Credentials Holder

Description

The Credentials Holder is a concept introduced in 3GPP Release 19 to support authentication and authorization for Standalone Non-Public Networks (SNPNs) when the credentials used by the UE are not owned by the SNPN operator. In traditional SNPN deployments, the SNPN operator acts as the authentication server and holds the subscription credentials. However, there are scenarios where a UE may want to access an SNPN using credentials from a different entity, such as a public land mobile network (PLMN) operator, a neutral host, or an enterprise. The Credentials Holder is the entity that owns and manages these credentials and performs the authentication and authorization functions on behalf of the SNPN. This separation of roles allows for flexible business models and enables UEs to roam into SNPNs without needing a direct subscription with the SNPN operator.

The Credentials Holder is defined in 3GPP TS 23.501 (System architecture for the 5G System) and TS 33.501 (Security architecture and procedures for 5G System). Architecturally, the Credentials Holder may be implemented as a standalone Authentication, Authorization, and Accounting (AAA) server or as a function within a PLMN's Unified Data Management (UDM) or Authentication Server Function (AUSF). When a UE attempts to access an SNPN, the SNPN's Access and Mobility Management Function (AMF) selects an AUSF, which may be in the SNPN or in the Credentials Holder's network. The AUSF interacts with the Credentials Holder to authenticate the UE and to obtain authorization information. The Credentials Holder validates the UE's credentials and returns the authentication result and authorization data to the SNPN. The SNPN then uses this information to grant or deny access and to establish the UE's session.

The Credentials Holder concept is part of the broader effort in 3GPP to support non-public networks (NPNs) and to enable new business models for vertical industries. SNPNs are designed to serve specific organizations, such as factories, campuses, or enterprises, and they may be deployed by the organization itself or by a third-party operator. In some cases, the organization may not want to manage its own credentials or may want to allow its employees or devices to access multiple SNPNs using a single set of credentials. The Credentials Holder enables this by acting as a central authentication authority that can be trusted by multiple SNPNs. This is similar to the role of a PLMN operator in roaming scenarios, but it is more flexible because the Credentials Holder does not need to be a mobile network operator.

The Credentials Holder also supports the concept of "SNPN access using credentials from a Credentials Holder" as defined in 3GPP TS 23.501. This allows a UE to access an SNPN even if it does not have a subscription with that SNPN, as long as it has credentials from a Credentials Holder that has a trust relationship with the SNPN. The trust relationship is established through roaming agreements or other business arrangements. The Credentials Holder may also provide additional services, such as policy control or charging, although these are not strictly part of its definition. The Credentials Holder is a key enabler for the vision of a diverse 5G ecosystem where users and devices can seamlessly access different types of networks using a unified identity.

In terms of security, the Credentials Holder must meet the same security requirements as any other authentication server in the 5G system. It must support strong authentication methods, such as 5G-AKA or EAP-AKA', and must protect the credentials from unauthorized access. The communication between the SNPN and the Credentials Holder is secured using inter-network security mechanisms, such as IPsec or TLS. The Credentials Holder may also be involved in the authorization of specific services or network slices, although the primary responsibility is authentication and authorization for SNPN access. The concept is still evolving, and future releases may add more details on how the Credentials Holder interacts with other network functions, such as the Network Slice Selection Function (NSSF) or the Policy Control Function (PCF).

Purpose & Motivation

The Credentials Holder concept was created to address the need for flexible authentication and authorization in Standalone Non-Public Networks (SNPNs). SNPNs are private networks designed for specific organizations, and they may be deployed in various ways. In many cases, the organization that owns the SNPN also owns the credentials of the devices that access it. However, there are scenarios where this is not the case. For example, a device may be owned by an employee who also has a subscription with a public mobile network operator. The employee may want to use the same device to access both the public network and the company's SNPN. Without the Credentials Holder concept, the employee would need separate credentials for each network, which is inconvenient and costly. The Credentials Holder allows the employee to use their public network credentials to access the SNPN, provided that the public network operator and the SNPN operator have a trust relationship.

Another scenario is when an SNPN is deployed by a neutral host that serves multiple organizations. Each organization may have its own credentials, and the neutral host may not want to manage all of them. The Credentials Holder allows each organization to manage its own credentials while the neutral host provides the radio access. This separation of concerns simplifies network management and enables new business models. The Credentials Holder also supports the case where a device needs to access multiple SNPNs, such as a delivery robot that operates in different factories. The robot can have a single set of credentials from a Credentials Holder that is trusted by all the factories, eliminating the need for multiple subscriptions.

Before the introduction of the Credentials Holder, SNPN access was limited to UEs that had a subscription with the SNPN operator. This restricted the applicability of SNPNs to closed environments where the organization controlled all devices. The Credentials Holder opens up SNPNs to a wider range of devices and users, making them more versatile and economically viable. It also aligns with the 3GPP vision of supporting diverse business models and enabling seamless connectivity across different types of networks. The concept was introduced in Release 19, and it is expected to be further refined in future releases as deployments and use cases evolve.