Protection of application metadata in transport protocols

Abstract

Systems and methods for sending application metadata to an on-path network element. In one embodiment, a method includes establishing an application session between an application client (1006) running on a user device (106) and an application service (1010); identifying application metadata associated with the application session (1810); formatting a transport protocol packet with the application metadata (1802); deriving an encryption key (1816) based on the key material (1812); encrypting application metadata in the transport protocol packet using the encryption key; and transmitting the transport protocol packet over a user plane network path (1024), the user plane network path (1024) comprising one or more on-path network elements (1104).

Description

Technical Field

[0001] The present disclosure relates to the field of communication systems, and in particular to next generation networks. Background Art

[0002] Next generation networks, such as fifth generation (5G), represent the next major stage in mobile telecommunication standards above fourth generation (4G) standards. Next generation networks may be enhanced in radio access and network architecture compared to 4G networks. Next generation networks are intended to utilize new areas of the radio spectrum for radio access networks (RANs), such as millimeter wave bands.

[0003] As mobile networks become more widely used across the country and around the world, communications may be intercepted or subject to other types of attacks. To ensure security and privacy, the Third Generation Partnership Project (3GPP) has developed security mechanisms for 5G mobile networks and security procedures performed within 5G mobile networks. One of the security processes between the user equipment (UE) and the 5G mobile network is the primary authentication and key agreement. The primary authentication and key agreement process enables mutual authentication between the UE and the network, and provides key material that can be used between the UE and the serving network in subsequent security processes. After the primary authentication, a non-access stratum (NAS) security context and an access stratum (AS) security context are created for the UE.

[0004] In addition, an application session may be established between the UE and an application service (e.g., a video streaming service). One or more on-path network elements may be provisioned on a user plane network path associated with the application session. One problem is how to securely provide application metadata to one or more of the on-path network elements in the form of an explicit signal. Summary of the invention

[0005] This article describes an enhanced mechanism for conveying explicit signals to network elements on the path. Typically, an application session is established between a UE and an application service via an application function (AF) of a 5G core network, and one or more network elements on the path are supplied on a user plane network path between the UE and the application service, such as a user plane function (UPF) and / or a RAN node. Pre-shared key materials derived from or distributed to the UE are also distributed to one or more network elements on the path in the network element on the path. Pre-shared key materials can be used to encrypt application metadata in transport protocol packets (such as user datagram protocol (UDP) packets). When a transport protocol packet is received at a network element on the path, the network element on the path can decrypt the application metadata and perform associated functions based on the decrypted application metadata. A technical advantage is that explicit signals can be sent to network elements on the path by a transport protocol.

[0006] In an embodiment (also referred to as an aspect), a method for sending application metadata to an on-path network element provisioned for an application session is described. The method includes: establishing an application session between an application client running on a user device and an application service; identifying application metadata associated with the application session; formatting a transport protocol packet using the application metadata; deriving an encryption key based on key material; encrypting the application metadata in the transport protocol packet using the encryption key; and sending the transport protocol packet over a user plane network path, the user plane network path including one or more on-path network elements of the on-path network element.

[0007] In an embodiment, the deriving comprises deriving the encryption key from authentication and key management for an application key derived during primary authentication of the user device.

[0008] In an embodiment, the deriving comprises: deriving an encryption key from a hybrid public key encryption key material, the hybrid public key encryption key material being received from at least a 5G core network.

[0009] In an embodiment, the method also includes: determining, at a control plane network function of at least the 5G core network, whether the user equipment supports the metadata encryption scheme; when the user equipment supports the metadata encryption scheme, identifying the path network elements supplied on the user plane network path of the application session; identifying the key material; and sending the key material to one or more of the path network elements.

[0010] In an embodiment, the method further comprises: receiving, at the control plane network function, a support indicator from the user equipment during the primary authentication, the support indicator indicating whether the user equipment supports the metadata encryption scheme.

[0011] In an embodiment, identifying the on-path network elements comprises compiling a list of one or more user plane functions and / or one or more radio access network nodes on the user plane network path.

[0012] In an embodiment, sending the key material comprises pushing the key material to a session management function, which in turn pushes the key material to a user plane function on the user plane network path.

[0013] In an embodiment, sending the key material comprises pushing the key material to an access and mobility management function which in turn pushes the key material to a radio access network node on the user plane network path.

[0014] In an embodiment, the method further comprises: receiving, at one of the on-path network elements, key material sent by a control plane network function; receiving a transport protocol packet sent on a user plane network path; deriving a decryption key based on the key material received from the control plane network function; decrypting encrypted application metadata in the transport protocol packet using the decryption key; and performing a function associated with the application session based on the decrypted application metadata.

[0015] In an embodiment, performing the function includes applying quality of service for the application session based on the decrypted application metadata.

[0016] In an embodiment, the transport protocol packet comprises a user datagram protocol packet, and the encrypted application metadata comprises a user datagram protocol option of the user datagram protocol packet.

[0017] In an embodiment, a 5G system is disclosed that supports sending application metadata to a path network element provisioned for an application session. The 5G system includes: a component for establishing an application session between an application client running on a user equipment (UE) and an application service; a component for identifying application metadata associated with the application session; a component for formatting a transport protocol packet using the application metadata; a component for deriving an encryption key based on key material; a component for encrypting the application metadata in the transport protocol packet using the encryption key; and a component for sending the transport protocol packet over a user plane network path including one or more of the path network elements.

[0018] In an embodiment, the means for deriving comprises means for deriving the encryption key from authentication and key management for application keys derived during primary authentication of the user equipment.

[0019] In an embodiment, the means for deriving comprises means for deriving an encryption key from hybrid public key encryption key material received from at least a 5G core network.

[0020] In an embodiment, the 5G system also includes: a component for determining whether a user device supports a metadata encryption scheme at a control plane network function of at least the 5G core network; a component for identifying a path network element supplied on a user plane network path of an application session when the user device supports the metadata encryption scheme; a component for identifying key material; and a component for sending key material to one or more of the path network elements.

[0021] In an embodiment, the 5G system further comprises: a component for receiving a support indicator from the user equipment during primary authentication at the control plane network function, the support indicator indicating whether the user equipment supports the metadata encryption scheme.

[0022] In an embodiment, the means for identifying the network elements on the path comprises means for compiling a list of one or more user plane functions and / or one or more radio access network nodes on the user plane network path.

[0023] In an embodiment, means for sending the key material comprises means for pushing the key material to a session management function, which in turn pushes the key material to a user plane function on the user plane network path.

[0024] In an embodiment, the means for sending the key material comprises means for pushing the key material to an access and mobility management function which in turn pushes the key material to a radio access network node on the user plane network path.

[0025] In an embodiment, the 5G system also includes: a component for receiving key material sent by a control plane network function at one of the on-path network elements; a component for receiving a transport protocol packet sent on a user plane network path; a component for deriving a decryption key based on the key material received from the control plane network function; a component for decrypting encrypted application metadata in the transport protocol packet using the decryption key; and a component for performing a function associated with an application session based on the decrypted application metadata.

[0026] In an embodiment, the means for performing the function includes means for applying quality of service for the application session based on the decrypted application metadata.

[0027] In an embodiment, the transport protocol packet comprises a user datagram protocol packet, and the encrypted application metadata comprises a user datagram protocol option of the user datagram protocol packet.

[0028] Other embodiments may include computer readable media, other systems, or other methods as described below. Additionally, one or more of the embodiments described above may be combined as described herein.

[0029] The above summary of the invention provides a basic understanding of some aspects of the specification. The summary of the invention is not an exhaustive overview of the specification. It is neither intended to identify important or key elements of the specification, nor to describe any scope of a specific embodiment of the specification, or any scope of the claims. Its only purpose is to present some concepts of the specification in a simplified form as a prelude to a more detailed description presented later. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Some embodiments of the present invention will now be described by way of example only and with reference to the accompanying drawings.In all drawings, the same reference number represents the same element or the same type of element.

[0031] Figure 1 The diagram illustrates the high-level architecture of a 5G system.

[0032] Figure 2 The diagram illustrates the non-roaming architecture of the 5G system.

[0033] Figure 3 is a signaling diagram illustrating the initiation of primary authentication.

[0034] Figure 4 is a signaling diagram illustrating the authentication process.

[0035] Figure 5 The basic network model for AKMA is illustrated.

[0036] Figure 6 Illustrated is the AKMA architecture in reference point representation for internal AF.

[0037] Figure 7 Illustrated is the AKMA architecture in reference point representation for external AF.

[0038] Figure 8 It is a diagram showing the generation of the AKMA anchor key (K AKMA ) signaling diagram.

[0039] Fig. 9 This is a diagram to generate the AKMA application key (K AF ) signaling diagram.

[0040] Fig.10 A UE is illustrated accessing an external application service in an illustrative embodiment.

[0041] Fig.11 Explicit signals sent over a user plane network path in an illustrative embodiment are illustrated.

[0042] Fig.12 is a block diagram of a UE in an illustrative embodiment.

[0043] Fig.13 is a block diagram of control plane network elements in an illustrative embodiment.

[0044] Fig.14 is a block diagram of user plane network elements in an illustrative embodiment.

[0045] Fig.15is a flow chart illustrating a method of encrypting application metadata in an illustrative embodiment.

[0046] Fig.16 is a flow chart illustrating a method of propagating key material to one or more on-path network elements in an illustrative embodiment.

[0047] Fig.17 is a flow chart illustrating a method of decrypting application metadata in an illustrative embodiment.

[0048] Fig.18 Transport protocol packets in an illustrative embodiment are illustrated.

[0049] Fig.19 IP packets in an illustrative embodiment are illustrated.

[0050] Fig. 20 is shown in the illustrative embodiment based on K AF Encrypted signaling diagram.

[0051] Fig.21 is a signaling diagram illustrating HPKE-based encryption in an illustrative embodiment. DETAILED DESCRIPTION

[0052] The accompanying drawings and the following description illustrate specific exemplary embodiments. Therefore, although not explicitly described or shown herein, those skilled in the art will be able to design various arrangements that embody the principles of the embodiments and are included within the scope of the embodiments. In addition, any examples described herein are intended to help understand the principles of the embodiments and should be interpreted as not being limited to these specifically listed examples and conditions. Therefore, the (multiple) concepts of the present invention are not limited to the specific embodiments or examples described below, but are limited by the claims and their equivalents.

[0053] Figure 1The high-level architecture of a 5G system 100 is illustrated. A 5G system (5GS) 100 is a communication system (e.g., a 3GPP system) that includes a 5G access network ((R)AN) 102, and a 5G core network (5GC) 104 that communicates with a 5G user equipment (UE) 106. Although the term "5G" is used, any next generation network above 5G is considered herein. The access network 102 provides radio or wireless connectivity to the UE 106 and connects the UE 106 to the 5GC 104. The access network 102 may include a next generation radio access network (NG-RAN), a non-3GPP access network, or another type of RAN connected to the 5GC 104. The access network 102 may support an evolved UMTS terrestrial radio access network (E-UTRAN) access (e.g., through an eNodeB, a gNodeB, and / or an ng-eNodeB), a wireless local area network (WLAN) access, fixed access, satellite radio access, new radio access technologies (RATs), and the like. 5GC 104 interconnects access network 102 with data network (DN) 108. 5GC 104 consists of network function (NF) 110, which can be implemented as one of network elements on dedicated hardware, software instances running on dedicated hardware, virtualized functions instantiated on appropriate platforms (e.g., cloud infrastructure), etc. Data network 108 can be an operator's external public or private data network, or an operator's internal data network (e.g., for IMS services). UE 106 (also referred to as a mobile terminal) includes a 5G-enabled device configured to register with 5GC 104 to access services. UE 106 may include an end-user device such as a mobile phone (e.g., a smart phone), a tablet, a computer with a mobile broadband adapter, etc. UE 106 may be enabled for voice services, data services, machine-to-machine (M2M) or machine-type communication (MTC) services, and / or other services.

[0054] Figure 2 A non-roaming architecture 200 of a 5G system is illustrated. Figure 2The architecture 200 in is a service-based representation, as further described in 3GPP TS 23.501 (v18.2.0), which is incorporated herein by reference as if fully included herein. The architecture 200 consists of network functions (NFs) of 5GC 104, and the NFs of the control plane (CP) are separated from the user plane (UP). The control plane of 5GC 104 includes an authentication server function (AUSF) 210, an access and mobility management function (AMF) 212, a session management function (SMF) 214, a policy control function (PCF) 216, a unified data management (UDM) 218, a network slice selection function (NSSF) 220, and an application function (AF) 222. The control plane of 5GC 104 also includes a network exposure function (NEF) 224, a NF repository function (NRF) 226, a service communication proxy (SCP) 228, a network slice admission control function (NSACF) 230, a network slice specific and SNPN authentication and authorization function (NSSAAF) 232, and an edge application server discovery function (EASDF) 234. The user plane of 5GC 104 includes one or more user plane functions (UPF) 240 that communicate with the data network 108. UE 106 can access the control plane and user plane of the core network 104 through (R)AN 102.

[0055] There are a large number of subscribers who can access services from operators or home network operators that implement mobile networks including 5G system 100, such as Figure 1 to Figure 2 As shown in . The communication between the subscriber (i.e., through the UE) and the mobile network is protected by security mechanisms (such as mechanisms standardized by 3GPP). The subscriber and the operator expect security guarantees from the security mechanisms. One of the security mechanisms is the primary authentication procedure, which provides mutual authentication between the UE and the network. The primary authentication is further described below.

[0056] The purpose of the primary authentication and key agreement process is to achieve mutual authentication between the UE 106 and the home network of the UE 106, and to provide key material that can be used between the UE 106 and the serving network in subsequent security procedures. The home network (e.g., a Home Public Land Mobile Network (HPLMN)) represents an operator network or carrier network through which a subscriber (e.g., UE 106) has a subscription to a service. The serving network has a radio access equipment capable of communicating with the UE 106 via radio signals. The key material generated by the primary authentication and key agreement process results in an anchor key (referred to as K ) being provided by the AUSF 210 of the home network to the Security Anchor Function (SEAF) of the serving network. SEAFKey). SEAF provides authentication functionality via the AMF 212 in the serving network and supports primary authentication using a subscription hidden identifier (SUCI) containing a hidden subscription permanent identifier (SUPI). SUPI is a globally unique 5G identifier assigned to each user in the 5G system 100. SUCI includes a SUPI type, a home network identifier (HN-ID) that identifies the subscriber's home network, a routing indicator (RID) assigned to the subscriber by the home network operator and provisioned in the UE's universal subscriber identity module (USIM), a protection scheme identifier, a home network public key identifier, and a scheme output. Anchor key (K SEAF ) from the so-called K AUSF The intermediate key of the key is derived. AUSF Keys are established between the UE 106 and the home network (AUSF 210) as a result of the primary authentication process.

[0057] Figure 3is a signaling diagram illustrating the initiation of primary authentication, such as described in 3GPP TS 33.501 (v18.2.0), which is incorporated herein by reference as if fully included herein. The UE 106 sends an N1 message 311 (i.e., an initial non-access stratum (NAS) message), such as a registration request, to the serving network 306 (e.g., the AMF 212 of the serving network 306). In a roaming scenario, the serving network 306 may also be referred to as a serving PLMN, or a visited PLMN (VPLMN). The UE 106 uses a SUCI or a 5G globally unique temporary identifier (5G-GUTI) in the registration request. The SEAF 302 of the AMF 212 may initiate authentication with the UE 106 in any process of establishing a signaling connection with the UE 106. The SEAF 302 initiates authentication by invoking the Nausf_UEAuthentication service to the home network 304 (e.g., HPLMN) by sending a Nausf_UEAuthentication_Authenticate request message 312 to the AUSF 210. The Nausf_UEAuthentication_Authenticate request message 312 includes the SUCI or SUPI, and the service network name (SN-Name). Upon receiving the Nausf_UEAuthentication_Authenticate request message 312, the AUSF 210 checks whether the requesting SEAF 302 in the service network 306 is authorized to use the service network name (SNN) in the Nausf_UEAuthentication_Authenticate request message 312 by comparing the service network name with the expected service network name. When the service network 306 is authorized to use the service network name, the AUSF 210 sends a Nudm_UEAuthentication_Get request message 313 to the UDM 218 of the home network. The Nudm_UEAuthentication_Get request message 313 includes the SUCI or SUPI, and the service network name. Upon receiving the Nudm_UEAuthentication_Get request message 313, the UDM 218 identifies the SUPI (if received), or invokes a subscription identifier de-hiding function (SIDF) which de-hides the SUPI from the SUCI (if received). The UDM 218 (or the authentication credentials repository and processing function (ARPF) of the UDM 218) selects or chooses an authentication method for primary authentication based on the SUPI.

[0058] Figure 4is a signaling diagram illustrating the primary authentication process, such as described in 3GPP TS 33.501. In this example, 5G Authentication and Key Agreement (AKA) is described, but similar concepts apply to Extensible Authentication Protocol AKA prime (EAP-AKA`). For the Nudm_UEAuthentication_Get request, the UDM 218 creates a 5G Home Environment Authentication Vector (5G HE AV) for the selected authentication method. The UDM 218 derives K AUSF The UDM 218 creates a 5G HE AV, which includes the authentication token (AUTN), the expected response (XRES*), K AUSF The UDM 218 then sends a Nudm_UEAuthentication_Get response message 411 to the AUSF 210, which has the 5G HE AV (e.g., Figure 4 In the case where SUCI is included in the Nudm_UEAuthentication_Get request, the UDM 218 includes the SUPI in the Nudm_UEAuthentication_Get response message 411 after decrypting the SUPI from the SUCI. If the subscriber has an Authentication and Key Management for Applications (AKMA) subscription, the UDM 218 may include the AKMA indication and the RID in the Nudm_UEAuthentication_Get response message 411.

[0059] In response to the Nudm_UEAuthentication_Get response message 411, the AUSF 210 temporarily stores the expected response (XRES*) together with the received SUCI or SUPI. Then, the AUSF 210 calculates the hashed expected response (HXRES*) from the expected response (XRES*) and obtains the hashed expected response (HXRES*) from K AUSF Key calculation K SEAF key, and replace XRES* with HXRES*, and K AUSF Key replaced by K in 5G HE AV SEAF The AUSF 210 removes the K key and generates a 5G authentication vector (5G AV) from the 5G HE AV received from the UDM 218. SEAFThe AUSF 210 sends a Nausf_UEAuthentication_Authenticate response message 412 to the SEAF 302, which includes the 5G SE AV. In response, the SEAF 302 sends the authentication token (AUTN) and the random challenge (RAND) to the UE 106 in a NAS message authentication request message 413.

[0060] although Figure 4 106 includes a mobile equipment (ME) and a USIM. The ME receives the authentication token (AUTN) and the random challenge (RAND) in the NAS message Authentication Request message 413, and forwards the authentication token (AUTN) and the random challenge (RAND) to the USIM. The USIM of the UE 106 verifies the freshness of the received value by checking whether the authentication token (AUTN) can be accepted. If so, the USIM calculates a response (RES), a cipher key (CK), and an integrity key (IK) based on the random challenge (RAND), and returns the response (RES), the CK key, and the IK key to the ME. The ME of the UE 106 calculates RES* based on RES, and calculates K based on CK||IK. AUSF key, and according to K AUSF Key to calculate K SEAF Key.

[0061] UE 106 sends a NAS message authentication response message 414 including RES* to SEAF 302. In response, SEAF 302 calculates HRES* based on RES* and compares HRES* and HXRES*. If they are consistent, SEAF 302 considers authentication successful from the perspective of the serving network. SEAF 302 sends the RES* received from UE 106 to AUSF 210 in a Nausf_UEAuthentication_Authenticate request message 415. When AUSF 210 receives the Nausf_UEAuthentication_Authenticate request message 415 (including RES* as authentication confirmation), AUSF 210 stores K based on the policy of the home network operator. AUSFThe AUSF 210 receives the received RES* and compares it with the stored XRES*. If RES* is equal to XRES*, then AUSF 210 considers the authentication successful from the perspective of the home network. AUSF 210 notifies UDM 218 (not shown) of the authentication result. AUSF 210 also sends a Nausf_UEAuthentication_Authenticate response message 416 to SEAF 302, which indicates whether the authentication is successful from the perspective of the home network. If the authentication is successful, K SEAF The key is sent to the SEAF 302 in a Nausf_UEAuthentication_Authenticate response message 416. In case the AUSF 210 receives SUCI from the SEAF 302 in the authentication request, the AUSF 210 includes the SUPI in the Nausf_UEAuthentication_Authenticate response message 416 if the authentication is successful.

[0062] AKMA (Authentication and Key Management for Applications) is a function that utilizes the operator authentication infrastructure to protect the communication between UE106 and AF 222. AKMA is described in 3GPP TS 33.535 (v18.0.0), which is incorporated herein by reference as if fully included herein. The application function (AF) is a control plane function within the 5G core network that provides application services to subscribers (e.g., NF service consumers). The application service described herein refers to a computer-based service provided using one or more networks. Examples of application services include data streaming (i.e., video, audio, etc.), voice and / or video calls, social media, online games, etc.

[0063] Figure 5 A basic network model 500 for AKMA is illustrated. Figure 6 The AKMA architecture 600 is illustrated in a reference point representation for an internal AF (ie, an AF located within an operator's network). Figure 7 The AKMA architecture 700 is illustrated in a reference point representation for an external AF (ie, an AF located outside of an operator's network).

[0064] exist Figure 5 In the example, the network model 500 for AKMA includes AUSF 210, AMF 212, UDM 218, AF 222, and NEF 224. The network model 500 for AKMA also includes an AKMA anchor function (AAnF) 536, which is an anchor function in the HPLMN. AAnF 536 stores the AKMA anchor key (K AKMA), and the SUPI for AKMA services, which are received from AUSF 210 after UE 106 completes a successful 5G primary authentication. AAnF 536 also generates key material to be used between UE 106 and AF 222, and maintains the UE AKMA context. AAnF 536 sends the SUPI of UE 106 to AF 222 or NEF 224 located within the operator's network. AKMA AF 222 requests AKMA application key (referred to as K) from AAnF 536 using AKMA key identifier (A-KID). AF ).

[0065] AKMA reuses the 5G primary certification process to certify UE 106. In summary, successful 5G primary certification results in AKMA certification. AUSF The key is stored in AUSF 210 and UE 106. After UE 106 completes primary authentication and before it initiates communication with AF 222, UE 106 obtains the key based on K AUSF Key to generate K AKMA Key and A-KID. After receiving K from UDM 218 AUSF After the key is obtained, AUSF 210 stores K AUSF key, and according to K AUSF Key Generation K AKMA AUSF 210 will K AKMA The key and A-KID are sent together with the SUPI of UE 106 to AAnF 536, which stores K AKMA Key.

[0066] Further details of the AKMA process are described below. Figure 8 It is a diagram showing the generation of the AKMA anchor key (K AKMA ). During the primary authentication process, the AUSF 210 interacts with the UDM 218 to obtain authentication information, such as subscription credentials (e.g., AKA authentication vectors) and authentication methods, using the Nudm_UEAuthentication_Get request service operation (i.e., sending the Nudm_UEAuthentication_Get request message 313 to the UDM 218). In response, the UDM 218 may also provide the AUSF 210 with an AKMA indication 801 indicating that the AUSF 210 has received the AKMA indication. AKMAWhether the key 803 needs to be generated for the UE 106 (ie, whether the UE 106 supports AKMA). If the AKMA indication 801 is included, the UDM 218 also includes the RID 802 of the UE 106 in the Nudm_UEAuthentication_Get Response 411 .

[0067] If the AUSF 210 receives the AKMA indication 801 from the UDM 218, the AUSF 210 stores the K AUSF key, and after the primary authentication process is successfully completed, according to K AUSF Key to generate K AKMA Key 803 and A-KID 804. Similarly, before initiating communication with AKMA AF 222, UE 106 AUSF Key to generate K AKMA Key 803 and A-KID 804. After the AKMA key material is generated, the AUSF 210 selects the AAnF 536 and registers the A-KID 804 and K-key 803 with the AAnF 536 using the Naanf_AKMA_AnchorKey_Register request message 812. AKMA The key 803 is sent to the AAnF 536 along with the SUPI of the UE 106. The AAnF 536 sends a response to the AUSF 210 using a Naanf_AKMA_AnchorKey_Register response message 813.

[0068] Fig. 9 This is a diagram to generate the AKMA application key (K AF ) signaling diagram. Before communication between UE 106 and AKMA AF 222 can begin, UE 106 and AKMA AF 222 need to know whether to use AKMA service. This knowledge is implicit to specific applications on UE 106 and AKMA AF 222, or indicated to UE 106 by AKMA AF 222. Before initiating communication with AKMA AF 222, UE 106 determines whether to use AKMA service according to AKMA service. AUSF Key Generation K AKMA Key 803 and A-KID 804. When UE 106 initiates communication with AKMA AF 222, UE 106 includes A-KID 804 in a session request to AKMA AF 222 (e.g., application session establishment request message 911). UE 106 may include A-KID 804 before or after sending the session request according to K AKMA Key 803 (e.g., Appendix A.4 of 3GPP TS 33.535) to derive K AF Key.

[0069] If the AKMA AF 222 does not have an active context associated with the A-KID 804, the AKMA AF 222 selects the AAnF 536 based on the A-KID 804. The AKMA AF 222 then sends a Naanf_AKMA_ApplicationKey_Get request message 912 (with the A-KID 804) to the AAnF 536 to request the KID for the UE 106. AF The AKMA AF222 also includes its identification (AF_ID) in the request.

[0070] The AAnF 536 checks whether it can provide AKMA services to the AKMA AF 222 based on the configured local policy or based on the authorization information available in the signaling. If successful, the following procedure is performed. Otherwise, the AAnF 536 rejects the procedure. The AAnF 536 determines ... UE-specific KID identified by the A-KID 804. AKMA The presence of key 803 verifies that the subscriber is authorized to use AKMA. If AAnF 536 does not already have K AF Key 905, then according to K AKMA Key 803 derives the application function (AF) key (i.e., K AF Key 905), and sends a Naanf_AKMA_ApplicationKey_Get response message 913 (with SUPI, K AF Key 905, and K AF The AKMA AF 222 sends an AKMA response (eg, an application session establishment response message 914) to the UE 106.

[0071] To access application services, such as those associated with AF 222, UE 106 may host an application client. Fig.10The UE 106 accessing external application services in an illustrative embodiment is illustrated. In this example, the 5G system 100 includes the RAN 102 and the 5GC 104 as described above. The RAN 102 includes one or more RAN nodes 1002, which are devices, hardware, components, etc. of the RAN 102 serving the UE 106 (e.g., gNB, gNB-CU, gNB-DU, and / or another type of node implemented in the RAN). As described above, the network function (NF) of the 5GC 104 is divided into a control plane (CP) 1020 and a user plane (UP) 1022. The control plane 1020 includes an AUSF 210, an AMF 212, an SMF 214, a UDM 218, and an AF 222. The user plane 1022 includes one or more UPFs 240. The UE 106 can access the control plane 1020 and the user plane 1022 through the RAN 102.

[0072] In this example, application services 1010 (also referred to as third-party application services) are implemented in data network 108 (such as by an application service provider (ASP)), and UE 106 can access through 5G system 100. ASP is an entity (including physical or virtual resources) that provides access to applications and related services to users or subscribers through one or more networks. Examples of application services 1010 provided by ASPs include, but are not limited to, games, augmented reality (AR) and / or virtual reality (VR), audio or video streaming (e.g., audio or video streaming of large events (such as concerts, sports games, etc.)), network-assisted control of automated guided vehicles (AGVs), network-assisted control of mobile robots in factories, etc. In this example, application services 1010 are provided or implemented on one or more application servers 1012.

[0073] AF 222 provides control plane functions for application sessions between application services 1010 and UE 106. If AF 222 is trusted, AF 222 can interact directly with the NF of 5GC 104. If AF 222 is a third party, AF 222 interacts with NEF 224. UE 106 hosts application client 1006, which is an application (e.g., a standalone application), component, executable code, part, etc. running on UE 106, which is configured to access application service 1010. For example, application client 1006 interacts with control plane NF (e.g., AF 222) to establish an application session with application service 1010. When the application session is established, data can be exchanged between application client 1006 and application service 1010 through user plane 1022 through one or more RAN nodes 1002 and one or more UPF 240. For example, data in packet form may be sent from the application client 1006 to the application service 1010 and / or from the application service 1010 to the application client 1006 via the user plane network path 1024 .

[0074] In an embodiment, in many cases, a unit on the user plane network path 1024 (e.g., RAN node 1002 and / or UPF 240) can provide useful services. For example, RFC 8558 of the Internet Engineering Task Force (IETF) defines "path signaling" as endpoint signals to or from path network elements. Path signals used to be implicit (e.g., derived from plaintext end-to-end information by examining the transport protocol). For example, the state machine described for the Transmission Control Protocol (TCP) as in RFC 9293 uses a well-known set of control messages exchanged in plaintext. Since these messages are visible to network elements on the path between nodes that are establishing a transport connection, they are often used by those network elements as signals for various purposes. Path signals can also be encrypted by endpoints, which can be referred to as explicit signals. Fig.11 An explicit signal 1124 is shown in an illustrative embodiment being sent over a user plane network path 1024. In this embodiment, the application client 1006 sends the explicit signal 1124 to the application server 1012. Thus, the application client 1006 represents the endpoint 1102, and the RAN node 1002 and the UPF 240 represent the on-path network element 1104 on the user plane network path 1024.

[0075] Mechanisms are described herein for communicating explicit signals 1124 to on-path network elements 1104 that prevent pervasive monitoring and ensure that explicit signal propagation is limited to the targeted on-path network elements 1104. Typically, these mechanisms are implemented via one or more 5G network functions, one or more on-path network elements 1104, and UE 106. Block diagrams of these elements are provided below.

[0076] Fig.12 1 is a block diagram of a UE 106 in an illustrative embodiment. From a functional perspective, the UE 106 consists of at least two parts: a mobile equipment (ME) 1200 and a universal subscriber identity module (USIM) 1260. The ME 1200 includes a radio interface component 1202, one or more processors 1204, a memory 1206, and a user interface component 1208. The UE 106 may also include a battery 1210. The radio interface component 1202 is a hardware component or component representing the local radio resources of the UE 106, such as an RF unit 1220 (e.g., one or more radio transceivers) and one or more antennas 1222. The radio interface component 1202 may be configured as WiFi, Bluetooth, 5G NR, LTE, etc. The processor 1204 represents the internal circuit system, logic, hardware, components, etc. that provide the functions of the UE 106. The processor 1204 may be configured to execute instructions 1240 for software loaded into the memory 1206. The processor 1204 may execute an operating system (OS) 1234 for managing hardware and software resources for the UE 106, and one or more application clients 1006. The processor 1204 may also execute a security controller 1236, which includes components or parts for controlling application sessions of the application clients 1006. The user interface component 1208 is a hardware component for interacting with a terminal user. For example, the user interface component 1208 may include a display 1250, a screen, a touch screen, etc. (e.g., a liquid crystal display (LCD), a light emitting diode (LED) display, etc.). The user interface component 1208 may include a keyboard or keypad 1252, a tracking device (e.g., a trackball or a trackpad), a speaker, a microphone, etc.

[0077] The USIM 1260 is an integrated circuit that provides security and integrity functions for the UE 106. The USIM 1260 includes, or is provisioned with, a subscription profile associated with a subscriber's subscription. The subscription profile may include various information, such as subscription credentials (e.g., SUPI) that are used to uniquely identify a subscription and mutually authenticate the UE 106 and the network.

[0078] UE 106 may include Fig.12 Various other components not specifically shown in the figure.

[0079] Fig.13 is a block diagram of a control plane network element 1300 in an illustrative embodiment. The control plane network element 1300 includes a server, device, apparatus, equipment (including hardware), system, component, etc., configured to implement one or more NFs 110 in the control plane 1020 of the 5G core network 104. In this embodiment, the control plane network element 1300 includes the following subsystems: a network interface component 1302, and a control plane controller 1304 operating on one or more platforms. The network interface component 1302 may include circuit systems, logic, hardware, components, etc., configured to exchange control plane messages or signaling with other network elements, network functions and / or UEs. The network interface component 1302 may operate using various protocols or reference points. The control plane controller 1304 may include circuit systems, logic, hardware, components, etc., configured to support operations or processes performed in the control plane 1020 of the 5G system 100. As Fig.13 As shown in , the control plane network element 1300 can represent the UDM 218, the AAnF 536, and / or another type of NF in the control plane 1020 of the 5G core network 104 as described above.

[0080] One or more subsystems of the control plane network element 1300 may be implemented on a hardware platform including analog and / or digital circuit systems. One or more subsystems of the control plane network element 1300 may be implemented on one or more processors 1330 that execute instructions 1334 (i.e., computer readable code) for software loaded into memory 1332. Processor 1330 includes an integrated hardware circuit that is configured to execute instructions 1334 to provide the functionality of the control plane network element 1300. Processor 1330 may include a collection of one or more processors, or may include a multi-processor core, depending on the specific implementation. Memory 1332 is a non-transitory computer-readable storage medium for data, instructions, applications, etc., and is accessible by processor 1330. Memory 1332 is a hardware storage device capable of temporarily and / or permanently storing information. Memory 1332 may include random access memory, or any other volatile or non-volatile storage device.

[0081] The control plane network element 1300 may include Fig.13 Various other components not specifically shown in the figure.

[0082] Fig.141 is a block diagram of a user plane network element 1400 in an illustrative embodiment. The user plane network element 1400 includes a server, device, apparatus, equipment (including hardware), system, component, etc., configured to process traffic in the user plane 1022 of the 5G core network 104 and / or the RAN 102. The user plane network element 1400 is an example of a network element 1104 on the path, such as Fig.11 As shown in . In this embodiment, the user plane network element 1400 includes the following subsystems: a network interface component 1402, and a user plane controller 1404 operating on one or more platforms. The network interface component 1402 may include circuit systems, logic, hardware, components, etc., configured to exchange user plane messages or packets with other network elements, network functions, RAN elements and / or UEs. The network interface component 1402 may operate using various protocols. The user plane controller 1404 may include circuit systems, logic, hardware, components, etc., configured to support operations or processes performed in the user plane 1022 of the 5G system 100. As shown in Fig.14 As shown in , the user plane network element 1400 may represent a UPF 240, a RAN node 1002, and / or another type of NF or element in the user plane 1022 of the 5G system 100 as described above.

[0083] One or more subsystems of the user plane network element 1400 may be implemented on a hardware platform including analog and / or digital circuit systems. One or more subsystems of the user plane network element 1400 may be implemented on one or more processors 1430, which execute instructions 1434 (i.e., computer readable code) for software loaded into the memory 1432. The processor 1430 includes an integrated hardware circuit that is configured to execute instructions 1434 to provide the functions of the user plane network element 1400. The processor 1430 may include one or more processor sets, or may include a multi-processor core, depending on the specific implementation. The memory 1432 is a non-transitory computer-readable storage medium for data, instructions, applications, etc., and is accessible by the processor 1430. The memory 1432 is a hardware storage device capable of temporarily and / or permanently storing information. The memory 1432 may include a random access memory, or any other volatile or non-volatile storage device.

[0084] The user plane network element 1400 may include Fig.14 Various other components not specifically shown in the figure.

[0085] Figures 15 to 17 is a flow chart illustrating a method of sending explicit signals (ie, encrypted application metadata) to an on-path network element 1104 provisioned for an application session in an illustrative embodiment. Fig.15 1 is a flow chart of a method 1500 for encrypting application metadata in an illustrative embodiment. The steps of the method 1500 are described as being performed in the UE 106, but the steps of the method 1500 may be performed in other entities, such as the application service 1010 (e.g., the AF 222, or the application server 1012). The steps of the flowchart described herein are not all-inclusive and may include other steps not shown, and the steps may be performed in an alternative order.

[0086] UE 106 (such as Fig.12 106) communicates with the AF 222 of the 5GC 104 to establish an application session between the application client 1006 and the application service 1010 running on the UE 106 (step 1502). For example, the UE 106 may send an application session request message to the AF 222 to establish the application session, or the AF 222 may send an application session request message to the UE 106. When the application session is established, the UE 106 formats a transport protocol packet for the application session. Fig.18 A transport protocol packet 1802 in an illustrative embodiment is illustrated. The general structure of the transport protocol packet 1802 includes a packet header 1804 and a payload 1806.

[0087] exist Fig.15 15, the UE 106 identifies application metadata associated with the application session (step 1504). The application metadata includes data summarizing the application traffic at a higher level of abstraction (i.e., above the transport layer). The application metadata provides greater visibility into how the application executes, behaves, and is used across the user plane network path 1024. For example, the application metadata may specify or request quality of service (QoS) details for the application session. In another example, the application metadata may provide security details for the application session. However, the application metadata described herein may be used to control or define other aspects of the application session to the network element 1104 on the path.

[0088] UE 106 formats transport protocol packet 1802 using application metadata (step 1506). In other words, UE 106 inserts application metadata 1810 into payload 1806 of transport protocol packet 1802, such as Fig.18 106 may also identify user plane data 1808 for the application session. The user plane data 1808 includes any data that the application client 1006 wants to exchange with the application service 1010. The UE 106 may also use the user plane data 1808 to format the transport protocol packet 1802 ( Fig.15In other words, the UE 106 may insert user plane data 1808 for the application session into the payload 1806 of the transport protocol packet 1802.

[0089] exist Fig.15 In the embodiment of the present invention, the UE 106 derives an encryption key based on the key material (step 1510). The key material includes data used to form a secret encryption and / or decryption key. The UE 106 may include an algorithm (e.g., in the security controller 1236) configured to derive the encryption key based on the key material. Fig.18 As shown in , UE 106 can derive encryption key 1816 based on key material 1812, which is also shared with on-path network element 1104. In an embodiment, UE 106 can derive encryption key 1816 based on key material 1812 (such as AKMA key material) received during primary authentication. For example, Fig. 9 As shown in FIG. , the UE 106 with AKMA enabled derives K before or after sending a session request. AF Key 905. Fig.18 As shown in FIG. 1 , key material 1812 may include K derived during the AKMA process. AF Key 905, and UE 106 can use K AF Key 905 is used to derive encryption key 1816 (optional step 1516). In another example, K AF Key 905 may include encryption key 1816, and key material 1812 may include the AF Key 905 K AKMA Key 803 (optional step 1518). One technical advantage is that K AF Key 905 may be reused to protect application metadata.

[0090] In one embodiment, the UE 106 may receive key material 1812 from the 5GC 104, such as after primary authentication. For example, the UE 106 may encrypt the application metadata 1810 using the hybrid public key encryption (HPKE) scheme in RFC 9180. HPKE is a scheme that provides public key encryption of plaintext of arbitrary size given the public key of the recipient. HPKE uses a non-interactive temporary static Diffie-Hellman exchange to establish a shared secret. HPKE requires that the endpoint be securely provisioned using an HPKE key configuration (key identifier, KEM ID, HPKE temporary public key (pKE), and HPKE symmetric algorithm). Therefore, the key material 1812 may include HPKE key material 1814, and the UE 106 may derive an encryption key 1816 based on the HPKE key material 1814 (optional step 1520). One technical advantage is that HPKE can be used to protect application metadata.

[0091] UE 106 encrypts application metadata 1810 in transport protocol packet 1802 using encryption key 1816 (step 1512). UE 106 sends transport protocol packet 1802 via user plane network path 1024 (step 1514), which includes one or more on-path network elements 1104. It should be understood that when sent via user plane network path 1024, transport protocol packet 1802 can be packaged in a higher level packet, such as Internet Protocol (IP). One technical advantage is that application metadata 1810 can be securely sent via encryption at the transport layer via user plane network path 1024.

[0092] although Fig.15 The method is described with respect to UE 106, but it is worth noting that AF 222 can operate in a similar manner to encrypt metadata associated with an application session.

[0093] Fig.16 18 is a flow chart of a method 1600 for propagating key material 1812 to one or more on-path network elements 1104 in an illustrative embodiment. When an application session is established between an application client 1006 of a UE 106 and an application service 1010, a control plane NF 110 (e.g., Fig.131602). For example, the control plane NF 110 may receive an indicator (referred to as a support indicator) from the UE 106 indicating whether the UE 106 supports the metadata encryption scheme, such as in a registration request to the AMF 212 (optional step 1610), during a primary authentication of the UE 106 (optional step 1612), etc. A technical advantage is that the UE 106 may report its capabilities regarding metadata encryption to the 5GC 104.

[0094] When the UE 106 supports the metadata encryption scheme, the control plane NF 110 identifies one or more on-path network elements 1104 provisioned on the user plane network path 1024 of the application session (step 1604). For example, the control plane NF 110 may compile a list of one or more UPFs 240 and / or one or more RAN nodes 1002 provisioned on the user plane network path 1024 (optional step 1614). One technical advantage is that each on-path network element 1104 can be effectively identified by the control plane NF 110.

[0095] The control plane NF 110 identifies the key material 1812 associated with the application session (step 1606). As described above, the control plane NF 110 may store the AKMA key (e.g., K AF Key 905 (optional step 1616) or K AKMA The control plane NF 110 may then send, propagate, or otherwise distribute the key material 1812 to one or more on-path network elements 1104 (step 1608). For example, the control plane NF 110 may push the key material 1812 to the SMF 214, which in turn pushes the key material 1812 to the UPF 240 (optional step 1622). One technical advantage is that the control plane NF 110 can effectively distribute the key material 1812 to any on-path UPF. The control plane NF 110 may push the key material 1812 to the AMF 212, which in turn pushes the key material 1812 to the RAN node 1002 (optional step 1624). One technical advantage is that key material 1812 is efficiently distributed to UPF and / or RAN node 1002 on any path to decrypt explicit signals sent over the transport layer.

[0096] Fig.17 1810 is a flow chart of a method 1700 for decrypting application metadata 1810 in an illustrative embodiment. Fig.14 18 (shown in FIG. 18 ) receives key material 1812 sent by control plane NF 110 (step 1702). As described above, the on-path network element 1104 may receive an AKMA key (e.g., K AF Key 905 (optional step 1712), or K AKMA The on-path network element 1104 receives the transport protocol packet 1802 sent on the user plane network path 1024 (step 1704) with the encrypted application metadata 1810. The on-path network element 1104 derives a decryption key based on the key material 1812 (step 1706). The on-path network element 1104 may include an algorithm configured to derive the decryption key based on the key material 1812. Fig.18 , UE 106 derives a decryption key 1818 based on key material 1812. The on-path network element 1104 uses the decryption key 1818 to decrypt the encrypted application metadata 1810 in the transport protocol packet 1802 (step 1708). Then, the on-path network element 1104 performs a function or action associated with the application session based on the decrypted application metadata 1810 (step 1710). For example, the on-path network element 1104 may apply quality of service (QoS) for the application session based on the application metadata 1810 (optional step 1718). In another example, the on-path network element 1104 may initiate or configure a security process based on the application metadata 1810 (optional step 1720), such as closing a UDP pinhole in a firewall after the flow of the application session is terminated to prevent incoming attack packets. However, the on-path network element 1104 may perform other functions, actions, or operations; or otherwise adjust the configuration of the application session in other ways based on the application metadata 1810 extracted from the transport protocol packet 1802. One technical advantage is that differentiated network services can be applied to application sessions using explicit signals sent via a transport layer.

[0097] Other on-path network elements 1104 or UE 106 may operate in a similar manner in response to receiving transport protocol packet 1802. One technical advantage is that any on-path network element 1104 may be able to decrypt the explicit signal in transport protocol packet 1802.

[0098] In an embodiment, application metadata 1810 may be inserted into the "options" portion of a user datagram protocol (UDP) datagram (also referred to as a UDP packet). In general, the Open Systems Interconnection (OSI) model is a conceptual framework used to describe the functionality of a network system. The OSI model divides the tasks involved in moving information between networked computers into seven task groups or layers, which are the physical layer, data link layer, network layer and transport layer, session layer, presentation layer, and application layer. The tasks of the transport layer include error correction, segmentation / de-segmentation of data, flow control, etc. For example, the sending side of the transport layer divides the application message into segments (e.g., packets) and passes the segments to the network layer. The receiving side reassembles the segments into application messages and passes the application messages to the application layer. The transport layer uses the Transmission Control Protocol (TCP) and UDP to perform its tasks.

[0099] UDP is part of the Internet Protocol (IP) suite used by programs running on different computers on a network. UDP is used to send short messages called datagrams. UDP uses a simple transmission model but does not employ a handshake dialogue for reliability, sequencing, and data integrity. The protocol assumes that error checking and correction are not required, thus avoiding processing at the network interface level. Fig.19An IP packet 1902 in an illustrative embodiment is illustrated. The IP packet 1902 includes an IP header 1904 and an IP transport payload 1906. UDP operates on top of IP, so a UDP packet 1908 is carried in the IP transport payload 1906. The UDP packet 1908 has a structure of a UDP header 1910 and a UDP payload 1912. The first eight bytes of the UDP packet 1908 contain the UDP header 1910, while the remaining bytes contain the UDP payload 1912. The UDP header 1910 contains four fields, two bytes each: source port number, destination port number, datagram size (i.e., length field), and checksum. The UDP length field can be used as a way to decompose the IP transport payload 1906 into UDP user data 1914 and a remaining area 1916 (also referred to as a UDP option area). In other words, when the UDP length field indicates a smaller transport payload than that implied by the IP header 1904, the remaining area 1916 can be created. For example, in IPv4, the IP Total Length field indicates the total length of the IP datagram (including the IP header 1904), and the size of the IP options is indicated in the IP header (in 4-byte words) as "Internet Header Length" (IHL). Therefore, the typical (and maximum valid) value for the UDP length is: UDP_Length = IPv4_Total_Length - IPv4_IHL*4. For example, in IPv6, the IP Payload Length field indicates the transport payload following the basic IPv6 header, which includes the IPv6 extension headers and space available for the transport protocol. The length of any additional IP extensions is indicated in each extension, so the typical (and maximum valid) value for the UDP length is: UDP_Length = IPv6_Payload_Length - sum(Extension Header Length).

[0100] The remaining area 1916 may be used for UDP options 1918. UDP options 1918 are extensions of UDP for communicating remote parameters to the on-path network elements 1104, or for supporting optional transport functions. In one embodiment, the application metadata 1810 discussed above may be carried (i.e., inserted or included) as UDP options 1918 in the UDP packet 1908. One technical advantage is that the UDP options extension may be used to propagate explicit signals to the on-path network elements 1104.

[0101] Example 1

[0102] Fig. 20 is a K-based AF Therefore, in this example, K AFThe key 905 is used to encrypt the application metadata 1810 of the explicit signal 1124 to the network element 1104 on the path (i.e., the RAN node 1002 and / or the UPF 240). First, the UE 106 provides an indicator (referred to as the support indicator 2002) to the 5GC 104, indicating whether the UE 106 supports the metadata encryption scheme (e.g., encrypting the application metadata in the UDP option). The UE 106 can provide the support indicator 2002 to the AMF 212 via the NAS payload in the registration request message, and the AMF 212 can provide it to the UDM 218 during registration. Alternatively, the UE 106 can provide the support indicator 2002 to the AUSF 210 / UDM 218 during the primary authentication (i.e., in the authentication message).

[0103] In the non-roaming case, when UE 106 requests an application session from AF 222 using A-KID 804 (e.g., sends an application session establishment request message 911 to AF 222), AF 222 collaborates with 5GC 104 to authenticate UE 106 and obtains K from AAnF 536. AF Key 905. When the verification is successful, the AAnF 536 obtains the UE's ability to encrypt the application metadata 1810, such as by obtaining the support indicator 2002 from the UDM 218. When the UE 106 supports the metadata encryption scheme, the AAnF 536 prepares a list of UPF(s) 240 and / or RAN node(s) 1002 involved in the user plane network path 1024. For example, the AMF 212 stores information about the RAN node 1002 provisioned for the application session on the user plane network path 1024, and the SMF 214 stores information about the UPF 240 provisioned for the application session on the user plane network path 1024. Therefore, the AAnF 536 can query the AMF 212 and the SMF 214 to compile a list of UPF(s) 240 and / or RAN node(s) 1002.

[0104] Then, AAnF 536 will K AF The key 905 is propagated to the UPF(s) 240 and / or RAN node(s) 1002 in the list as key material 1812. In this embodiment, the AAnF 536 is an example of the control plane NF 110 as described above. To this end, the AAnF 536 transmits the key 905 to the SMF 214 via the SMF 214. AF The key 905 is pushed to one or more UPFs 240 provisioned on the user plane network path 1024 and / or is pushed to one or more UPFs 240 via the AMF(s) 212. AFThe key 905 is pushed to one or more RAN nodes 1002 provisioned on the user plane network path 1024. For the UPF 240, the AAnF 536 can subscribe to the UDM 218 to be notified whenever a new SMF 214 is registered, and the K AF The key 905 is pushed to the UPF 240. For the RAN node 1002, the AAnF 536 can subscribe to the UDM 218 to be notified whenever a new AMF 212 is registered, and the K AF The key 905 is pushed to the RAN node 1002. The AMF 212 can ensure that when the UE 106 moves to a new RAN 102, the AMF 212 provides the K to the RAN node(s) 1002 in the new RAN 102. AF Key 905. SMF 214 can ensure that when a new UPF 240 is selected, SMF 214 provides K to the new UPF 240. AF Key 905. AAnF 536 may repeatedly propagate K for each application session request. AF The key 905 process is as follows, because for each AF 222, a new K AF Key 905 is generated, and K AF Key 905 needs to be pushed to the registered SMF / UPF.

[0105] For application sessions, UE 106 also generates K AF Key 905. After the application session is established, UE 106 determines whether to provide application metadata 1810 for the application session to on-path network element 1104. If so, UE 106 uses K AF Key 905 is used to encrypt application metadata 1810. In this example, it is assumed that UE 106 sends user data for an application session in UDP packet 1908 carried in IP packet 1902. UE 106 uses K AF 905 to derive encryption key 1816, encrypt application metadata 1810 using encryption key 1816, and insert encrypted application metadata 1810 into remaining area 1916 of UDP payload 1912 (see Fig.19 ). In other words, the encrypted application metadata 1810 is sent as a UDP option 1918 of the UDP packet 1908. The UE 106 then sends the IP packet 1902 (see FIG. 1 ) over the user plane network path 1024 (such as to the application service 1010). Fig.10 ).

[0106] The RAN node 1002 on the user plane network path 1024 receives the IP packet 1902 with the encrypted application metadata 1810. The RAN node 1002 uses K AF Key 905 is used to decrypt the encrypted application metadata 1810 available in the UDP packet 1908. For example, the RAN node 1002 obtains the encrypted application metadata 1810 from K AF The RAN node 1002 derives a decryption key 1818 from the key 905 and uses the decryption key 1818 to decrypt the encrypted application metadata 1810. The RAN node 1002 then performs functions associated with the application session based on the decrypted application metadata 1810. For example, the RAN node 1002 can provide differentiated network services such as QoS based on the decrypted application metadata 1810. Similarly, the UPF 240 on the user plane network path 1024 receives the IP packet 1902 with the encrypted application metadata 1810. The UPF 240 uses the decryption key 1818 to decrypt the encrypted application metadata 1810. AF The AF 222 on the user plane network path 1024 receives the IP packet 1902 with the encrypted application metadata 1810 and uses the key 905 to decrypt the encrypted application metadata 1810 available in the UDP packet 1908 and perform functions associated with the application session based on the decrypted application metadata 1810. For example, the UPF 240 can provide differentiated network services such as QoS based on the decrypted application metadata 1810. Optionally, the AF 222 on the user plane network path 1024 receives the IP packet 1902 with the encrypted application metadata 1810 and uses the key 905 to decrypt the encrypted application metadata 1810 available in the UDP packet 1908 and perform functions associated with the application session based on the decrypted application metadata 1810. AF Key 905 decrypts the encrypted application metadata 1810 available in UDP packet 1908. One technical advantage is that the shared key material (i.e., K AF The key 905) is distributed to the on-path network element 1104 for the application session so that the endpoint can send the display signal to the on-path network element 1104 in the form of encrypted application metadata (ie, encrypted UDP options).

[0107] When the UE 106 does not support the metadata encryption scheme, but the metadata encryption scheme is supported by the trusted AF 222, K AKMA The key 803 may be distributed to the RAN node(s) 1002 and / or the UPF(s) 240 as key material 1812. This may be beneficial for unidirectional streaming content, such as video streaming.

[0108] Example 2

[0109] Fig.21is a signaling diagram for HPKE-based encryption in an illustrative embodiment. Thus, in this example, HPKE keys are used to encrypt application metadata for explicit signals to the network element 1104 on the path (i.e., (multiple) RAN nodes 1002 and / or (multiple) UPFs 240). First, the UE 106 provides an indicator (referred to as a support indicator 2002) to the 5GC 104, which indicates whether the UE 106 supports the metadata encryption scheme (e.g., encrypting application metadata in a UDP option). The UE 106 may provide the support indicator 2002 to the AMF 212 via a NAS payload in a registration request message, and the AMF 212 may provide the same to the UDM 218 during registration. Alternatively, the UE 106 may provide the support indicator 2002 to the AUSF 210 / UDM 218 during the primary authentication (i.e., in an authentication message).

[0110] In a non-roaming case, the UE 106 requests an application session from the AF 222 (e.g., sends an application session establishment request message 911 to the AF 222) using the A-KID 804. The UDM 218 (or any new NF or existing NF 110) obtains the UE capability to encrypt the application metadata, such as by obtaining or identifying a support indicator 2002 provided by the UE 106. When the UE 106 supports the metadata encryption scheme, for example, the UDM 218 prepares a list of (multiple) UPFs 240 and / or (multiple) RAN nodes 1002 involved in the user plane network path 1024. For example, the AMF 212 stores information about the RAN nodes 1002 provisioned for the application session on the user plane network path 1024, and the SMF 214 stores information about the UPFs 240 provisioned for the application session on the user plane network path 1024. Therefore, the UDM 218 may query the AMF 212 and the SMF 214 to compile a list of (multiple) UPFs 240 and / or (multiple) RAN nodes 1002.

[0111] The UDM 218 (or any new NF or existing NF 110) then propagates the HPKE key material 1814 to the UPF(s) 240 and / or RAN node(s) 1002 in the list. In this embodiment, the UDM 218 is an example of a control plane NF 110 as described above. To this end, the UDM 218 pushes the HPKE key material 1814 to one or more UPFs 240 provisioned on the user plane network path 1024 via the SMF 214, and / or pushes the HPKE key material 1814 to one or more RAN nodes 1002 provisioned on the user plane network path 1024 via the AMF(s) 212. The AMF 212 can ensure that when the UE 106 moves to a new RAN 102, the AMF 212 provides the HPKE key material 1814 to the RAN node(s) 1002 in the new RAN 102. SMF 214 may ensure that when a new UPF 240 is selected, SMF 214 provides HPKE key material 1814 to the new UPF 240.

[0112] The UDM 218 (or any new NF or existing NF 110) also pushes the HPKE key material 1814 to the UE 106. For example, the UDM 218 may invoke a UE Parameter Update (UPU) procedure to provide the HPKE key material 1814 to the UE 106. The UPU ensures that the data is protected while being delivered to the UE 106. Alternatively, the UDM 218 may send the HPKE key material 1814 to the AMF 212 serving the UE 106, and the AMF 212 delivers the HPKE key material 1814 to the UE 106 via the NAS protocol (i.e., a new payload in a NAS message).

[0113] After the application session is established, the UE 106 determines whether to provide application metadata 1810 to the on-path network element 1104 for the application session. If so, the UE 106 uses the HPKE key material 1814 to encrypt the application metadata 1810. In this example, it is assumed that the UE 106 sends user data for the application session in a UDP packet 1908 carried in an IP packet 1902. The UE 106 uses the HPKE key material 1814 to derive an encryption key 1816 and uses the encryption key 1816 to encrypt the application metadata 1810 for the application session. The HPKE key material 1814 includes a key identifier, a KEM ID, an HPKE public key, and an HPKE symmetric algorithm. The UE 106 generates a temporary public key (pkE) to perform encryption and inserts the encrypted application metadata 1810 into the remaining area 1916 of the UDP payload 1912 (see Fig.19). In other words, the encrypted application metadata 1810 is sent as a UDP option 1918 of the UDP packet 1908. The UE 106 also inserts the temporary public key (pKE) as the UDP option 1918. The UE 106 then sends the IP packet 1902 over the user plane network path 1024 (such as toward the application service 1010), (see Fig.10 ).

[0114] The RAN node 1002 on the user plane network path 1024 receives the IP packet 1902 with the encrypted application metadata 1810 and the temporary public key (pKE). The RAN node 1002 uses the HPKE key material 1814 and the temporary public key (pKE) to derive the decryption key 1818. The RAN node 1002 then uses the decryption key 1818 to decrypt the encrypted application metadata 1810 and performs functions associated with the application session based on the decrypted application metadata 1810. For example, the RAN node 1002 can provide differentiated network services such as QoS based on the decrypted application metadata 1810. Similarly, the UPF 240 on the user plane network path 1024 receives the IP packet 1902 with the encrypted application metadata 1810 and the temporary public key (pKE). The UPF 240 uses the HPKE key material 1814 and the temporary public key (pKE) to derive the decryption key 1818. The UPF 240 then decrypts the encrypted application metadata 1810 using the decryption key 1818 and performs functions associated with the application session based on the decrypted application metadata 1810. For example, the RAN node 1002 can provide differentiated network services, such as QoS, based on the decrypted application metadata 1810. Optionally, the AF 222 on the user plane network path 1024 receives the IP packet 1902 with the encrypted application metadata 1810 and uses the HPKE key material 1814 to decrypt the encrypted application metadata 1810 available in the UDP packet 1908. One technical advantage is that the shared key material 1812 (i.e., the HPKE key material) is distributed to the on-path network element 1104 for the application session so that the endpoint can send a display signal to the on-path network element 1104 in the form of encrypted application metadata (i.e., encrypted UDP options).

[0115] When the UE 106 does not support the metadata encryption scheme, but the metadata encryption scheme is supported by the trusted AF 222, K AKMA The key 803 may be distributed as key material 1812 to the RAN node(s) 1002 and / or the UPF(s) 240. This may be beneficial for unidirectional streaming content, such as video streaming.

[0116] The above examples are provided for non-roaming scenarios. The roaming scenario is similar to the non-roaming scenario. The HPLMN will K AF The key or HPKE key is pushed to the VPLMN SMF / UPF and AMF. In this way, the key material is available to the VPLMN RAN node 1002 and UPF 240, as well as the HPLMN UPF 240.

[0117] Any of the various elements or modules shown in the figure or described herein can be implemented as hardware, software, firmware or some combination thereof.For example, an element can be implemented as special hardware. Special hardware elements can be referred to as "processor", "controller" or some similar terms. When provided by a processor, the function can be provided by a single special processor, provided by a single shared processor or provided by a plurality of separate processors, some of which can be shared. In addition, the explicit use of the term "processor" or "controller" should not be interpreted as referring only to the hardware capable of executing software, and can implicitly include but not limited to digital signal processor (DSP) hardware, network processor, application specific integrated circuit (ASIC) or other circuit systems, field programmable gate array (FPGA), read-only memory (ROM), random access memory (RAM), non-volatile memory, logic or some other physical hardware components or modules for storing software.

[0118] In addition, the element can be implemented as an instruction that can be executed by a processor or a computer to perform the function of the element. Some examples of instructions are software, program code, and firmware. These instructions are operable when executed by a processor to instruct the processor to perform the function of the element. These instructions can be stored on a storage device that can be read by the processor. Some examples of storage devices are digital or solid-state memory, magnetic storage media (such as disks and tapes), hard drives, or optically readable digital data storage media.

[0119] As used in this application, the term "circuitry" may refer to one or more or all of the following:

[0120] (a) Hardware circuit implementation only (such as implementation in analog and / or digital circuitry only)

[0121] (b) a combination of hardware circuitry and software such as (where applicable):

[0122] (i) a combination of analog and / or digital hardware circuits and software / firmware; and

[0123] (ii) any portion of hardware processor(s) with software (including digital signal processor(s), software, and memory(s) that work together to enable a device (such as a mobile phone or server) to perform various functions; and

[0124] (c) Hardware circuit(s) and / or processor(s) that require software (e.g., firmware) to operate, such as microprocessor(s), or portions of microprocessor(s), but where the software is not required for operation, the software may not be present.

[0125] This definition of circuitry applies to all uses of the term in this application, including in any claims. As a further example, as used in this application, the term "circuitry" also covers an implementation of only a hardware circuit or processor (or multiple processors), or a portion of a hardware circuit or processor and its (or their) accompanying software and / or firmware. For example, and if applicable to a particular claim element, the term "circuitry" also covers a baseband integrated circuit or processor integrated circuit for a mobile device or a similar integrated circuit in a server, cellular network device, or other computing or network device.

[0126] Although specific embodiments are described herein, the scope of the present disclosure is not limited to these specific embodiments.The scope of the present disclosure is defined by the following claims and any equivalents thereof.

Claims

1. A method for sending application metadata to an on-path network element provisioned for an application session, the method comprising: establishing (1502) the application session between an application client running on a user device and an application service; identifying (1504) the application metadata associated with the application session; formatting (1506) a transport protocol packet using the application metadata; Based on the key material, deriving (1510) an encryption key; encrypting (1512) the application metadata in the transport protocol packet using the encryption key; as well as The transport protocol packet is sent (1514) over a user plane network path including one or more of the on-path network elements.

2. The method according to claim 1, wherein the deriving comprises: The encryption key is derived (1516 / 1518) from authentication and key management for application keys derived during primary authentication of the user device.

3. The method according to claim 1, wherein the deriving comprises: The encryption key is derived (1520) from hybrid public key encryption key material, wherein the hybrid public key encryption key material is received from at least a 5G core network.

4. The method according to claim 1, further comprising: determining (1602), at a control plane network function of at least the 5G core network, whether the user equipment supports a metadata encryption scheme; when the user equipment supports the metadata encryption scheme, identifying (1604), at the control plane network function, the on-path network elements provisioned on the user plane network path for the application session; At the control plane network function, identifying (1606) the key material; as well as The key material is sent (1608) to the one or more of the on-path network elements.

5. The method according to claim 4, further comprising: A support indicator is received (1612) at the control plane network function from the user equipment during primary authentication, the support indicator indicating whether the user equipment supports the metadata encryption scheme.

6. The method of claim 4, wherein identifying the network elements on the path comprises: A list of one or more user plane functions and / or one or more radio access network nodes on the user plane network path is compiled (1614).

7. The method according to claim 4, further comprising: receiving (1702) the key material sent by the control plane network function at one of the on-path network elements; receiving (1704), at said one of said on-path network elements, said transport protocol packet sent on said user plane network path; deriving (1706), at the one of the on-path network elements, a decryption key based on the key material received from the control plane network function; decrypting (1708) the encrypted application metadata in the transport protocol packet using the decryption key at the one of the on-path network elements; as well as At the one of the on-path network elements, a function associated with the application session is performed (1710) based on the decrypted application metadata.

8. The method of claim 7, wherein performing the function comprises: Based on the decrypted application metadata, quality of service for the application session is applied (1718).

9. A 5G system (100) supporting sending application metadata (1810) to a network element (1104) on a path provisioned for an application session, the 5G system comprising: means (1236) for establishing, at a user device (106), said application session between an application client (1006) running on said user device and an application service (1010); means for identifying, at the user device, the application metadata associated with the application session (1236); means (1236) for formatting a transport protocol packet (1802) at said user equipment using said application metadata; means (1236) for deriving, at the user device, an encryption key (1816) based on the key material (1812); means for encrypting, at the user device, the application metadata in the transport protocol packet using the encryption key (1236); as well as Means (1236) for sending the transport protocol packet at the user equipment over a user plane network path (1024), the user plane network path (1024) comprising one or more of the on-path network elements.

10. The 5G system according to claim 9, further comprising: means (1304) for determining, at a control plane network function (110) of at least a 5G core network (104), whether the user equipment supports a metadata encryption scheme; means (1304) for identifying, at the control plane network function, the on-path network elements provisioned on the user plane network path for the application session when the user equipment supports the metadata encryption scheme; means (1304) for identifying said key material at said control plane network function; as well as Means for sending the key material to the one or more of the on-path network elements (1302).

Images