Method and apparatus for UE and application function session protection for model transfer
In accordance with an example embodiment, a UE performs maintaining an AKMA, context including a UE identifier, an AKMA anchor key KAKMA, and a primary AKMA key identifier, A-KID; receiving from an application function, AF, a secondary AKMA key identifier, A-KID′; and validating the AF for the UE using the AKMA key identifier A-KID. The validating includes: obtaining from the secondary AKMA key identifier A-KID′ an AKMA temporary UE identifier A-TID; and verifying whether the A-TID was included in the primary AKMA key identifier A-KID. If the verifying is positive, then the UE establishes an application session with the AF; and receives an artificial intelligence, AI, model from the AF; or otherwise rejects the application session with the AF.
1 . A user equipment (UE) comprising:
at least one processor; and
at least one memory storing instructions that, when executed by the at least one processor, cause the UE at least to perform:
maintaining an authentication and key management for applications, AKMA, context including a UE identifier, an AKMA anchor key K AKMA , and a primary AKMA key identifier (A-KID), wherein the primary A-KID is in a Network Access Identifier (NAI) format that includes an AKMA temporary UE identifier (A-TID);
receiving from an application function (AF) a secondary AKMA key identifier (A-KID′) in an application session establishment request received over an application-specific network application function interface (Ua*);
validating the AF for the UE using the AKMA key identifier A-KID, the validating comprising:
obtaining from the secondary AKMA key identifier A-KID′ an AKMA temporary UE identifier A-TID; and
verifying whether the A-TID was included in the primary AKMA key identifier A-KID; and
if the verifying is positive, then
establishing an application session with the AF; and
receiving an artificial intelligence, AI, model from the AF; or
otherwise rejecting the application session with the AF,
wherein the validating comprises obtaining a secondary AKMA key identifier A-KID′ from a non-access stratum (NAS) wherein the secondary AKMA key identifier A-KID′ includes an AF identifier that identifies the AF, wherein the secondary AKMA key identifier A-KID′ is obtained from a session establishment request sent by the AF to the UE;
performing authentication and key management for applications (AKMA) based on 3GPP credentials in the 5G system (5GS);
using an AKMA application key K AF derived from the AKMA anchor key (KAKMA), in encryption or decryption of data exchanged in the application session; and
authenticating the UE to a home network operator and responsively obtaining the AKMA context prior to the maintaining of the AKMA context.