Indication of provisioning protocol for credentials to access a non-public network
A method for a user equipment (UE) to obtain security credentials for accessing a non-public network (NPN) is provided. The method comprises sending, to an onboarding network (ON), a registration request that includes an identifier of the UE, and obtaining an indication of a credential provisioning protocol (CPP) used by a provisioning server (PS) for provisioning security credentials to access the NPN. The method further comprises obtaining, from the PS via the ON using the indicated CPP, security credentials for the UE to access the NPN.
1 . A method for a user equipment (UE) to obtain security credentials for accessing a non-public network (NPN), the method comprising:
sending, to an onboarding network (ON), a registration request that includes an identifier of the UE;
obtaining an indication of a credential provisioning protocol (CPP) used by a provisioning server (PS) for provisioning security credentials to access the NPN; and
obtaining security credentials for the UE to access the NPN, wherein the security credentials are obtained from the PS via the ON using the indicated CPP.
2 . The method of any of claim 1 , wherein:
the registration request includes an indication of one or more UE-supported CPPs; and
the indicated CPP is one of the UE-supported CPPs.
3 . The method of claim 1 , wherein obtaining the indication of a CPP used by the PS includes receiving an indication of a PS-supported CPP from the PS or from a default credential server (DCS).
4 . The method according to claim 1 , wherein the DCS comprises an authentication, authorization, and accounting (AAA) server.
5 . The method of claim 1 , wherein the obtained indication is integrity-protected based on one of the following:
key material known to the UE and to a default credential server (DCS),
key material known to the UE and to the PS, or
key material known to the UE and to the ON.
6 . The method of claim 1 , wherein the indication of the CPP used by the PS is obtained from the ON.
7 . The method of claim 6 , wherein the indication of the CPP used by the PS is obtained from the ON in one of the following:
a message in a non-access stratum security mode command (NAS SMC) procedure; or
a registration accept that is responsive to the registration request.
8 . The method of claim 1 , wherein the indication of the CPP used by the PS is obtained from the PS.
9 . The method of claim 8 , wherein obtaining the indication of the CPP used by the PS comprises:
after registration with the ON, sending to the PS a request for security credentials for the UE to access the NPN; and
receiving the indication in response to the request.
10 . The method of claim 1 , wherein the indicated CPP is one of the following: CMPv2, ACME, EST, SCEP, GSMA eSIM, or OMA LwM2M.
11 . The method of claim 1 , wherein the indication of the CPP used by the PS includes an indication of whether the CPP is performed via control plane communications with the UE or via user plane communications with the UE.
12 . A method for a default credential server (DCS) to facilitate provisioning of security credentials for a user equipment (UE) to access a non-public network (NPN), the method comprising:
receiving, from an onboarding network (ON), an authentication request that includes an identifier of the UE;
performing a primary authentication with the UE via the ON, using an authentication method based on the identifier of the UE;
determining a credential provisioning protocol (CPP) used by a provisioning server (PS) for provisioning security credentials to access the NPN; and
sending to the ON an indication of the CPP used by the PS.
13 . A method for a provisioning server (PS) for a non-public network (NPN) to facilitate user equipment (UE) access to the NPN, the method comprising:
determining a credential provisioning protocol (CPP) to be used by the PS for provisioning security credentials for the UE to access the NPN;
sending to the UE an indication of the CPP to be used by the PS; and
providing security credentials for the UE to access the NPN, wherein the security credentials are provided to the UE via an onboarding network (ON) using the indicated CPP.
14 . A user equipment (UE) configured to obtain security credentials for accessing a non-public network (NPN), the UE comprising:
radio interface circuitry configured to communicate with an onboarding network (ON) and the NPN; and
processing circuitry operably coupled to the radio interface circuitry, whereby the processing circuitry and radio interface circuitry are configured to perform operations corresponding to method of claim 1 .
15 . A non-transitory, computer-readable medium storing computer-executable instructions that, when executed by processing circuitry of a user equipment (UE) configured to obtain security credentials for accessing a non-public network (NPN), configure the UE to perform operations corresponding to the method of claim 1 .
16 . A default credential server (DCS) configured to facilitate provisioning of security credentials for a user equipment (UE) to access a non-public network (NPN), the DCS comprising:
interface circuitry configured to communicate at least win an onboarding network (ON) and the UE; and
processing circuitry operably coupled to the interface circuitry, wherein the processing circuitry and the interface circuitry are configured to perform operations corresponding to the method of claim 12 .
17 . A non-transitory, computer-readable medium storing computer-executable instructions that, when executed by processing circuitry of a default credential server (DCS) configured to facilitate provisioning of security credentials for a user equipment (UE) to access a non-public network (NPN), configure the DCS to perform operations corresponding to the method of claim 12 .
18 . A provisioning server (PS) configured to facilitate user equipment (UE) access to a non-public network (NPN), the DCS comprising:
interface circuitry configured to communicate with at least an onboarding network (ON) and the UE; and
processing circuitry operably coupled to the interface circuitry, wherein the processing circuitry and the interface circuitry are configured to perform operations corresponding to the method of claim 13 .
19 . A non-transitory, computer-readable medium storing computer-executable instructions that, when executed by processing circuitry of a provisioning server (PS) configured to facilitate user equipment (UE) access to a non-public network (NPN), configure the PS to perform operations corresponding to the method of claim 13 .