# US 12,003,494 B2 · Network slice authentication > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,003,494 B2 - Document ID: US12003494B2 - Status: Granted - Kind: B2 - Application number: 17/422,767 - Filed: 2019-01-21 - Published: 2022-03-03 - Granted: 2024-06-04 - Earliest claimed: 2019-01-21 - Assignees: Telefonaktiebolaget LM Ericsson (publ) - Applicants: Telefonaktiebolaget LM Ericsson (publ) - Inventors: Noamen Ben Henda; Monica Wifvesson - Web page: https://patentgrep.com/patent/US12003494B2 ## CPC - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04W 12/06: Authentication - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04W 12/041: Key generation or derivation - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Arrangements for network slice isolation. A method is performed by a terminal device. The method includes determining to shift from accessing a first service using a current network slice to accessing a second service using a target network slice. Network access to the current network slice is handled by a source Access Management Function. Network access to the target network slice is handled by a target Access Management Function. The method includes performing a slice authentication procedure in response thereto. During the authentication procedure a mutual secret is shared between the terminal device and the target Access Management Function. The method includes creating a security context for the target network slice based on the mutual secret. The method includes activating the security context, thereby security isolating the target network slice from the source Access Management Function. ## Claims ### Claim 1 A method for network slice isolation, the method being performed by a terminal device, the method comprising: determining, by the terminal device, to shift from accessing a first service using a current network slice to accessing a second service using a target network slice, network access to the current network slice being handled by a source Access Management Function (AMF) currently serving the terminal device, and network access to the target network slice being handled by another target AMF that is separate from the source AMF; in response to a determination by the terminal device to shift from the source AMF to the target AMF to access the second service using the target network slice handled by the target AMF, performing, by the terminal device, a slice authentication procedure that includes sharing a mutual secret between the terminal device and the target AMF; creating, by the terminal device, a security context for the target network slice based on the mutual secret; and activating, by the terminal device, the security context, thereby security isolating the target network slice from the source AMF. ### Claim 2 (depends on 1) The method according to claim 1, further comprising: obtaining, by the terminal device, an indication that that the security context has been activated by the target AMF, wherein the security context is created in response thereto to an activation of the security context by the target AMF. ### Claim 3 (depends on 2) The method according to claim 2, wherein the indication is obtained in a non-access stratum, NAS, security mode, SM, command message. ### Claim 4 (depends on 1) The method according to claim 1, further comprising: providing, by the terminal device, an indication to the target AMF that the security context has been activated. ### Claim 5 (depends on 4) The method according to claim 4, wherein the indication is provided in a non-access stratum, NAS, security mode, SM, complete message. ### Claim 6 (depends on 1) The method according to claim 1, wherein the slice authentication procedure is performed with the target AMF. ### Claim 7 (depends on 1) The method according to claim 1, wherein the slice authentication procedure is performed with the source AMF. ### Claim 8 A method for network slice isolation, the method being performed by a target Access Management Function (AMF), the method comprising: obtaining, by the target AMF, an indication that a terminal device has determined to shift from accessing a first service using a current network slice to accessing a second service using a target network slice, network access to the current network slice being handled by another source AMF currently serving the terminal device, and network access to the target network slice being handled by the target AMF that is separate from the source AMF; obtaining, by the target AMF, as an output from a slice authentication procedure, a mutual secret that is shared between the terminal device and the target AMF, the slice authentication procedure having been performed with the terminal device; and activating, by the target AMF, a created security context for the target network slice based on the mutual secret, thereby security isolating the target network slice from the source AMF. ### Claim 9 (depends on 8) The method according to claim 8, further comprising: providing, by the target AMF, an indication to the terminal device that the created security context has been activated by the target Access Management Function AMF based on the mutual secret. ### Claim 10 (depends on 9) The method according to claim 9, wherein the indication is provided in a non-access stratum, NAS, security mode, SM, command message. ### Claim 11 (depends on 8) The method according to claim 8, further comprising: obtaining, by the target AMF, an indication from the terminal device that the security context as created by the terminal device has been activated by the terminal device. ### Claim 12 (depends on 11) The method according to claim 11, wherein the indication is obtained in a non-access stratum, NAS, security mode, SM, complete message. ### Claim 13 (depends on 8) The method according to claim 8, further comprising: creating, by the target AMF, the security context for the target network slice based on the mutual secret. ### Claim 14 (depends on 8) The method according to claim 8, wherein the security context has been created by the source AMF. ### Claim 15 (depends on 8) The method according to claim 8, wherein the slice authentication procedure is performed between the terminal device and the target AMF. ### Claim 16 (depends on 8) The method according to claim 8, wherein the slice authentication procedure is performed between the terminal device and the source AMF, and wherein the mutual secret is obtained from the source AMF. ### Claim 17 (depends on 8) The method according to claim 8, wherein the slice authentication procedure is performed between the terminal device and a Session Management Function (SMF) of the target network slice, and wherein the mutual secret is obtained from the SMF. ### Claim 18 (depends on 17) The method according to claim 17, further comprising: providing, by the target AMF, a request message to the SMF to perform the slice authentication procedure with the terminal device. ### Claim 19 A terminal device for network slice isolation, the terminal device comprising processing circuitry, the processing circuitry being configured to: cause the terminal device to: shift from accessing a first service using a current network slice to accessing a second service using a target network slice, network access to the current network slice being handled by a source Access Management Function (AMF) currently serving the terminal device, and network access to the target network slice being handled by another target AMF that is separate from the source AMF; in response to a determination by the terminal device to shift from the source AMF to the target AMF to access the second service using the target network slice handled by the target AMF, perform a slice authentication procedure that includes sharing a mutual secret between the terminal device and the target AMF; create a security context for the target network slice based on the mutual secret; and activate the security context, thereby security isolating the target network slice from the source AMF. ### Claim 20 An Access Management Function (AMF) for network slice isolation, the AMF acting as a target AMF and comprising processing circuitry, the processing circuitry being configured to: cause the target AMF to: obtain an indication that a terminal device has determined to shift from accessing a first service using a current network slice to accessing a second service using a target network slice, network access to the current network slice being handled by another source AMF currently serving the terminal device, and network access to the target network slice being handled by the target AMF; obtain, as an output from a slice authentication procedure, a mutual secret that is shared between the terminal device and the target AMF, the slice authentication procedure having been performed with the terminal device; and activate a created security context for the target network slice based on the mutual secret, thereby security isolating the target network slice from the source AMF.