US 12,772,053 B2Granted

Authentication and authorization for user equipment (UE)-to-network relaying

AssigneeNokia Technologies Oy

InventorsLaurent Thiebaut, György Wolfner, Devaki Chandramouli, Suresh Nair

Life of this patent

Estimating the term…

Loading patent…

Abstract

Systems, methods, apparatuses, and computer program products for creation of a PCS connection between the remote user equipment (UE) and the relay UE. The remote UE may provide its identifier (e.g., a subscription concealed identifier (SUCI)) to the relay UE and the relay UE may forward this identifier to the network so that the network can authenticate the remote UE. The network may check the authorization of using the relay UE and/or for relaying the remote UE (e.g., both the remote UE and the relay UE may be checked for a configuration that permits the relaying). For the authentication and authorization, the access and mobility management function (AMF) associated with the relay UE may forward the messages between the remote UE and the authentication server function (AUSF) of the remote UE. In this way, certain embodiments described herein may address certain security issues related to relaying a remote UE.

Claims8

Dependent claims

A relay user equipment, comprising:

at least one processor;
and
at least one memory including computer program code,
wherein the computer program code is configured to, when executed by the at least one processor, cause the relay user equipment at least to perform operations comprising:
receiving an identifier of a remote user equipment via a direct communication connection between the relay user equipment and the remote user equipment, wherein the remote user equipment is out of radio coverage of a radio network that provides access to a serving network of the remote user equipment;
providing, to a relay network entity of a serving network of the relay user equipment, a first non-access stratum message comprising a first request for authorization for the relay user equipment to be a relay for the remote user equipment, wherein the first request comprises the identifier for the remote user equipment;
relaying signaling associated with authenticating the remote user equipment with the serving network of the remote user equipment that is received from the remote user equipment to a serving network of the relay user equipment and relaying signaling associated with authenticating the remote user equipment with the serving network of the remote user equipment that is received from the serving network of the relay user equipment to the remote user equipment, wherein the signaling associated with authenticating the remote user equipment received from the remote user equipment is destined for a network entity of the serving network of the remote user equipment and the signaling associated with authenticating the remote user equipment received from the serving network of the relay user equipment originates at the network entity of the serving network of the remote user equipment and is destined for the remote user equipment, and wherein the serving network of the remote user equipment differs from the serving network of the relay user equipment;
and
receiving, from the relay network entity, a second non-access stratum message comprising a response to the first request, wherein the response to the first request comprises:
security information to be used in association with relaying, by the relay user equipment, control plane signaling and user plane traffic of the remote user equipment received via a direct connection, to the serving network of the remote user equipment via the serving network of the relay user equipment and/or relaying, by the relay user equipment, control plane signaling and user plane traffic for the remote user equipment received from the serving network of the remote user equipment via the serving network of the relay user equipment, to the remote user equipment via the direct connection.

7 more elements

A method, comprising:

receiving, by a relay user equipment, an identifier of a remote user equipment via a direct communication connection between the relay user equipment and the remote user equipment, wherein the remote user equipment is out of radio coverage of a radio network that provides access to a serving network of the remote user equipment;
providing by the relay user equipment to a relay network entity of a serving network of the relay user equipment, a first non-access stratum message comprising a first request for authorization for the relay user equipment to be a relay for the remote user equipment, wherein the first request comprises the identifier for the remote user equipment;
relaying, by the relay user equipment, signaling associated with authenticating the remote user equipment with the serving network of the remote user equipment that is received from the remote user equipment to the serving network of the relay user equipment and relaying signaling associated with authenticating the remote user equipment with the serving network of the remote user equipment that is received from the serving network of the relay user equipment to the remote user equipment, wherein the signaling associated with authenticating the remote user equipment received from the remote user equipment is destined for a network entity of the serving network of the remote user equipment and the signaling associated with authenticating the remote user equipment received from the serving network of the relay user equipment originates at the network entity of the serving network of the remote user equipment and is destined for the remote user equipment, and wherein the serving network of the remote user equipment differs from the serving network of the relay user equipment;
and
receiving by the relay user equipment from the relay network entity, a second non-access stratum message comprising a response to the first request, wherein the response comprises:
security information to be used in association with relaying, by the relay user equipment, control plane signaling and user plane traffic of the remote user equipment received via a direct connection, to the serving network of the remote user equipment via the serving network of the relay user equipment and/or relaying, by the relay user equipment, control plane signaling and user plane traffic for the remote user equipment received from the serving network of the remote user equipment via the serving network of the relay user equipment, to the remote user equipment via the direct connection.

3 more elements

Dependencies are inferred from the claim text.