User equipment authentication and authorization procedure for edge data network
A user equipment (UE) may attempt to access an edge data network. The UE generates a first credential based on a second credential, the second credential generated for a procedure between the UE and a cellular network, generating an identifier corresponding to the first credential, and generates a multi-access edge computing (MEC) authorization parameter. The UE then transmits an application registration request message to a server associated with an edge data network, the application registration request message including an indication of the first credential, the identifier corresponding to the first credential and the first authorization parameter. The UE then receives an authentication accept message or an authentication reject message from the server associated with the edge data network.
1. A method, comprising:
at a user equipment (UE):
generating a first credential based on a second credential, the second credential generated for a primary authentication procedure between the UE and a cellular network, wherein the second credential is an Authentication Server Function (AUSF) key (K AUSF );
generating an identifier corresponding to the first credential, said identifier uniquely identifying the first credential;
calculating a multi-access edge computing (MEC) authorization parameter using the first credential and a second identifier, the second identifier being a globally unique value associated with an edge enabler client (EEC) running on the UE;
transmitting an application registration request message to a server associated with an edge data network, the application registration request message including the second identifier, the second identifier corresponding to the first credential and the MEC authorization parameter; and
receiving an authentication accept message or an authentication reject message from the server associated with the edge data network, wherein the authentication accept message or the authentication rejection message is based on a validation of the MEC authorization parameter.
2. The method of claim 1 , wherein the primary authentication procedure includes an authentication server function (AUSF).
3. The method of claim 1 , wherein the first credential is further based on an identifier associated with the UE or other shared information between the UE and the cellular network.
4. The method of claim 3 , wherein the identifier associated with the UE is one of a subscription permanent identifier (SUPI) or a generic public subscription identifier (GPSI).
5. The method of claim 1 , wherein the server associated with the edge data network is an edge configuration server (ECS).
6. The method of claim 1 , wherein the server associated with the edge data network transmits the authentication accept message-based on a second MEC authorization parameter, generated from information in the request message, matching the MEC authorization parameter.
7. The method of claim 1 , wherein the first credential is based on a key derivation function (KDF) and wherein the MEC authorization parameter is generated based on a hashing function.
8. A user equipment (UE), comprising:
a processor configured to perform operations comprising:
generating a first credential based on a second credential, the second credential generated for a primary authentication procedure between the UE and a cellular network, wherein the second credential is an Authentication Server Function (AUSF) key (K AUSF );
generating an identifier corresponding to the first credential, said identifier uniquely identifying the first credential;
calculating a multi-access edge computing (MEC) authorization parameter using the first credential and a second identifier, the second identifier being a globally unique value associated with an edge enabler client (EEC) running on the UE;
generating an application registration request message to a server associated with an edge data network, the application registration request message including the second identifier, the second identifier corresponding to the first credential and the MEC authorization parameter; and
receiving an authentication accept message or an authentication reject message from the server associated with the edge data network, based on the MEC authorization parameter being verified, wherein the authentication accept message is transmitted when a second MEC authorization parameter, generated from information in the request message, matches the MEC authorization parameter; and
a transceiver communicatively connected to the processor.
9. The UE of claim 8 , wherein the first credential is further based on an identifier associated with the UE or other shared information between the UE and the cellular network.
10. The UE of claim 8 , wherein the server associated with the edge data network is an edge configuration server (ECS).
11. A non-transitory computer readable storage media having instructions stored thereon that, when executed by a baseband processor of a user equipment (UE), result in operations comprising:
generating a first credential based on a second credential, the second credential generated for a procedure between a UE and a cellular network;
generating an identifier corresponding to the first credential, said identifier uniquely identifying the first credential;
calculating a multi-access edge computing (MEC) authorization parameter using the first credential and a second identifier, the second identifier being a globally unique value associated with an edge enabler client (EEC) running on the UE;
generating an application registration request message to a server associated with an edge data network, the application registration request message including the second identifier, the second identifier corresponding to the first credential and the MEC authorization parameter; and
receiving at least one of: an authentication accept message and an authentication reject message from the server associated with the edge data network, wherein the authentication accept message is received when a second MEC authorization parameter, generated from information in the request message, matches the MEC authorization parameter.
12. The non-transitory computer readable storage media of claim 11 , wherein the second credential is generated for a primary authentication procedure includes an authentication server function (AUSF) and the second credential is K AUSF .
13. The non-transitory computer readable storage media of claim 11 , wherein the first credential is further based on an identifier associated with the UE or other shared information between the UE and the cellular network.
14. The non-transitory computer readable storage media of claim 11 , wherein the server associated with the edge data network is an edge configuration server (ECS).