods and systems for identifying AUSF and accessing related keys in 5G ProSe. The AUSF corresponding to a remote UE is identified by an AMF based on routing indicator or SKI. The AUSF is capable of key management of ProSe UE-to-Network relay communication. The AUSF authorizes the remote UE to access a 5G core network through one or more UE-to-network relays. The authorization of the remote UE is performed based on a SUPI corresponding to the remote UE. The SUPI is obtained from a UDM. Once the remote UE is authorized, the AUSF can derive keys that enable the remote UE to access the 5G core network through the one or more UE-to-network relays. The keys derived by the AUSF 803 can be referred to as authentication keys. The derived keys include REAR key, K NR_ProSe , K D , and K NRP .
1. A method for securing proximity services (ProSe) in a 5 th generation (5G) network, the method comprising:
receiving, by a user equipment (UE), a policy pertaining to discovery of at least one ProSe relay UE or security of ProSe communication, from an access and mobility function (AMF), in response to a policy provisioning request;
sending, by the UE, a key request message, to the AMF, for obtaining security keys and parameters for securing ProSe communication with a 5G core network through at least one ProSe relay UE; and
receiving, by the UE, a remote access via relay (REAR) key and at least one security parameter, from the AMF, for securing the ProSe communication with the 5G core network through the at least one ProSe relay UE,
wherein the REAR key is generated by an authentication server function (AUSF) associated with UE which is identified, by the AMF, using a source key identifier (SKI) stored in the AMF, and
wherein a format of SKI comprises a type field indicating the AUSF associated with the UE and a value field indicating an association of the SKI with K AUSF , and an availability of K AUSF .
2. The method of claim 1 , wherein the key request message comprises at least one of a ProSe remote access indication, a globally unique temporary identity (GUTI), a generic public subscription identifier (GPSI), a routing indicator, and a subscription concealed identifier (SUCI).
3. The method of claim 2 , wherein the REAR key is received, by the UE, on successful verification of the UE by the AUSF associated with the UE, wherein the verification of the UE comprises:
receiving, by the AUSF, the key request message from the AMF;
sending, by the AUSF, a UE authentication request comprising at least one of the ProSe remote access indication, the GUTI, the SUCI, the GPSI, and the routing indicator, to a unified data management (UDM);
generating, by the AUSF, the REAR key on receiving, from the UDM, a subscription permanent identifier (SUPI) in response to the UE authentication request, wherein the SUPI is received if the UE is authorized to access the 5G network through the at least one ProSe relay UE; and
sending, by the AUSF, the REAR key to the AMF, wherein the AMF delivers the REAR key to the UE.
4. The method of claim 3 , wherein the AUSF associated with the UE is identified, by the AMF, based on the routing indicator.
5. The method of claim 3 , wherein the AMF checks a stored mapping between the SKI and at least on identifier of the UE, to route the key request message to the AUSF associated with the UE.
6. The method of claim 3 ,
wherein the AMF obtains the SKI from the AUSF, associated with the UE, during primary authentication of the UE with the 5G core network, and
wherein the SKI is derived by the AUSF along with K AUSF if the primary authentication is successful.
7. The method of claim 3 , wherein the SKI is obtained, by the AMF, from a policy control function (PCF) while receiving the policy pertaining to the discovery of the at least one ProSe relay UE and the security of ProSe communication.
8. The method of claim 3 ,
wherein the format of the SKI is identical to a format of a next generation key set identifier (ngKSI).
9. The method of claim 1 , wherein the policy provisioning request includes at least one of a capability of the UE to avail ProSe through the 5G network, and availability of a functional PC-5 interface.
10. The method of claim 1 , wherein the policy pertaining to the discovery of the at least one ProSe relay UE and the security of ProSe communication is obtained, by the AMF from a policy control function (PCF).
11. A user equipment (UE) for securing proximity services (ProSe) in a 5 th generation (5G) network, the UE comprising:
memory; and
at least one processor coupled to the memory, wherein the at least one processor is configured to:
receive a policy pertaining to discovery of at least one ProSe relay UE or security of ProSe communication, from an access and mobility function (AMF), in response to a policy provisioning request;
send a key request message, to the AMF, for obtaining security keys and parameters for securing ProSe communication with a 5G core network through at least one ProSe relay UE; and
receive a remote access via relay (REAR) key and at least one security parameter from the AMF for securing the ProSe communication with the 5G core network through the at least one ProSe relay UE,
wherein the REAR key is generated by an authentication server function (AUSF) associated with UE which is identified, by the AMF, using a source key identifier (SKI) stored in the AMF, and
wherein a format of SKI comprises a type field indicating the AUSF associated with the UE and a value field indicating an association of the SKI with K AUSF , and an availability of K AUSF .
12. The UE of claim 11 , wherein the key request message comprises at least one of a ProSe remote access indication, a globally unique temporary identity (GUTI), a generic public subscription identifier (GPSI), a routing indicator, and a subscription concealed identifier (SUCI).
13. The UE of claim 12 , wherein the REAR key is received, by the UE, on successful verification of the UE by the AUSF associated with the UE, wherein the verification of the UE comprises:
receiving, by the AUSF, the key request message from the AMF;
sending, by the AUSF, a UE authentication request comprising at least one of the ProSe remote access indication, the GUTI, the SUCI, the GPSI, and the routing indicator, to a unified data management (UDM);
generating, by the AUSF, the REAR key on receiving, from the UDM, a subscription permanent identifier (SUPI) in response to the UE authentication request, wherein the SUPI is received if the UE is authorized to access the 5G network through the at least one ProSe relay UE; and
sending, by the AUSF, the REAR key to the AMF, wherein the AMF delivers the REAR key to the UE.
14. The UE of claim 13 ,
wherein the AMF checks a stored mapping between the SKI and at least on identifier of the UE, to route the key request message to the AUSF associated with the UE.
15. The UE of claim 14 ,
wherein the AMF obtains the SKI from the AUSF, associated with the UE, during primary authentication of the UE with the 5G core network, and
wherein the SKI is derived by the AUSF along with K AUSF if the primary authentication is successful.
16. The UE of claim 14 , wherein the SKI is obtained, by the AMF, from a policy control function (PCF) while receiving the policy pertaining to the discovery of the at least one ProSe relay UE and the security of ProSe communication.
17. The UE of claim 14 ,
wherein the format of the SKI is identical to a format of a next generation key set identifier (ngKSI).
18. The UE of claim 11 , wherein the policy provisioning request includes at least one of a capability of the UE to avail ProSe through the 5G network, and availability of a functional PC-5 interface.
19. The UE of claim 11 , wherein the policy pertaining to the discovery of the at least one ProSe relay UE and the security of ProSe communication is obtained, by the AMF from a policy control function (PCF).