KR20210095435A - Apparatus and method for performing authentication in wireless communication system - Google Patents

Abstract

The present disclosure relates to a method and apparatus for performing authentication in a wireless communications system. A network entity in accordance with an embodiment of the present disclosure transmits a message including a network slice authentication result performed based on identification information received from UE, sets a backoff timer of the network entity, and transmits a configuration update command or deregistration message to the UE after the set backoff timer expires. The message including the network slice authentication result includes information on a backoff timer value, a cause of authentication failure, and at least one of allowed NSSAI from authentication success and rejected NSSI from authentication failure. In the UE having received the message including the network slice authentication result, a backoff timer in accordance with the backoff timer value transmitted to the UE may be set.

Description

Device and method for performing authentication in a wireless communication system {Apparatus and method for performing authentication in wireless communication system}

The present disclosure relates to an apparatus and method for authentication in a wireless communication system. Specifically, the present disclosure relates to a NAS processing method and apparatus for authentication in an environment in which a UE uses a network slice.

Efforts are being made to develop a 5G communication system or a pre-5G communication system to meet the increasing demand for wireless data traffic after commercialization of the 4G communication system. For this reason, the 5G communication system or the pre-5G communication system is called a system after the 4G network (Beyond 4G Network) communication system or the LTE system after (Post LTE).

The 5G communication system defined by 3GPP is called the New Radio (NR) system. In order to achieve high data rates, 5G communication systems are considering transmitting and receiving radio waves in an ultra-high frequency (mmWave) band (eg, a 60 gigabyte (60 GHz) band). In order to alleviate the path loss of radio waves and increase the propagation distance of radio waves in the ultra-high frequency band, beamforming, massive MIMO, Full Dimensional MIMO (FD-MIMO), and array antenna (array antenna), analog beam-forming (analog beam-forming), and large-scale antenna (large scale antenna) techniques are applied to radio wave transmission and reception.

In addition, for network improvement of the system, in the 5G communication system, an evolved small cell, an advanced small cell, a cloud radio access network (cloud RAN), and an ultra-dense network (ultra-dense network) , Device to Device communication (D2D), wireless backhaul, moving network, cooperative communication, Coordinated Multi-Points (CoMP), and interference cancellation Technology development is underway. In addition, in the 5G system, advanced coding modulation (ACM) methods such as FQAM (Hybrid FSK and QAM Modulation) and SWSC (Sliding Window Superposition Coding), and advanced access technologies such as Filter Bank Multi Carrier (FBMC), NOMA (non-orthogonal multiple access), and sparse code multiple access (SCMA) are being developed.

As various technologies can be applied according to the above-mentioned and the development of the wireless communication system, a method for efficiently managing the wireless communication system through these various technologies is required. The present disclosure relates to an apparatus and method for authentication in an environment in which a UE uses a network slice for efficient management of a wireless communication system.

The present disclosure relates to an apparatus and method for performing authentication in a wireless communication system.

The network entity according to an embodiment of the present disclosure transmits a message including a network slice authentication result performed based on the identification information received from the UE to the UE, sets a backoff timer of the network entity, and the set backoff timer is After expiration, a configuration update command or de-registration message is sent to the UE, and the message including the network slice authentication result includes the backoff timer value, the cause of the authentication failure, the NSSAI that allows the connection with authentication success, or the connection due to authentication failure. Information on at least one of NSSAI that is not allowed is included, and a backoff timer according to the value of the backoff timer transmitted to the UE may be set in the UE receiving the message including the network slice authentication result.

According to an embodiment of the present disclosure, authentication can be efficiently performed in a wireless communication system.

1 is a diagram for explaining the structure of a wireless communication system according to an embodiment of the present disclosure.
2 is a flowchart illustrating a procedure for performing authentication and communication using a NAS message in a 5G network environment according to an embodiment of the present disclosure.
3 is a flowchart illustrating a procedure for performing authentication and communication using a NAS message in a 5G network environment according to an embodiment of the present disclosure.
4 is a diagram illustrating a configuration of a UE according to an embodiment of the present disclosure.
5 is a diagram illustrating a configuration of a network entity according to an embodiment of the present disclosure.

Hereinafter, embodiments of the present disclosure will be described in detail with reference to the accompanying drawings. In describing the embodiments, descriptions of technical contents that are well known in the technical field to which the present disclosure pertains and are not directly related to the present disclosure will be omitted. This is to more clearly convey the gist of the present disclosure without obscuring the gist of the present disclosure by omitting unnecessary description.

For the same reason, some components are exaggerated, omitted, or schematically illustrated in the accompanying drawings. In addition, the size of each component does not fully reflect the actual size. The same reference numerals are assigned to the same or corresponding elements in each figure.

Advantages and features of the present disclosure, and methods for achieving them, will become apparent with reference to the embodiments described below in detail in conjunction with the accompanying drawings. However, the present disclosure is not limited to the embodiments disclosed below, but may be implemented in various different forms, and only the present embodiments allow the disclosure of the present disclosure to be complete, and common knowledge in the art to which the present disclosure belongs It is provided to fully inform those who have the scope of the invention, and the present disclosure is only defined by the scope of the claims. Like reference numerals refer to like elements throughout.

At this time, it will be understood that each block of the flowchart diagrams and combinations of the flowchart diagrams may be performed by computer program instructions.

Additionally, each block may represent a module, segment, or portion of code that includes one or more executable instructions for executing specified logical function(s). It should also be noted that in some alternative implementations it is also possible for the functions recited in blocks to occur out of order. For example, two blocks shown one after another may in fact be performed substantially simultaneously, or it is possible that the blocks are sometimes performed in the reverse order according to the corresponding function.

In this case, the term '~ unit' used in this embodiment means software or hardware components such as FPGA (Field Programmable Gate Array) or ASIC (Application Specific Integrated Circuit), and '~ unit' performs certain roles do. However, '-part' is not limited to software or hardware. The '~ unit' may be configured to reside on an addressable storage medium or may be configured to refresh one or more processors. Thus, as an example, '~' denotes components such as software components, object-oriented software components, class components, and task components, and processes, functions, properties, and procedures. , subroutines, segments of program code, drivers, firmware, microcode, circuitry, data, databases, data structures, tables, arrays, and variables. The functions provided in the components and '~ units' may be combined into a smaller number of components and '~ units' or further separated into additional components and '~ units'. In addition, components and '~ units' may be implemented to play one or more CPUs in a device or secure multimedia card. Also, in an embodiment, '~ unit' may include one or more processors.

A term for identifying an access node used in the following description, a term referring to network entities or a term referring to network functions, a term referring to messages, a term referring to an interface between network objects, Terms and the like referring to various pieces of identification information are exemplified for convenience of description. Accordingly, the present disclosure is not limited to the terms described below, and other terms referring to objects having equivalent technical meanings may be used.

For convenience of description, the present disclosure uses terms and names defined in 3GPP LTE (3rd Generation Partnership Project Long Term Evolution) standard, or terms and names modified based on the terms and names. However, the present disclosure is not limited by the above-described terms and names, and may be equally applied to systems conforming to other standards. In the present disclosure, eNB may be used interchangeably with gNB for convenience of description. That is, a base station described as an eNB may represent a gNB. In the present disclosure, the term terminal may refer to a mobile phone, NB-IoT devices, sensors, as well as various wireless communication devices.

That is, in describing the embodiments of the present disclosure in detail, the 3GPP will mainly target the communication standards set by the standards, but the main gist of the present disclosure is to greatly expand the scope of the present disclosure to other communication systems having similar technical backgrounds. It can be applied with some modifications within the scope not departing from, which will be possible at the judgment of a person skilled in the art of the present disclosure.

In the 5G or NR system, an Access and Mobility Management Function (AMF), which is a management entity that manages the mobility of a terminal, and a Session Management Function (SMF), an entity that manages a session, are separated. Due to this, unlike the MME (Mobility Management Entity) performing mobility management and session management together in the 4G LTE communication system, in the 5G or NR system, as the entity performing mobility management and session management is separated, the terminal and the network entity A communication method and a communication management method may be changed between each other.

In the 5G or NR system, when the terminal accesses the network through non 3GPP access, mobility management is performed through AMF through N3IWF (Non-3GPP Inter-Working Function), and session management is performed through SMF. (session management) may be performed. In addition, the AMF may process security-related information, which is an important element in mobility management.

As described above, in the 4G LTE system, the MME is in charge of both mobility management and session management. In the 5G or NR system, a non-standalone architecture for performing communication by using the network entity of the 4G LTE system together may be supported.

With 5G, the concept of a network slice was introduced. Network slicing is a technology that logically configures a network as a set of network elements (NFs) to support a specific service, and separates it from other slices. This is a concept introduced to more efficiently utilize the resources of the network, and may perform communication by finding appropriate resources in the network according to the communication performed by the UE. Meanwhile, in using such a network slice, authentication for a network slice is performed, and the present invention intends to prepare a method related to authentication of a network slice.

In the present disclosure, while the UE succeeds in registration and communicates with the network, network slice authentication is performed by the network, and authentication for such a network slice To provide a method for the operation of the UE and the network when the registration of the UE is rejected due to failure or authentication failure.

Through the present disclosure, a method and apparatus for efficiently performing authentication and communication using a NAS in an environment in which a terminal uses a network slice are provided.

1 is a diagram for explaining the structure of a wireless communication system according to an embodiment of the present disclosure.

1, 5G or NR core network (core network) is UPF (User Plane Function, 131), SMF (Session Management Function, 121), AMF (Access and Mobility Management Function, 111), 5G RAN (Radio Access) Network, 103), UDM (User Data Management, 151), PCF (Policy Control Function, 161), such as network functions (NF, Network Function) may be included.

In addition, for authentication of entities corresponding to each of these NFs, the 5G or NR core network may include entities such as AUSF (Authentication Server Function, 141), AAA (authentication, authorization and accounting, 171). there is.

When communicating through 3GPP access, UE (User Equipment, Terminal, 101-1) may access the 5G core network through a base station (5G RAN, Radio Access Network, basestation, BS, 103). On the other hand, when the UE 101-1 communicates through non 3GPP access, an N3 interworking function (N3IWF) exists, and session management is controlled through the UE, non 3GPP access, N3IWF, SMF, and mobility. For management (mobility management), it can be controlled through UE, non 3GPP access, N3IWF, and AMF. In the 5G or NR system, an entity performing mobility management and session management is AMF 111 . , SMF 121 can be separated. On the other hand, the 5G or NR system is a standalone deployment structure that communicates only with 5G or NR entities and a non-stand alone deployment structure that uses 4G entities and 5G or NR entities together. can support

As shown in Figure 1, when the UE communicates with the network (network), control (control) is performed by the eNB, the deployment (deployment) in the form of using the 5G entity of the core network (core network) may be possible there is. In this case, mobility management between the UE and the AMF and session management between the UE and the SMF may be performed in a layer 3, non-access stratum (NAS) layer. On the other hand, the layer 2 AS (Access Stratum) related message may be transmitted between the UE and the eNB.

Although the communication network on which the present disclosure is based assumes a network of 5G and 4G LTE, it can be applied if the same concept is applied to other systems within a range that can be understood by a person of ordinary skill in the art.

2 is a flowchart illustrating a procedure for performing authentication and communication using a NAS message in a 5G network environment according to an embodiment of the present disclosure.

In step 201, the UE is in a state of being registered with the network. That is, the UE transmits a registration request to the AMF and receives a message indicating registration accept, thereby performing communication.

As in step 211, the AMF may transmit a network slice specific authentication command message to the UE.

The network slice specific authentication command message may include at least one of information included in Table 1 as follows.

At this time, the AMF requests the UE to provide the identity (ID) required to perform the network slice authentication process, for example, a network access identifier (NAI) or identification (Identiy) information mapped to the NAI. can

For this, in one embodiment

The network slice specific authentication command message may include a container including an identity request message requesting identity information as shown in Table 1 below.

[Table 1] network slice specific authentication command

As in step 213, the UE may send a network slice specific authentication complete message to the AMF.

In this case, as shown in Table 2 or Table 3, the UE may provide identity-related information through AMF or network.

In this case, the UE may provide network identity, for example, NAI or mapping of NAI, which corresponds to identity information mapped with NAI, to the network.

Alternatively, as an embodiment, the UE may provide a container for a response message that provides identity to a network, for example, an identity response message.

[Table 2] network slice specific authentication complete message

[Table 3] network slice specific authentication complete message

Thereafter, the AMF may transfer the response received from the UE to the AAA via the AUSF, and may receive the authentication result to be transferred from the AAA to the UE via the AUSF.

As in step 215, the AMF may send a network slice-specific authentication result to the UE.

Upon receiving this message, the UE may set timer T35xx.

As in step 231, the UE may send a message indicating network slice-specific authentication complete to the AMF.

After that, the AMF forwards the response received from the UE to AAA via AUSF,

Receives authentication result from AAA through AUSF to UE.

As in step 241, the AMF may send a network slice-specific authentication result to the UE.

The AMF may send a network slice-specific authentication result message including at least one of the information included in Table 4 to the UE as follows.

The AMF may set the value of T35xx, which is a backoff timer for the UE, and transmit it to the UE. In addition, the AMF may transmit a cause value in order to inform the reason for the failure when the corresponding authentication (authentication) fails as an embodiment.

In addition, AMF may send allowed NSSAI or rejected NSSAI to provide information about allowed NSSAI for which authentication is allowed or information about rejected NSSAI for which authentication is not allowed.

[Table 4] network slice-specific authentication result message

In step 251, the UE may set a backoff timer T35xx.

In step 261, the AMF may set a backoff timer (backoff timer T 35yy).

AMF may send a configuration update command) message after timer T 35yy expires.

Therefore, the AMF should not send a configuration update command to the UE while the T35yy is running.

In step 271, the AMF may send a configuration update command to the UE.

The UE may update the configuration of the UE upon receiving a configuration update command.

3 is a flowchart illustrating a procedure for performing authentication and communication using a NAS message in a 5G network environment according to an embodiment of the present disclosure.

In step 301, the UE is in a state of being registered with the network (network). That is, the UE transmits a registration request to the AMF and receives a message indicating registration accept, thereby performing communication.

As in step 311, the AMF may transmit a network slice specific authentication command message to the UE.

The network slice specific authentication command message may include the following information.

At this time, the AMF may request the UE to provide an Identity (ID) required to perform a network slice authentication process, for example, NAI or identification information mapped to NAI.

For this, in one embodiment

The network slice specific authentication command message may include a container including an identity request message for requesting identity information as shown in Table 5 below.

[Table 5] network slice specific authentication command

As in step 313, the UE may send a network slice specific authentication complete message to the AMF.

In this case, as shown in Table 6 or Table 7, the UE may provide identity-related information through AMF or network.

In this case, the UE may provide network identity, for example, NAI or NAI and corresponding identity information mapped with NAI, ie, mapping of NAI to the network.

Alternatively, as an embodiment, the UE may provide a container for a response message that provides identity to a network, for example, an identity response message.

[Table 6] network slice specific authentication complete message

[Table 7] network slice specific authentication complete message

After that, the AMF forwards the response received from the UE to AAA via AUSF,

A result of authentication to be delivered to the UE through the AUSF can be received from the AAA.

As in step 315, the AMF may send a network slice-specific authentication result to the UE.

Upon receiving this message, the UE may set timer T35xx.

As in step 331, the UE may send a message indicating network slice-specific authentication complete to the AMF.

After that, the AMF forwards the response received from the UE to AAA via AUSF,

Receives the authentication result to be delivered to the UE through the AUSF from the AAA.

As in step 341, the AMF may send a network slice-specific authentication result to the UE.

The AMF may send a network slice-specific authentication result message including at least one of information included in Table 8 as follows to the UE.

The AMF may set the value of T35xx, which is a backoff timer for the UE, and transmit it to the UE. In addition, the AMF may transmit a cause value in order to inform the reason for the failure when the corresponding authentication (authentication) fails as an embodiment.

In addition, AMF can send allowed NSSAI or rejected NSSAI to provide information about allowed NSSAI for which authentication is allowed or information about rejected NSSAI for which authentication is not allowed.

[Table 8] network slice-specific authentication result message

In step 351, the UE may set a backoff timer T35xx.

In step 361, the AMF may set a backoff timer T 35yy.

After the AMF expires timer T 35yy, the network may send a DEREGISTRATION REQUEST message.

Therefore, AMF is activated while T35yy is running.

The AMF MUST NOT send a DEREGISTRATION REQUEST message to the UE.

In step 371, the AMF may send a DEREGISTRATION REQUEST message to the UE.

When the UE receives a DEREGISTRATION REQUEST message, it may perform a deregistration procedure.

4 is a diagram illustrating a configuration of a UE according to an embodiment of the present disclosure.

As shown in FIG. 4 , the UE of the present disclosure may include a transceiver 410 , a memory 420 , and a processor 430 . The processor 430 , the transceiver 410 , and the memory 420 of the UE may operate according to the above-described communication method of the UE. However, the components of the UE are not limited to the above-described examples. For example, the UE may include more or fewer components than the aforementioned components. In addition, the processor 430 , the transceiver 410 , and the memory 420 may be implemented in the form of a single chip.

The transmitter/receiver 410 collectively refers to a receiver of a UE and a transmitter of the UE, and may transmit/receive a signal to/from a base station or a network entity. A signal transmitted and received with the base station may include control information and data. To this end, the transceiver 410 may include an RF transmitter that up-converts and amplifies the frequency of a transmitted signal, and an RF receiver that low-noise amplifies and down-converts a received signal. However, this is only an embodiment of the transceiver 410 , and components of the transceiver 410 are not limited to the RF transmitter and the RF receiver.

In addition, the transceiver 410 may include a wired/wireless transceiver, and may include various components for transmitting and receiving signals.

In addition, the transceiver 410 may receive a signal through a wireless channel, output it to the processor 430 , and transmit the signal output from the processor 430 through a wireless channel.

Also, the transceiver 410 may receive a communication signal and output it to the processor, and transmit the signal output from the processor to a network entity through a wired/wireless network.

The memory 420 may store programs and data necessary for the operation of the UE. Also, the memory 420 may store control information or data included in a signal obtained from the UE. The memory 420 may be configured as a storage medium or a combination of storage media such as ROM, RAM, hard disk, CD-ROM, and DVD.

The processor 430 may control a series of processes so that the UE can operate according to the above-described embodiment of the present disclosure. The processor 430 may include at least one or more processors. For example, the processor 430 may include a communication processor (CP) that controls for communication and an application processor (AP) that controls an upper layer such as an application program.

5 is a diagram illustrating a configuration of a network entity according to an embodiment of the present disclosure.

As shown in FIG. 5 , the network entity of the present disclosure may include a transceiver 510 , a memory 520 , and a processor 530 . According to the above-described communication method of the network entity, the processor 530 , the transceiver 510 , and the memory 520 of the network entity may operate. However, the components of the network entity are not limited to the above-described example. For example, the network entity may include more or fewer components than the aforementioned components. In addition, the processor 530 , the transceiver 510 , and the memory 520 may be implemented in the form of a single chip. The network entity is, as described above, AMF (Access and Mobility management Function), SMF Session Management Function), PCF (Policy and Charging Function), NEF (Network Exposure Function), UDM (Unified Data Management), UPF (User Plane Function), etc. may include a network function (NF, Network Function) of In addition, it may include a base station (base station).

The transceiver 510 collectively refers to a receiver of a network entity and a transmitter of a network entity, and may transmit/receive a signal to and from a UE or other network entity. In this case, the transmitted/received signal may include control information and data. To this end, the transceiver 510 may include an RF transmitter that up-converts and amplifies a frequency of a transmitted signal, and an RF receiver that low-noise amplifies and down-converts a received signal. However, this is only an embodiment of the transceiver 510 , and components of the transceiver 510 are not limited to the RF transmitter and the RF receiver. The transceiver 510 may include a wired/wireless transceiver, and may include various components for transmitting and receiving signals.

In addition, the transceiver 510 may receive a signal through a communication channel (eg, a wireless channel) and output it to the processor 530 , and transmit the signal output from the processor 530 through the communication channel.

In addition, the transceiver 510 may receive a communication signal and output it to the processor, and transmit the signal output from the processor to the UE or a network entity through a wired/wireless network.

The memory 520 may store programs and data necessary for the operation of the network entity. Also, the memory 520 may store control information or data included in a signal obtained from a network entity. The memory 520 may be configured as a storage medium or a combination of storage media such as ROM, RAM, hard disk, CD-ROM, and DVD.

The processor 530 may control a series of processes so that the network entity operates according to the above-described embodiment of the present disclosure. The processor 530 may include at least one or more processors. Methods according to the embodiments described in the claims or specifications of the present disclosure may be implemented in the form of hardware, software, or a combination of hardware and software.

When implemented in software, a computer-readable storage medium storing one or more programs (software modules) may be provided. One or more programs stored in the computer-readable storage medium are configured for execution by one or more processors in an electronic device (device). One or more programs include instructions for causing an electronic device to execute methods according to embodiments described in a claim or specification of the present disclosure.

Such programs (software modules, software) include random access memory, non-volatile memory including flash memory, read only memory (ROM), electrically erasable programmable ROM (electrically erasable programmable read only memory, EEPROM), magnetic disc storage device, compact disc-ROM (CD-ROM), digital versatile discs (DVDs), or other It may be stored in an optical storage device or a magnetic cassette. Alternatively, it may be stored in a memory composed of a combination of some or all thereof. In addition, each configuration memory may be included in plurality.

In addition, the program is transmitted through a communication network consisting of a communication network such as the Internet, an intranet, a local area network (LAN), a wide area network (WAN), or a storage area network (SAN), or a combination thereof. It may be stored on an attachable storage device that can be accessed. Such a storage device may be connected to a device implementing an embodiment of the present disclosure through an external port. In addition, a separate storage device on the communication network may be connected to the device implementing the embodiment of the present disclosure.

In the specific embodiments of the present disclosure described above, components included in the disclosure are expressed in the singular or plural according to the specific embodiments presented. However, the singular or plural expression is appropriately selected for the context presented for convenience of description, and the present disclosure is not limited to the singular or plural element, and even if the element is expressed in plural, it is composed of the singular or singular. Even an expressed component may be composed of a plurality of components.

Meanwhile, although specific embodiments have been described in the detailed description of the present disclosure, various modifications are possible without departing from the scope of the present disclosure. Therefore, the scope of the present disclosure should not be limited to the described embodiments and should be defined by the claims described below as well as the claims and equivalents.

Claims (1)

A method for a network entity to perform authentication in a wireless communication system, the method comprising:
transmitting a message including a result of network slice authentication performed based on identification information received from the UE to the UE; setting a backoff timer of the network entity; and
after the set backoff timer expires, sending a configuration update command or deregistration message to the UE;
The message including the network slice authentication result includes information on at least one of a backoff timer value, a cause of authentication failure, an NSSAI that allows access due to authentication success or an NSSAI that does not allow access due to authentication failure,
A backoff timer according to the value of the backoff timer transmitted to the UE is set to the UE receiving the message including the network slice authentication result.

Images