Method for authentication for NSWO service, device, and storage medium

A method of authentication for a non-seamless wireless local area network offload (NSWO) service, comprising:

• receiving a second authentication request message from an authentication server function, wherein the second authentication request message comprises a subscription concealed identifier (SUCI) and fifth NSWO indication information, and the fifth NSWO indication information indicates to perform authentication for the NSWO service;
• calculating a subscription permanent identifier (SUPI) based on the SUCI;
• determining, based on the second authentication request message, to use an extensible authentication protocol-authentication and key agreement (EAP-AKA′) authentication method;
• obtaining a first EAP-AKA′ authentication vector based on the SUPI;
• and
• sending a second authentication response message to the authentication server function, wherein the second authentication response message comprises a second EAP-AKA′ authentication vector, and the second EAP-AKA′ authentication vector is associated with the first EAP-AKA′ authentication vector.

A method of authentication for a non-seamless wireless local area network offload (NSWO) service, comprising:

• after determining to perform the NSWO service, sending a subscription concealed identifier (SUCI) of a terminal device to an access network device, wherein the SUCI is used to determine an address of an NSWO network element;
• receiving a third authentication request message that is from the NSWO network element via the access network device, wherein the third authentication request message is an authentication request message corresponding to an extensible authentication protocol-authentication and key agreement EAP-AKA′ authentication algorithm;
• performing authentication verification on a network by using the EAP-AKA′ authentication algorithm;
• after the authentication verification succeeds, calculating RES;
• and
• sending the RES to the NSWO network element via the access network device, wherein the RES is used to perform authentication on the terminal device, wherein after the authentication verification succeeds, the method further comprises:
• calculating a key CK′ and a key IK′, and forgoing calculating a key KAUSF, wherein the key KAUSF is calculated based on the key CK′ and the key IK′.

A communication apparatus, comprising at least one processor and at least one memory, wherein the at least one memory is configured to store instructions, and the at least one processor is configured to execute the instructions thereby causing the communication apparatus to:

• after determining to perform a non-seamless wireless local area network offload (NSWO) service, send a subscription concealed identifier (SUCI) of the communication apparatus to an access network device, wherein the SUCI is used to determine an address of an NSWO network element;
• receive a third authentication request message from the NSWO network element via the access network device, wherein the third authentication request message is an authentication request message corresponding to an extensible authentication protocol-authentication and key agreement (EAP-AKA′) authentication algorithm;
• and
• perform authentication verification on a network by using the EAP-AKA′ authentication algorithm;
• after the authentication verification succeeds, calculate RES;
• and
• send the RES to the NSWO network element via the access network device, wherein the RES is used to perform authentication on the communication apparatus, wherein the at least one processor being further configured to further execute the instructions thereby further causing the communication apparatus to:
• after the authentication verification succeeds, calculate a key CK′ and a key IK′, and forgo calculating a key KAUSF, wherein the key KAUSF is calculated based on the key CK′ and the key IK′.

A system, comprising at least one of an authentication server function or a unified data management, wherein

• the authentication server function comprises at least one first processor and at least one first memory, wherein the at least one first memory is configured to store first instructions, and the at least one first processor is configured to execute the first instructions thereby causing the authentication server function to:
• receive, from an NSWO network element, a first authentication request message, wherein the first authentication request message comprises a subscription concealed identifier (SUCI) and fourth NSWO indication information, and the fourth NSWO indication information indicates to perform authentication for the NSWO service;
• send, based on the fourth NSWO indication information, a second authentication request message to the unified data management, wherein the second authentication request message comprises the SUCI and fifth NSWO indication information, and the fifth NSWO indication information indicates to perform authentication for the NSWO service;
• receive a second authentication response message from the unified data management, wherein the second authentication response message comprises a second extensible authentication protocol-authentication and key agreement (EAP-AKA′) authentication vector and a subscription permanent identifier (SUPI) of a terminal device, and the SUPI is corresponding to the SUCI;
• send a first authentication response message to the NSWO network element based on the second authentication response message, wherein the first authentication response message is an authentication response message corresponding to an EAP-AKA′ authentication algorithm;
• receive a fifth authentication request message from the NSWO network element;
• and
• perform authentication on the terminal device based on the fifth authentication request message and the second EAP-AKA′ authentication vector;
• and
• the unified data management comprises at least one second processor and at least one second memory, wherein the at least one second memory is configured to store second instructions, and the at least one second processor is configured to execute the second instructions thereby causing the unified data management to:
• receive the second authentication request message from the authentication server function;
• calculate the SUPI based on the SUCI;
• determine, based on the second authentication request message, to use an extensible authentication protocol-authentication and key agreement (EAP-AKA′) authentication method;
• obtain a first EAP-AKA′ authentication vector based on the SUPI, wherein the second EAP-AKA′ authentication vector is associated with the first EAP-AKA′ authentication vector;
• and
• send the second authentication response message to the authentication server function.