Routing indicator retrival for AKMA
A method for an authentication server function, AUSF, of a communication network is provided. The method comprises sending a second authentication request comprising a first identifier associated with a user equipment, UE, or a second identifier associated with the UE, receiving a response to the second authentication request, and when the response comprises an 5 authentication and key management for applications, AKMA, indicator: determining a first security key identifier based on a first field comprised in the response.
1 . A method performed by an authentication server function, AUSF, of a communication network, the method comprising:
sending an authentication request comprising a subscription permanent identifier, SUPI, of a user equipment, UE;
receiving a response to the authentication request, the response comprising an authentication and key management for applications, AKMA, indicator and a routing indicator associated with a home network of the UE; and
responsive to the AKMA indicator comprised in the response:
determining an anchor key, K AKMA , for AKMA key material generation; and
determining a key identifier, A-KID, of the anchor key, K AKMA , based on the routing indicator associated with the home network of the UE comprised in the response.
2 . The method according to claim 1 , further comprising:
sending, to an anchor function for authentication and key management for applications, AAnF, a message including the anchor key, K AKMA , and the key identifier, A-KID.
3 . The method according to claim 2 , wherein the message further includes the SUPI of the UE.
4 . The method according to claim 1 , wherein the authentication request is sent to a unified data management function, UDM, of the communication network, and wherein the response to the authentication request is received from the UDM.
5 . A method performed by a unified data management function, UDM, of a communication network, the method comprising:
receiving, from an authentication server function, AUSF, of the communication network, an authentication request for a user equipment, UE, that includes a subscription permanent identifier, SUPI, of the UE;
obtaining a routing indicator associated with a home network of the UE; and
sending an authentication and key management for applications, AKMA, indicator and the routing indicator associated with the home network of the UE to the AUSF in response to the authentication request.
6 . The method according to claim 5 , wherein obtaining the routing indicator associated with the home network of the UE comprises one of the following:
retrieving a stored version of the routing indicator associated with the home network of the UE from UE subscription data or from a previous successful authentication of the UE; or
performing a de-concealment operation on the SUPI of the UE to generate a subscription concealed identifier, SUCI, of the UE, the SUCI of the UE comprising the routing indicator associated with the home network of the UE.
7 . A network node for implementing an authentication server function, AUSF, of a communication network, the network node comprising:
processing circuitry configured to cause the network node to:
send an authentication request comprising a subscription permanent identifier, SUPI, of a user equipment, UE;
receive a response to the authentication request, the response comprising an authentication and key management for applications, AKMA, indicator and a routing indicator associated with a home network of the UE; and
responsive to the response to the AKMA indicator comprised in the response:
determine an anchor key, KAKMA, for AKMA key material generation; and
determine a key identifier, A-KID, of the anchor key, K AKMA , based on the routing indicator associated with the home network of the UE comprised in the response.
8 . The network node for implementing the AUSF according to claim 7 , wherein the processing circuitry is further configured to cause the network node to:
send, to an anchor function for authentication and key management for applications, AAnF, a message including the anchor key, KAKMA, and the key identifier, A-KID.
9 . The network node for implementing the AUSF according to claim 8 , wherein the message further includes the SUPI of the UE.
10 . The network node for implementing the AUSF according to claim 7 , wherein the authentication request is sent to a unified data management function, UDM, of the communication network, and wherein the response to the second authentication request is received from the UDM.
11 . A network node for implementing a unified data management function, UDM, of a communication network, the network node comprising:
processing circuitry configured to cause the network node to:
receive, from an authentication server function, AUSF, of the communication network, an authentication request for a user equipment, UE, that includes a subscription permanent identifier, SUPI, of the UE;
obtain a routing indicator associated with a home network of the UE; and
send an authentication and key management for applications, AKMA, indicator and the routing indicator associated with the home network of the UE to the AUSF in response to the authentication request.
12 . The network node for implementing the UDM of claim 11 , wherein obtaining the routing indicator associated with the home network of the UE comprises one of the following:
retrieving a stored version of the routing indicator associated with the home network of the UE from UE subscription data or from a previous successful authentication of the UE; or
performing a de-concealment operation on the SUPI of the UE to generate a subscription concealed identifier, SUCI, of the UE, the SUCI of the UE comprising the routing indicator associated with the home network of the UE.