Method and apparatus for UE authentication for remote provisioning
The disclosure relates to a communication method and system for converging a 5th-Generation (5G) communication system for supporting higher data rates beyond a 4th-Generation (4G) system with a technology for Internet of Things (IoT). A method is provided for operating a terminal in a wireless network, including configuring a restricted packet data unit session with a provisioning server (PVS); transmitting a remote provisioning request message including a subscription permanent identifier to the PVS; and receiving a remote provisioning response message in response to the remote provisioning request message. The remote provisioning response message includes standalone non-public network credentials and subscription data of a terminal in case that a remote provisioning for the terminal is approved.
1. A method for operating a terminal in a wireless network, the method comprising:
configuring a restricted packet data unit (PDU) session with a provisioning server (PVS);
transmitting a remote provisioning request message including a subscription permanent identifier (SUPI) to the PVS; and
receiving a remote provisioning response message in response to the remote provisioning request message,
wherein the remote provisioning response message includes standalone non-public network (SNPN) credentials and subscription data of a terminal in case that remote provisioning for the terminal is approved,
wherein the remote provisioning response message is determined based on an authentication response message received from a default credentials server (DCS),
wherein the DCS is selected by the PVS based on the SUPI,
wherein an authentication request message is transmitted after mutual authentication between the PVS and the DCS is performed, and
wherein the authentication response message is transmitted in response to the authentication request message transmitted from the PVS to the DCS based on the SUPI.
2. The method of claim 1 , wherein the DCS is selected by the PVS based on a realm part of the SUPI.
3. The method of claim 1 , wherein the remote provisioning response message includes a terminal authentication result indicating authentication failure for the terminal in case that the remote provisioning for the terminal is not approved.
4. A method for operating a provisioning server (PVS) in a wireless network, the method comprising:
configuring a restricted packet data unit (PDU) session with a terminal;
receiving a remote provisioning request message including a subscription permanent identifier (SUPI) from the terminal;
selecting a default credentials server (DCS), based on the SUPI;
performing mutual authentication with the DCS;
transmitting an authentication request message to the DCS including the SUPI after performing the mutual authentication;
receiving an authentication response message including a terminal authentication result from the DCS;
transmitting a remote provisioning response message to the terminal in response to the remote provisioning request message,
wherein the remote provisioning response message includes standalone non-public network (SNPN) credentials and subscription data of the terminal in case that remote provisioning for the terminal is approved, and
wherein the remote provisioning response message is determined based on the authentication response message.
5. The method of claim 4 , wherein the DCS is selected based on a realm part of the SUPI.
6. The method of claim 4 , wherein the remote provisioning response message includes a terminal authentication result indicating authentication failure for the terminal in case that the remote provisioning for the terminal is not approved.
7. A method for operating a default credentials server (DCS) in a wireless network, the method comprising:
performing mutual authentication with a provisioning server (PVS);
receiving an authentication request message including a subscription permanent identifier (SUPI) from the PVS; and
transmitting an authentication response message including an authentication result to the PVS in response to the authentication request message,
wherein the authentication request message is transmitted based on a remote provisioning request message received from a terminal, and the authentication response message includes standalone non-public network (SNPN) credentials and subscription data of the terminal in case that the authentication result indicates authentication success, and
wherein the mutual authentication is performed after the PVS selects the DCS based on a realm part of the SUPI.
8. The method of claim 7 , wherein a remote provisioning response message received in response to the remote provisioning request message includes a terminal authentication result indicating authentication failure for the terminal in case that remote provisioning for the terminal is not approved.