Method for authenticating a user on a network slice
Provided is a method to operate a secure chip card for connecting to a user equipment operating in a cellular network comprising a plurality of network slices, wherein for at least one network slice a slice authentication server is operational, the secure chip card comprising a secured memory with at least one slice authentication application.
1. A method to operate a secure chip card connected to a user equipment operating in a cellular network comprising a plurality of network slices, wherein for at least one network slice a slice authentication server is operational, the secure chip card comprising a secured memory with at least one slice authentication application,
the method comprising the steps of:
retrieving a slice authentication configuration message comprising a slice identification from the user equipment;
generating, by a slice authentication application of said secure chip card, an application user identifier considering the slice identification, said application user identifier representing a user who wants to get access to the network slice via the user equipment,
sending a slice attachment request comprising the application user identifier to the slice authentication server;
receiving a user verification request corresponding to said application user identifier from the slice authentication server;
acquiring user verification data acquired from the user of the user equipment,
sending a user verification result to the slice authentication server; and
receiving a slice authentication success message to the user equipment for the user of the user equipment to access to the slice corresponding to the slice identification.
2. The method according to claim 1 , wherein the secure chip card is configured to store a plurality of slice authentication applications, further comprising a slice authentication proxy application,
wherein the first of the plurality of slice authentication applications is assigned to a first slice of the cellular network, and a second slice of the plurality of slice authentication applications is assigned to a second slice of the cellular network,
the method comprising the step after receiving of the user verification request dispatching the user verification request to one of the plurality of slice authentication applications.
3. The method according to claim 2 , further comprising the steps for the secure chip card of
receiving from the slice authentication server a set of application configuration parameter, and
updating the stored at least one slice authentication application based on the received set of application configuration parameter.
4. The method according to claim 3 , wherein the user equipment has registered to the cellular network by means of network access credentials stored in the secured chip card.
5. The method according to claim 4 , wherein the step of sending a user verification result comprises encrypting the user verification result before submitting.
6. A secure chip card for connecting configured to be connected to a user equipment operating in a cellular network comprising a plurality of network slices, wherein for at least one network slice an slice authentication server is operational,
the secure chip card comprising a secured memory with at least one slice authentication application; wherein the secure chip card is configured to:
retrieve a slice authentication configuration message comprising a slice identification from the user equipment;
generate an application user identifier, by a slice authentication application of said secure chip card, considering the slice identification, said application user identifier representing a user who wants to get access to the network slice;
send, via the user equipment, a slice attachment request comprising the application user identifier to the slice authentication server;
receive a user verification request corresponding to said application user identifier from the slice authentication server;
retrieve user verification data acquired from the user of the user equipment;
send a user verification result to the slice authentication server; and
receive a slice authentication success message to the user equipment for the user of the user equipment to access to the slice corresponding to the slice identification.
7. The secure chip card according to claim 6 , further configured to store a plurality of slice authentication applications, further comprising a slice authentication proxy application,
wherein the first of the plurality of slice authentication applications is assigned to a first slice of the cellular network, and a second slice of the plurality of slice authentication applications is assigned to a second slice of the cellular network,
the secure chip card being configured after receiving of the user verification request to dispatch the user verification request to one of the plurality of slice authentication applications.
8. The secure chip card according to claim 6 , further being configured to:
receive from the slice authentication server a set of application configuration parameter, and
update the stored at least one slice authentication application based on the received set of application configuration parameter.
9. The secure chip card according to claim 8 , wherein the user equipment has registered to the cellular network by means of network access credentials stored in the secured chip card.
10. The secure chip card according to claim 9 , further configured upon sending a user verification result to encrypt the user verification result before submitting.
11. A method for a slice authentication server being assigned to a network slice of a cellular network, the method comprising the step of:
receiving, at the slice authentication server, from a secure chip card of a user equipment a slice attachment request comprising an application user identifier generated from a slice identification representing a user who wants to get access to the network slice via the user equipment,
checking, by the slice authentication server, for the application user identifier, a stored record is available,
preparing, by the slice authentication server, a user verification request, wherein the user verification request instructs the secure chip card, in conjunction with the user equipment, to return a user verification request,
sending, by the slice authentication server, the user verification request to the secure chip card,
receiving, at the slice authentication server, a user verification result,
evaluating, by the slice authentication server, the user verification result, and
sending, by the slice authentication server, a slice authentication success message to the user equipment to access to the slice corresponding to the slice identification.