KEY HIERARCHY FOR NETWORK SLICING

摘要

A method is provided for facilitating service-specific security while avoiding a full authentication and key agreement exchange each time a service is activated on a device. Multiple services on a single device and sharing the same session link (e.g., radio link or radio bearer) and the same physical network may nonetheless obtain distinct service-specific network connectivity root keys from which service-specific security/session keys may be derived. In such case, instead of performing a full authentication and key agreement exchange with an operator or provider (e.g., home subscription server or HSS), the device may authenticate a network slice using a security credential established during a prior authentication with another network slice.

主权项

1. A method operational at a device, comprising:
performing an authentication and key agreement (AKA) exchange with a first network entity operating on a network; generating a device-specific network connectivity root key from the AKA exchange; performing a service registration procedure for a first service through the network; and obtaining a first service-specific network connectivity root key from the service registration procedure, wherein the first service-specific network connectivity root key is, at least partially, a function of the device-specific network connectivity root key and a first service identifier, and each distinct service activated by the device has a distinct service-specific network connectivity root key.