Multi-access edge computing (MEC)-key id derivation in authentication between UE and edge servers
Disclosed are embodiments for authentication and authorization in a 5G network between an edge enabler client (EEC) of a UE and an edge configuration server (ECS). The embodiment include performing primary authentication with the 5G network to obtain a K AUSF ; generating a K edge and a K edge ID using the K AUSF and a subscription permanent identifier (SUPI); providing the K edge and the K edge ID to the EEC to cause it to compute a MAC EEC using the K edge and an EEC ID; and sending to the ECS an application registration request, the application registration request including the EEC ID, MACEEC, and K edge ID.
1. A method, performed by a user equipment (UE) configured to communicate in a 5G network, of authentication and authorization between an edge enabler client (EEC) of the UE and an edge configuration server (ECS), the method comprising:
performing primary authentication with the 5G network to obtain a K AUSF ;
generating a K edge and a K edge identifier (ID) using the K AUSF and a subscription permanent identifier (SUPI);
providing the K edge and the K edge ID to the EEC to cause it to compute a MAC EEC using the K edge and an EEC ID; and
sending to the ECS an application registration request, the application registration request including the EEC ID, the MAC EEC , and the K edge ID, in which the sending comprises either sending a non-access stratum (NAS) message or a user-plane message.
2. The method of claim 1 , further comprising receiving from the ECS an authentication request acceptance or rejection.
3. The method of claim 1 , further comprising generating the K edge according to a key derivation function (KDF) in which an input string S to the KDF includes an FC parameter, a P0 parameter, and an L0 parameter, the FC parameter being allocated according to 3GPP specifications, the P0 parameter is equal to the SUPI, and the L0 parameter is equal to a length of the SUPI.
4. The method of claim 1 , in which the K edge ID uniquely identifies one K edge .
5. The method of claim 1 , in which the K edge ID includes a routing part for locating an authentication server function (AUSF) or a network exposure function (NEF).
6. The method of claim 5 , in which the routing part is based on one or more of the SUPI, generic public subscription identifier (GPSI), and public land mobile network (PLMN) ID.
7. The method of claim 1 , in which the K edge ID includes a service identifier part for identifying an edge service.
8. The method of claim 7 , in which the service identifier part is based on one or more of the EEC ID, an edge application server (EAS) ID, and an EAS provider identifier.
9. The method of claim 1 , in which the K edge ID includes a uniqueness part to ensure the K edge ID will not be conflict with another K edge ID.
10. The method of claim 9 , in which the uniqueness part is a pseudorandom number.
11. A non-transitory computer-readable storage medium for a user equipment (UE) configured to communicate in a 5G network and perform authentication and authorization between an edge enabler client (EEC) of the UE and an edge configuration server (ECS), the computer-readable storage medium including instructions that when executed by the UE, cause the UE to:
perform primary authentication with the 5G network to obtain a K AUSF ;
generate a K edge and a K edge identifier (ID) using the K AUSF and a subscription permanent identifier (SUPI);
provide the K edge and the K edge ID to the EEC to cause it to compute a MAC EEC using the K edge and an EEC ID; and
send to the ECS an application registration request in a non-access stratum (NAS) message or a user-plane message, the application registration request including the EEC ID, the MAC EEC , and the K edge ID.
12. The computer-readable storage medium of claim 11 , in which the instructions further configure the UE to receive from the ECS an authentication request acceptance or rejection.
13. The computer-readable storage medium of claim 11 , in which the instructions further configure the UE to generate the K edge according to a key derivation function (KDF) in which an input string S to the KDF includes an FC parameter, a P0 parameter, and an L0 parameter, the FC parameter being allocated according to 3GPP specifications, the P0 parameter is equal to the SUPI, and the L0 parameter is equal to a length of the SUPI.
14. The computer-readable storage medium of claim 11 , in which the K edge ID uniquely identifies one K edge .
15. The computer-readable storage medium of claim 11 , in which the K edge ID includes a routing part for locating an authentication server function (AUSF) or a network exposure function (NEF).
16. The computer-readable storage medium of claim 15 , in which the routing part is based on one or more of the SUPI, generic public subscription identifier (GPSI), and public land mobile network (PLMN) ID.