Network slice authentication

A method for network slice isolation, the method being performed by a target Access Management Function, the method comprising:

• obtaining an indication that the terminal device has determined to shift from accessing a first service using a current network slice to accessing a second service using a target network slice, network access to the current network slice being handled by a source Access Management Function, and network access to the target network slice being handled by the target Access Management Function;
• obtaining, as output from a slice authentication procedure, a mutual secret that is shared between the terminal device and the target Access Management Function, the slice authentication procedure having been performed with the terminal device;
• and
• activating a created security context for the target network slice based on the mutual secret, thereby security isolating the target network slice from the source Access Management Function.

A terminal device for network slice isolation, the terminal device comprising processing circuitry, the processing circuitry being configured to cause the terminal device to:

• determine to shift from accessing a first service using a current network slice to accessing a second service using a target network slice, network access to the current network slice being handled by a source Access Management Function, and network access to the target network slice being handled by a target Access Management Function;
• perform a slice authentication procedure in response thereto, during the authentication procedure a mutual secret is shared between the terminal device and the target Access Management Function;
• create a security context for the target network slice based on the mutual secret;
• and
• activate the security context, thereby security isolating the target network slice from the source Access Management Function.

An Access Management Function for network slice isolation, the Access Management Function acting as a target Access Management Function and comprising processing circuitry, the processing circuitry being configured to cause the Access Management Function to:

• obtain an indication that the terminal device has determined to shift from accessing a first service using a current network slice to accessing a second service using a target network slice, wherein network access to the current network slice being handled by a source Access Management Function, and network access to the target network slice being handled by the target Access Management Function;
• obtain, as output from a slice authentication procedure, a mutual secret that is shared between the terminal device and the target Access Management Function, the slice authentication procedure having been performed with the terminal device;
• and
• activate a created security context for the target network slice based on the mutual secret, thereby security isolating the target network slice from the source Access Management Function.