Method for fusing quic protocol link establishment process and 5g nas process

Abstract

The application discloses a method for fusing a QUIC protocol link establishment process and a 5G NAS process, belongs to the field of Internet transmission protocols, and comprises the following steps: a terminal embeds a QUIC context descriptor (QCD) in a 5G NAS registration request, wherein the QCD contains a 64-bit connection identifier, a 4-bit maximum flow quantity field and a 1-bit pre-shared key request flag; an access management function on the network side analyzes the QCD and generates a KgNB key based on 5G AKA authentication, generates a QUIC pre-shared key through a key derivation function, and allocates a dynamic connection identifier list, wherein the list contains a main CID and a standby CID; a session management function issues a CID-QoS flow mapping rule to a user plane function through an N4 interface, and establishes a preconfigured QUIC connection context. The application embeds QUIC parameters in 5G NAS signaling through a terminal-side QUIC-NAS fusion module, realizes deep coupling of protocol stacks, reduces network interaction delay, quickly establishes a connection, returns the derived KgNB key to a network-side application end, and constructs a transmission layer security protection.

Description

Technical Field

[0001] This invention relates to the field of Internet transmission protocols, particularly a method for integrating the QUIC protocol link establishment process with 5G NAS processes. Background Technology

[0002] With the deep integration of 5G networks and Internet transmission protocols, the QUIC protocol, due to its multiplexing and 0-RTT connection characteristics, has gradually become a key technology for optimizing the performance of mobile communication transmission layers. Currently, in the 3GPP standard, the NAS process and the QUIC protocol stack still adopt a layered and independent design. Terminals must complete the 5G registration process before independently establishing a QUIC connection, leading to dual security handshakes and signaling redundancy issues. Especially in high-mobility scenarios, existing technologies need to maintain the NAS security context and QUIC transmission state separately. When a user equipment experiences base station handover, the traditional TCP / TLS protocol stack reconstruction process generates an average interruption latency of 300-500ms, making it difficult to meet the stringent end-to-end latency requirements of URLLC services. Furthermore, the independent negotiation mechanism results in a lack of coordinated management between the QUIC Connection Identifier (CID) and 5G QoS flows, and the UPF cannot pre-build the transmission context, causing an increase in first-packet transmission latency of over 80%.

[0003] Existing QUIC over 5G solutions primarily achieve this through application layer overlay, failing to effectively reuse the 5G AKA security architecture and NAS signaling channels. While using proxy servers to relay QUIC streams reduces IP exposure risks, it introduces additional hop counts. Although QUIC data is encapsulated at the PDCP layer, the issue of co-deriving the NAS layer security context and QUIC keys remains unresolved. Furthermore, deep coupling between transport layer connection parameters and 5G core network signaling is not achieved, necessitating a re-execution of the TLS handshake during mobile handover. Moreover, the integrity and confidentiality of QUIC parameter transmission cannot be guaranteed using NAS security protection mechanisms. Particularly in long-latency scenarios such as satellite communication, the lack of pre-established connection mechanisms in existing technologies results in service recovery times exceeding 800ms, significantly impacting user experience. Summary of the Invention

[0004] In view of the aforementioned existing problems, the present invention is proposed.

[0005] Therefore, this invention provides a method for integrating the QUIC protocol link establishment process with the 5G NAS process to solve the problems of excessively high mobile handover latency and poor service continuity caused by the independent layering of QUIC and 5G protocol stacks in the prior art.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0007] This invention provides a method for integrating the QUIC protocol link establishment process with the 5G NAS process, which includes a terminal-side QUIC-NAS fusion module, wherein the terminal embeds a QUIC context descriptor (QCD) in the 5G NAS registration request, and the QCD contains a 64-bit connection identifier, a 4-bit maximum flow count field, and a 1-bit pre-shared key request flag.

[0008] The network-side security collaboration module executes after parsing the QCD in the network-side access management function. Based on the KgNB key generated by 5G AKA authentication, it generates a QUIC pre-shared key through a key derivation function and allocates a dynamic connection identifier list, which includes a primary CID and a backup CID.

[0009] The transport context pre-build module allows the session management function to send CID-QoS flow mapping rules to the user plane function through the N4 interface and establish a pre-configured QUIC connection context.

[0010] The performance optimization module uses the QCD to transmit encrypted TLS SessionTickets via NAS Message Container. The connection identifier list is dynamically allocated from the global connection identifier pool through AMF. AMF obtains user equipment security capability information from unified data management through the user data management-subscription data acquisition service interface. After verifying the consistency between the user equipment identifier and the subscription data recorded by UDM, key derivation is obtained.

[0011] The transmission module pre-allocates dedicated hardware acceleration resources for the connection identifier associated with ultra-reliable low-latency communication service flows, sets a context aging timer, and sets a NAS registration timer as a periodic registration timer defined by the protocol. When the user equipment switches to the target base station, the source AMF transmits the following parameters to the target AMF through inter-AMF communication via the service interface.

[0012] The terminal policy decision submodule detects valid Transport Layer Security session tickets in the local cache of the user equipment, ensures that the QUIC version supported by the network matches the capabilities of the user equipment, and identifies latency-sensitive service characteristics of the user equipment. The AMF assigns a geographic area label to each connection label and triggers pre-migration when the user equipment leaves the label area. The UPF enables forward error correction coding for QUIC flows related to satellite links.

[0013] As a preferred embodiment of the method for integrating the QUIC protocol link establishment process with the 5G NAS process described in this invention, the terminal embeds a QUIC context descriptor (QCD) in the 5G NAS registration request. The QCD includes a 64-bit connection identifier, a 4-bit maximum flow count field, and a 1-bit pre-shared key request flag, and includes the following steps:

[0014] The locally cached TLS Session Ticket and UE capability information are used to obtain the QUIC enable decision. Based on the QUIC enable decision, a connection identifier (CID) is generated. According to the URLLC flow count, the maximum flow count value is obtained. Through the KgNB key availability status, a pre-shared key request flag is formed. The connection identifier, channel count, and key identifier are used to obtain a formatted protocol description block, base station key, and original session credentials. Protected cryptographic credentials are obtained. The cryptographic credentials and protocol description block are used to obtain a complete security signaling packet.

[0015] As a preferred embodiment of the method for integrating the QUIC protocol link establishment process with the 5G NAS process described in this invention, the following steps are included: After parsing the QCD, the network-side access management function executes the following steps: Based on the KgNB key generated by 5G AKA authentication, a QUIC pre-shared key is generated through a key derivation function; a dynamic connection identifier list is allocated, the list containing a primary CID and a backup CID; and the process includes the following steps.

[0016] The QCD information element in the NAS registration request sent by the terminal is parsed to extract the connection identifier, flow control parameters and security flag. The KgNB key generated by 5G AKA certification is verified and obtained. Based on the key, a pre-shared key K-QUIC dedicated to QUIC is generated through a key derivation function. The primary connection identifier is generated using K-QUIC and the base station identifier. The backup connection identifier is derived through a hash chain expansion algorithm to form a list containing the primary and backup CIDs.

[0017] As a preferred embodiment of the method for integrating the QUIC protocol link establishment process with the 5G NAS process described in this invention, the session management function issues CID-QoS flow mapping rules to the user plane function through the N4 interface to establish a pre-configured QUIC connection context, including the following steps:

[0018] Based on network policies and service requirements, QoS flow templates are generated. Combined with the connection identifier list issued by the access management function, CID-QoS flow mapping rules are constructed. The SMF encapsulates these mapping rules into PFCP session establishment request messages on the N4 interface and sends them to the user plane function. After receiving the message, the UPF configures the flow classifier according to the CID identifier and establishes a five-tuple packet detection rule. At the same time, hardware acceleration resources are pre-allocated according to QoS priority. The UPF uses the pre-shared key and flow mapping rules to pre-build a QUIC connection context that supports 0-RTT transmission.

[0019] As a preferred embodiment of the method for integrating the QUIC protocol link establishment process with the 5G NAS process described in this invention, the QCD transmits an encrypted TLS Session Ticket through the NAS Message Container, and the connection identifier list is dynamically allocated from the global connection identifier pool through the AMF, including the following steps:

[0020] The TLS Session Ticket is encrypted using the KgNB key with AES-256-GCM, and the encrypted session credential and QCD information elements are encapsulated together in the NAS Message Container. After receiving the NAS registration request, the AMF parses the container, obtains the decrypted QCD parameters and TLS credential, queries the global CID resource pool based on the AMF node identifier and the current load status, dynamically generates the primary CID using the K-QUIC key through a hash algorithm, and derives the backup CID through the offset.

[0021] The allocation results are synchronously updated to the global CID resource table of all AMF nodes. The AMF uses its private key to digitally sign the primary and backup CID lists, and encapsulates the signed connection identifier list together with the NAS security context into a RegistrationAccept message and returns it to the terminal.

[0022] As a preferred embodiment of the method for integrating the QUIC protocol link establishment process with the 5G NAS process described in this invention, the AMF obtains user equipment security capability information from the unified data management system through the user data management-subscription data acquisition service interface. After verifying the consistency between the user equipment identifier and the subscription data recorded by the UDM, key derivation is obtained, including the following steps.

[0023] The system initiates a query request to the UDM via the Nudm_SDM_Get service interface, carrying the user equipment identifier to obtain subscription data. After verifying the legality of the request, the UDM returns a subscription dataset containing security capability parameters. The AMF extracts the QUIC support flag and key derivation permission flag from it, and performs a consistency check by comparing the current identifier of the terminal with the subscription identifier stored in the UDM. The AMF then generates a security token based on the availability status of the KgNB key.

[0024] As a preferred embodiment of the method for integrating the QUIC protocol link establishment process with the 5G NAS process described in this invention, the method includes the following steps: pre-allocating dedicated hardware acceleration resources for the connection identifier associated with the ultra-reliable low-latency communication service flow, setting a context aging timer, and using a NAS registration timer defined by the protocol for periodic registration.

[0025] When a terminal identifies a URLLC service flow through the Max_Streams field in the QCD information element, the network side first queries the available hardware acceleration resource pool of the UPF based on the identifier, selects a suitable acceleration unit from it and establishes a binding relationship with the connection identifier, configures a queue-free scheduling and preemptive resource allocation strategy based on the binding relationship, initializes the context aging timer based on the periodic registration timer T3412 defined by the NAS protocol, and establishes a dynamic refresh mechanism to pause aging count when the service flow is in an active state.

[0026] As a preferred embodiment of the method for integrating the QUIC protocol link establishment process with the 5G NAS process described in this invention, when the user equipment switches to the target base station, the source AMF transmits the following parameters to the target AMF through inter-AMF communication, including the following steps:

[0027] The active QUIC context parameters are extracted from the user equipment's current connection state table and encapsulated together with the pre-shared key K-QUIC into a Namf_Communication_Transfer request message. The message is then digitally signed using the AMF private key to ensure integrity. After receiving the signed signaling, the target AMF verifies the validity of the context in conjunction with the target area policy. Once the verification is successful, the target AMF immediately issues a QoS traffic configuration command to the user plane function through the N4 interface.

[0028] As a preferred embodiment of the method for integrating the QUIC protocol link establishment process with the 5G NAS process described in this invention, the user equipment detects a valid Transport Layer Security (TLS) session ticket in its local cache, the network-supported QUIC version matches the user equipment's capabilities, and the user equipment's current service characteristics include a latency-sensitive service identifier. This includes the following steps:

[0029] The validity status of the locally stored encrypted TLS session ticket is checked. The QUIC protocol version broadcast on the network is compared with the capability set supported by the terminal itself to generate a version compatibility flag. The QoS flow attribute characteristics of the currently active service are analyzed to identify whether it contains a latency-sensitive service identifier. Logical judgment is made based on the three conditions of ticket validity status, version compatibility flag and service feature identifier to generate a QCD information element insertion instruction and trigger the QUIC acceleration process.

[0030] As a preferred embodiment of the method for integrating the QUIC protocol link establishment process with the 5G NAS process described in this invention, the AMF assigns a geographic area label to each connection identifier, triggers pre-migration when the user equipment leaves the label area, and the UPF enables forward error correction coding for QUIC flows related to the satellite link, including the following steps.

[0031] Based on base station location information and coverage area, a geographic area label containing latitude, longitude, and radius parameters is generated and bound to the primary and backup connection identifiers of the terminal to form a mapping table. When the location information reported by the terminal exceeds the original boundary, the AMF combines the target base station load status to generate a list of candidate CIDs for pre-migration and trigger the connection migration process in advance. For satellite link scenarios, the UPF dynamically derives the forward error correction level based on the Max_Streams field value in the QCD, configures RS coding parameters based on the level and real-time channel quality, and activates the corresponding error correction encoder.

[0032] The beneficial effects of this invention are as follows: By embedding QUIC parameters into 5G NAS signaling through the terminal-side QUIC-NAS fusion module, deep coupling of the protocol stack is achieved, reducing network interaction latency, quickly establishing connections, and returning the derived KgNB key to the network-side application, thus constructing transport layer security protection and innovatively forming a synergistic effect. The terminal side compresses signaling overhead through QCD information elements, and the network side pre-builds context to support 0-RTT transmission, achieving seamless migration in conjunction with the mobility module. Compared with traditional layered solutions, this design breaks through by binding the QUIC security context with 5G AKA. Through a flow-based resource scheduling paradigm, the end-to-end connection establishment process is compressed into a single stage while ensuring security, effectively solving latency bottlenecks and service continuity issues in high-mobility scenarios. Attached Figure Description

[0033] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0034] Figure 1 This is a schematic diagram of the method for integrating the QUIC protocol link establishment process with the 5G NAS process in Example 1.

[0035] Figure 2 This is a schematic diagram of the functional interaction of the QUIC-NAS converged protocol stack. Detailed Implementation

[0036] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0037] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0038] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0039] Reference Figure 1 and Figure 2 This is the first embodiment of the present invention. The embodiment provides a method for integrating the QUIC protocol link establishment process with the 5G NAS process, including the following steps:

[0040] The terminal-side QUIC-NAS converged module embeds a QUIC context descriptor (QCD) in the 5G NAS registration request. The QCD contains a 64-bit connection identifier, a 4-bit maximum flow count field, and a 1-bit pre-shared key request flag.

[0041] The terminal embeds a QUIC context descriptor (QCD) in the 5G NAS registration request. The QCD contains a 64-bit connection identifier, a 4-bit maximum flow count field, and a 1-bit pre-shared key request flag.

[0042] The locally cached TLS Session Ticket and UE capability information are used to obtain the QUIC enable decision. Based on the QUIC enable decision, a connection identifier (CID) is generated. According to the URLLC flow count, the maximum flow count value is obtained. Through the KgNB key availability status, a pre-shared key request flag is formed. The connection identifier, channel count, and key identifier are used to obtain a formatted protocol description block, base station key, and original session credentials. Protected cryptographic credentials are obtained. The cryptographic credentials and protocol description block are used to obtain a complete security signaling packet.

[0043] Furthermore, the terminal first checks whether a valid TLS Session Ticket exists in its local cache, and then makes a comprehensive judgment based on the user equipment's (UE) QUIC protocol support capability information to generate a QUIC enable decision. Based on the decision result, the terminal generates a 64-bit connection identifier (CID), which will serve as the unique identifier for the QUIC connection. According to current service requirements, especially the number of flows required for Ultra Reliable Low Latency Communication (URLLC) services, a 4-bit maximum flow count value is determined. The terminal checks the availability status of the KgNB key generated by 5G AKA authentication and sets a 1-bit pre-shared key request flag (PSK_Flag) accordingly. Subsequently, the terminal encapsulates the generated connection identifier, maximum flow count value, and key request flag to form a formatted QUIC context descriptor (QCD) protocol description block. The terminal uses the base station key (KgNB) to encrypt the original TLS Session Ticket using AES-256-GCM to generate a protected encrypted credential. Finally, the encrypted credential is combined with the QCD protocol description block to construct a complete secure signaling packet. This signaling packet will be transmitted via the NAS Message Container in 5G... Transmitted in the NAS registration request, it achieves secure and efficient integration of QUIC protocol parameters and 5G NAS signaling.

[0044] The network-side security collaboration module executes after parsing the QCD in the network-side access management function. Based on the KgNB key generated by 5G AKA authentication, it generates a QUIC pre-shared key through a key derivation function and allocates a dynamic connection identifier list, which includes a primary CID and a backup CID.

[0045] After parsing the QCD, the network-side access management function executes. Based on the KgNB key generated by 5G AKA authentication, it generates a QUIC pre-shared key through a key derivation function and allocates a dynamic connection identifier list, which includes a primary CID and a backup CID.

[0046] The QCD information element in the NAS registration request sent by the terminal is parsed to extract the connection identifier, flow control parameters and security flag. The KgNB key generated by 5G AKA certification is verified and obtained. Based on the key, a pre-shared key K-QUIC dedicated to QUIC is generated through a key derivation function. The primary connection identifier is generated using K-QUIC and the base station identifier. The backup connection identifier is derived through a hash chain expansion algorithm to form a list containing the primary and backup CIDs.

[0047] Furthermore, after receiving the 5G NAS registration request from the terminal, the network-side access management function first parses the QUIC context descriptor information element contained therein, extracting a 64-bit connection identifier, a 4-bit maximum flow quantity field, and a 1-bit pre-shared key request flag. Then, it verifies the validity of the KgNB key generated by the terminal during the 5G AKA authentication process. Based on the valid KgNB key, it calculates and generates a QUIC-specific pre-shared key K-QUIC using a key derivation function. Using K-QUIC and the identifier information of the current serving base station as input parameters, it generates a primary connection identifier using the HMAC-SHA256 hash algorithm. Based on the primary connection identifier, it derives a backup connection identifier by adding a sequence number offset and applying the hash algorithm again. Finally, it combines the primary and backup connection identifiers to form a dynamic connection identifier list, which is digitally signed and embedded into the 5G NAS registration reception message and returned to the terminal.

[0048] The transport context pre-build module allows the session management function to send CID-QoS flow mapping rules to the user plane function through the N4 interface and establish a pre-configured QUIC connection context.

[0049] The session management function sends CID-QoS flow mapping rules to the user plane function through the N4 interface and establishes a pre-configured QUIC connection context.

[0050] Based on network policies and service requirements, QoS flow templates are generated. Combined with the connection identifier list issued by the access management function, CID-QoS flow mapping rules are constructed. The SMF encapsulates these mapping rules into PFCP session establishment request messages on the N4 interface and sends them to the user plane function. After receiving the message, the UPF configures the flow classifier according to the CID identifier and establishes a five-tuple packet detection rule. At the same time, hardware acceleration resources are pre-allocated according to QoS priority. The UPF uses the pre-shared key and flow mapping rules to pre-build a QUIC connection context that supports 0-RTT transmission.

[0051] Furthermore, the session management function first generates a quality of service (QoS) flow template based on network policies in the 5G core network policy database and the current service requirements of the terminal. The template includes flow priority and bandwidth guarantee parameters. It then matches and associates the QoS flow template generated by the session management function with a dynamic connection identifier list containing primary and backup connection identifiers issued by the access management function, constructing a mapping rule between connection identifiers and QoS management flows. The session management function encapsulates this mapping rule into a PFCP session establishment request message format on the N4 interface and sends it to the user plane function via the N4 interface. Upon receiving the PFCP session establishment request message, the user plane function configures a flow classifier based on the connection identifier carried in the message and establishes packet detection rules based on the five-tuple and connection identifier. Simultaneously, the user plane function pre-allocates dedicated hardware acceleration resources for high-priority flows in the hardware resource pool based on the flow priority parameters in the QoS flow template. Finally, the user plane function utilizes the QUIC pre-shared key obtained from the session management function and the established connection identifier and QoS management flow mapping rule to pre-construct a QUIC connection context supporting zero round-trip latency transmission. This context contains complete security associations and flow state information.

[0052] In the performance optimization module, QCD transmits encrypted TLS SessionTickets through NAS Message Container. The connection identifier list is dynamically allocated from the global connection identifier pool through AMF. AMF obtains user equipment security capability information from unified data management through the user data management-subscription data acquisition service interface. After verifying the consistency between the user equipment identifier and the subscription data recorded in UDM, key derivation is obtained.

[0053] QCD transmits encrypted TLS Session Tickets via NAS Message Container, and the list of connection identifiers is dynamically allocated from the global connection identifier pool via AMF.

[0054] The TLS Session Ticket is encrypted using the KgNB key with AES-256-GCM, and the encrypted session credential and QCD information elements are encapsulated in the NAS Message Container. After receiving the NAS registration request, the AMF parses the container, obtains the decrypted QCD parameters and TLS credential, queries the global CID resource pool based on the AMF node identifier and the current load status, dynamically generates the primary CID using the K-QUIC key through a hash algorithm, and derives the backup CID through the offset.

[0055] Specifically, the expression is,

[0056] ;

[0057] in, For the QUIC pre-shared key derived from KgNB, A unique identifier for serving AMF, The current IP address of the user equipment. Use the first 64 bits of the hash result as the CID.

[0058] ;

[0059] in, Serial numbers maintained by AMF This is the identifier for the currently serving base station.

[0060] Furthermore, the terminal uses the KgNB key generated by 5G AKA authentication as the encryption key and employs the AES-256-GCM algorithm to encrypt the transport layer security session ticket. The encrypted transport layer security session ticket, along with a QUIC context descriptor containing a 64-bit connection identifier, a 4-bit maximum flow quantity field, and a 1-bit pre-shared key request flag, is encapsulated in a NAS message container with integrity protection. Upon receiving the 5GNAS registration request containing the NAS message container, the access management function first decrypts the NAS message container to obtain the QUIC context descriptor parameters and the decrypted transport layer security session ticket. The access management function then queries the global connection identifier resource pool based on its own node identifier information and current resource load status to determine the available connection identifier allocation range. Using the QUIC pre-shared key K-QUIC as the hash key, combined with the base station identifier information and sequence number parameters, the primary connection identifier is calculated using the HMAC-SHA256 algorithm. A preset offset is added to the primary connection identifier, and the hash algorithm is applied again to calculate and generate a backup connection identifier. Finally, the primary and backup connection identifiers are combined to form a dynamic connection identifier list, which is digitally signed by the access management function and returned to the terminal.

[0061] The allocation results are synchronously updated to the global CID resource table of all AMF nodes. The AMF uses its private key to digitally sign the primary and backup CID lists, and encapsulates the signed connection identifier list together with the NAS security context into a RegistrationAccept message and returns it to the terminal.

[0062] Furthermore, the access management function synchronously updates the generated primary and backup connection identifier allocation results to the global connection identifier resource pool of all access management function nodes through the internal interface of the 5G core network, ensuring the consistency of resource status of each node. The access management function uses its own private key to digitally sign the list containing the primary and backup connection identifiers, using the ECDSA-secp256r1 signing algorithm. The digitally signed connection identifier list and 5G NAS security context parameters (including integrity protection key and encryption key) are encapsulated together in the 5G NAS registration and reception message. The access management function sends the complete 5G NAS registration and reception message to the terminal through the NGAP interface. The message contains all the security parameters and resource configuration information required for QUIC connection. After receiving the 5G NAS registration and reception message, the terminal can immediately establish a QUIC connection using the connection identifier list and security context provided in the message, without the need for additional negotiation.

[0063] AMF obtains user equipment security capability information from the unified data management system through the user data management-subscription data acquisition service interface. After verifying the consistency between the user equipment identifier and the subscription data recorded in the UDM, it obtains the key derivation.

[0064] The system initiates a query request to the UDM via the Nudm_SDM_Get service interface, carrying the user equipment identifier to obtain subscription data. After verifying the legality of the request, the UDM returns a subscription dataset containing security capability parameters. The AMF extracts the QUIC support flag and key derivation permission flag from it, and performs a consistency check by comparing the current identifier of the terminal with the subscription identifier stored in the UDM. The AMF then generates a security token based on the availability status of the KgNB key.

[0065] Furthermore, the access management function sends a query request to the unified data management system via the Nudm_SDM_Get service interface. The request message carries the user equipment's permanent identifier (SUPI) or temporary identifier (5G-GUTI). Upon receiving the query request, the unified data management system first verifies the access management function's access permissions and the integrity of the request message. After confirming its legitimacy, it retrieves the subscription data corresponding to the user equipment identifier from the subscription database. The unified data management system returns the subscription dataset containing the user equipment's security capability parameters to the access management function via a Nudm_SDM_Get response message. The access management function extracts the QUIC protocol support flag and key derivation permission indicator from the subscription dataset. The access management function compares the currently used identifier information of the user equipment with the subscription identifier information returned by the unified data management system item by item, including fields such as identifier type, identifier value, and validity period. After the identifier consistency verification is passed, the access management function checks the 5G... The availability status of the KgNB key generated during the AKA authentication process includes key validity and remaining lifespan; the access management function generates a security token based on the QUIC protocol support flag, key derivation permission indicator, and KgNB key status. The token contains QUIC pre-shared key derivation authorization information and validity period limit.

[0066] The transmission module pre-allocates dedicated hardware acceleration resources for the connection identifier associated with ultra-reliable low-latency communication service flows, sets a context aging timer, and sets a NAS registration timer as a periodic registration timer defined by the protocol. When the user equipment switches to the target base station, the source AMF transmits the following parameters to the target AMF through inter-AMF communication, and the service interface passes the following parameters to the target AMF.

[0067] For connection identifiers associated with ultra-reliable low-latency communication service flows, dedicated hardware acceleration resources are pre-allocated, context aging timers are set, and NAS registration timers are periodic registration timers defined by the protocol.

[0068] When a terminal identifies a URLLC service flow through the Max_Streams field in the QCD information element, the network side first queries the available hardware acceleration resource pool of the UPF based on the identifier, selects a suitable acceleration unit from it and establishes a binding relationship with the connection identifier, configures a queue-free scheduling and preemptive resource allocation strategy based on the binding relationship, initializes the context aging timer based on the periodic registration timer T3412 defined by the NAS protocol, and establishes a dynamic refresh mechanism to pause aging count when the service flow is in an active state.

[0069] Furthermore, when the terminal identifies the ultra-reliable low-latency communication service flow through the Max_Streams field in the QUIC context descriptor information element, the session management function first queries the available hardware acceleration resource pool status information of the user plane function based on the identifier, and selects dedicated hardware acceleration processing units that meet the low latency requirements from the resource pool. The session management function establishes a one-to-one binding relationship between the selected hardware acceleration processing units and the QUIC connection identifier, and records the binding relationship in the user plane function. Based on the established binding relationship between the hardware acceleration processing units and the connection identifier, the session management function configures a queue-free scheduling strategy and a preemptive resource allocation strategy in the user plane function to ensure that the ultra-reliable low-latency communication service flow obtains hardware resources first. The session management function calculates the initial value of the QUIC connection context aging timer based on the current value of the periodic registration timer T3412 defined by the 5G NAS protocol. The session management function establishes a dynamic refresh mechanism in the user plane function. When the ultra-reliable low-latency communication service flow is detected to be in an active data transmission state, the counting operation of the context aging timer is automatically paused, and the timer counting is resumed when the service flow is idle.

[0070] When a user equipment switches to a target base station, the source AMF transmits the following parameters to the target AMF through inter-AMF communication and the service interface.

[0071] The active QUIC context parameters are extracted from the user equipment's current connection state table and encapsulated together with the pre-shared key K-QUIC into a Namf_Communication_Transfer request message. The message is then digitally signed using the AMF private key to ensure integrity. After receiving the signed signaling, the target AMF verifies the validity of the context in conjunction with the target area policy. Once the verification is successful, the target AMF immediately issues a QoS traffic configuration command to the user plane function through the N4 interface.

[0072] Furthermore, the source access management function retrieves active QUIC connection parameters from the user equipment's current connection status table, including the primary connection identifier, backup connection identifier, flow sequence number, and QUIC pre-shared key K-QUIC; encapsulates these parameters according to the format defined by the Namf_Communication_Transfer service interface to form a complete handover request message; the source access management function uses its own private key to digitally sign the Namf_Communication_Transfer request message using the ECDSA-secp256r1 algorithm, generating a message integrity protection value; the target access management function receives... Upon receiving the signed Namf_Communication_Transfer request message, the message signature and the identity of the source access management function are first verified. The target access management function verifies the validity of the QUIC connection context parameters based on the target base station area policy and the current network load status. After successful verification, the target access management function sends a PFCP session modification request message to the target user plane function through the N4 interface. The message contains the remapping rules between the QUIC connection identifier and the quality of service flow. The target user plane function updates the flow classification rules and resource allocation policies according to the PFCP session modification request message, completing the QUIC connection context migration during the handover process.

[0073] The terminal policy decision submodule detects valid Transport Layer Security session tickets in the local cache of the user equipment, ensures that the QUIC version supported by the network matches the capabilities of the user equipment, and identifies latency-sensitive service characteristics of the user equipment. The AMF assigns a geographic area label to each connection label and triggers pre-migration when the user equipment leaves the label area. The UPF enables forward error correction coding for QUIC flows related to satellite links.

[0074] The user equipment (UE) detects a valid Transport Layer Security (TLS) session ticket in its local cache, confirms that the network-supported QUIC version matches the UE's capabilities, and that the UE's current service characteristics include a latency-sensitive service identifier.

[0075] The validity status of the locally stored encrypted TLS session ticket is checked. The QUIC protocol version broadcast on the network is compared with the capability set supported by the terminal itself to generate a version compatibility flag. The QoS flow attribute characteristics of the currently active service are analyzed to identify whether it contains a latency-sensitive service identifier. Logical judgment is made based on the three conditions of ticket validity status, version compatibility flag and service feature identifier to generate a QCD information element insertion instruction and trigger the QUIC acceleration process.

[0076] Furthermore, the terminal first verifies the validity of the locally stored encrypted transport layer security session ticket, checking the ticket expiration time and integrity check value. The terminal then compares the received QUIC protocol version information broadcast from the network side with the QUIC capability set stored internally, generating a binary version compatibility flag. The terminal analyzes the attribute parameters of all currently active Quality of Service (QoS) flows, identifying service flows marked as Ultra-Reliable Low-Latency Communication (ULLC). The terminal establishes a three-state logic judgment condition, using the transport layer security session ticket validity status, the QUIC version compatibility flag, and the ULC as input parameters. Only when the transport layer security session ticket is valid, the QUIC version is compatible, and ULC exists, the terminal generates a QUIC context descriptor information element insertion control signal. Based on the control signal, the terminal triggers the QUIC acceleration process, embedding a QUIC context descriptor information element containing a 64-bit connection identifier, a 4-bit maximum flow quantity field, and a 1-bit pre-shared key request flag into the 5G NAS registration request message.

[0077] AMF assigns a geographic area label to each connection identifier. Pre-migration is triggered when the user equipment leaves the labeled area. UPF enables forward error correction coding for QUIC flows related to the satellite link, including the following steps.

[0078] Based on base station location information and coverage area, a geographic area label containing latitude, longitude, and radius parameters is generated and bound to the primary and backup connection identifiers of the terminal to form a mapping table. When the location information reported by the terminal exceeds the original boundary, the AMF combines the target base station load status to generate a list of candidate CIDs for pre-migration and trigger the connection migration process in advance. For satellite link scenarios, the UPF dynamically derives the forward error correction level based on the Max_Streams field value in the QCD, configures RS coding parameters based on the level and real-time channel quality, and activates the corresponding error correction encoder.

[0079] Furthermore, the access management function generates geographic area labels based on the latitude and longitude coordinates and wireless coverage radius parameters of the serving base station. These labels include the center point coordinates and coverage radius value. The access management function binds the geographic area labels to the terminal's primary and backup connection identifiers, forming a mapping table between connection identifiers and geographic areas. When the GPS location information reported by the terminal exceeds the boundary defined by the original geographic area label, the access management function queries the load status information of the target base station area. Based on the target base station's load status and resource availability, the access management function selects and generates a pre-migration candidate connection identifier list from the backup connection identifiers. The access management function sends this candidate connection identifier list to the target access management function in advance via a service interface, initiating the connection pre-migration process. In satellite communication scenarios, the user plane function parses the Max_Streams field value in the QUIC context descriptor information element and calculates the forward error correction level according to a preset formula. The user plane function dynamically adjusts the redundancy parameters of the Reed-Solomon coding based on real-time measured satellite channel quality indicators. The user plane function activates the configured forward error correction encoder in the data plane to perform real-time encoding and decoding processing on the QUIC data packets transmitted via the satellite link.

[0080] In summary, this invention achieves deep coupling of the protocol stack by embedding QUIC parameters into 5G NAS signaling through a terminal-side QUIC-NAS fusion module. This reduces network interaction latency, enables rapid connection establishment, and allows the derived KgNB key to be returned to the network-side application, constructing transport layer security protection and creating an innovative synergistic effect. The terminal side compresses signaling overhead through QCD information elements, and the network side pre-builds contexts to support 0-RTT transmission, enabling seamless migration in conjunction with the mobility module. Compared to traditional layered solutions, this design innovatively binds the QUIC security context with 5G AKA. Through a flow-based resource scheduling paradigm, it compresses the end-to-end connection establishment process into a single stage while ensuring security, effectively solving latency bottlenecks and service continuity issues in high-mobility scenarios.

[0081] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for fusing a QUIC protocol link establishment process and a 5G NAS process, characterized in that: Comprising, The terminal side QUIC-NAS fusion module, the terminal embeds the QUIC context descriptor (QCD) in the 5G NAS registration request, the QCD contains 64-bit connection identifier, 4-bit maximum flow number field, 1-bit pre-shared key request flag; Network side security cooperation module, the network side access management function is executed after parsing QCD, based on KgNB key generated by 5G AKA authentication, generate QUIC pre-shared key through key derivation function, allocate dynamic connection identifier list, the list contains main CID and a standby CID; Transmission context pre-modeling module, the session management function issues CID-QoS flow mapping rules to the user plane function through N4 interface, and establishes pre-configured QUIC connection context; Performance optimization module, the QCD transmits encrypted TLS SessionTicket through NAS Message Container, the connection identifier list is dynamically allocated by AMF from the global connection identifier pool, AMF obtains user equipment security capability information from unified data management through user data management-subscription data acquisition service interface, verifies the consistency of the user equipment identifier and the subscription data recorded in UDM, and obtains key derivation; Transmission module, the connection identifier associated with the ultra-reliable low-latency communication service flow is pre-allocated with special hardware acceleration resources, and a context aging timer is set. The NAS registration timer is the periodic registration timer defined by the protocol; When the user equipment switches to the target base station, the source AMF transmits through inter-AMF communication, and the service interface transmits the following parameters to the target AMF; Terminal policy decision sub-module, the user equipment detects the valid transmission layer security session ticket in local cache, the network supported QUIC version matches the user equipment capability, the user equipment current service characteristics contain delay sensitive service identifier, the AMF allocates geographical area label for each connection identifier, triggers pre-migration when the user equipment leaves the label area, and the UPF enables forward error correction coding for satellite link related QUIC flow.

2. The method of claim 1, wherein the QUIC protocol link establishment procedure is fused with the 5G NAS procedure. The terminal embeds the QUIC context descriptor (QCD) in the 5G NAS registration request, the QCD contains 64-bit connection identifier, 4-bit maximum flow number field, 1-bit pre-shared key request flag, including the following steps, The locally cached TLS Session Ticket and UE capability information obtain the QUIC enabling decision, based on the QUIC enabling decision, the generated connection identifier CID, according to the URLLC flow number, the maximum flow number value is obtained, the pre-shared key request flag is formed through the KgNB key available state, the connection identifier, the channel number and the key identifier, the formatted protocol description block is obtained, the base station key and the original session credential are obtained, the protected encrypted credential is obtained, and the encrypted credential and the protocol description block obtain the complete security signaling package. 3.The method of claim 2, wherein: The network side access management function parses the QCD and performs, based on the KgNB key generated by the 5G AKA authentication, a key derivation function to generate a QUIC pre-shared key, and allocates a dynamic connection identifier list, which includes a main CID and a backup CID, including the following steps, The QCD information element in the NAS registration request sent by the terminal is parsed, the connection identifier, flow control parameter and security flag are extracted, the KgNB key generated by the 5G AKA authentication is verified and obtained, the key derivation function is used to generate a QUIC-specific pre-shared key K-QUIC based on the key, the main connection identifier is generated using K-QUIC and the base station identifier, and the backup connection identifier is derived through a hash chain expansion algorithm, forming a list containing the main and backup CIDs.

4. The method of claim 3, wherein the QUIC protocol link establishment procedure is fused with the 5G NAS procedure. The session management function sends the CID-QoS flow mapping rule to the user plane function through the N4 interface to establish the pre-configured QUIC connection context, Including the following steps, The QoS flow template is generated according to the network policy and business demand, the connection identifier list is constructed in combination with the access management function, the SMF encapsulates these mapping rules as a PFCP session establishment request message of the N4 interface and sends them to the user plane function, the UPF configures a flow classifier and establishes a five-tuple packet detection rule according to the CID identifier after receiving, and pre-allocates hardware acceleration resources according to the QoS priority, and the UPF uses the pre-shared key and the flow mapping rule to pre-build the QUIC connection context supporting 0-RTT transmission.

5. The method of claim 4, wherein the QUIC protocol link establishment procedure is fused with the 5G NAS procedure. The QCD transmits the encrypted TLS Session Ticket through the NAS Message Container, and the connection identifier list is dynamically allocated by the AMF from the global connection identifier pool, including the following steps, The KgNB key is used to encrypt the TLS Session Ticket by AES-256-GCM, and the encrypted session credential is encapsulated into the NAS Message Container together with the QCD information element, the AMF parses the container after receiving the NAS registration request, obtains the decrypted QCD parameters and TLS credentials, queries the global CID resource pool according to the AMF node identifier and the current load state, and dynamically generates the main CID and the backup CID through the hash algorithm using the K-QUIC key; The allocation result is updated in the global CID resource table of all AMF nodes, and the AMF uses a private key to digitally sign the main and backup CID lists, and returns the signed connection identifier list and the NAS security context to the terminal in the RegistrationAccept message.

6. The method of claim 5, wherein the QUIC protocol link establishment procedure is fused with the 5G NAS procedure. The AMF obtains the user equipment security capability information from the unified data management through the user data management-subscription data service interface, verifies the consistency of the user equipment identifier and the subscription data recorded in the UDM, and derives the key derivation, including the following steps, The query request is initiated to the UDM through the Nudm_SDM_Get service interface, carries the user equipment identifier to obtain the subscription data, the UDM returns the subscription data set containing the security capability parameter after verifying the legality of the request, the AMF extracts the QUIC support flag and key derivation permission identifier from the subscription data set, and performs consistency check on the current identifier of the terminal and the subscription identifier stored in the UDM, and the AMF generates a security token in combination with the available state of the KgNB key.

7. The method of claim 6, wherein the QUIC protocol link establishment procedure is fused with the 5G NAS procedure. The connection identifier associated with the ultra-reliable low-latency communication service flow is pre-assigned with dedicated hardware acceleration resources, a context aging timer is set, and a NAS registration timer is a periodic registration timer defined by the protocol, including the following steps, When the terminal identifies the URLLC service flow through the Max_Streams field in the QCD information element, the network side first queries the available hardware acceleration resource pool of the UPF according to the identification, selects a suitable acceleration unit from the pool, and establishes a binding relationship with the connection identifier, configures a queue-free scheduling and pre-emptive resource allocation strategy based on the binding relationship, takes the periodic registration timer T3412 defined by the NAS protocol as a reference to initialize the context aging timer, and establishes a dynamic refreshing mechanism to suspend the aging count when the service flow is in an active state.

8. The method of claim 7, wherein the QUIC protocol link establishment procedure is fused with the 5G NAS procedure. When the user equipment switches to the target base station, the source AMF transmits the following parameters to the target AMF through inter-AMF communication transmission, including the following steps, The active QUIC context parameters are extracted from the user equipment current connection state table and encapsulated into the Namf_Communication_Transfer request message together with the pre-shared key K-QUIC, and the message is digitally signed using the AMF private key to ensure integrity, and the target AMF verifies the validity of the context after receiving the signed signaling, and immediately issues a QoS traffic configuration instruction to the user plane function through the N4 interface after verification. 9.The method of claim 8, wherein: The user equipment detects the locally cached valid transport layer security session ticket, the QUIC version supported by the network matches the user equipment capability, and the current service characteristics of the user equipment include delay-sensitive service identification, Including the following steps, Check the validity state of the locally stored encrypted TLS session ticket, compare the QUIC protocol version broadcast by the network with the capability set supported by the terminal itself, generate a version compatibility flag, analyze the QoS flow attribute characteristics of the currently activated service, identify whether it contains delay-sensitive service identification, and comprehensively judge the three conditions of ticket validity state, version compatibility flag and service characteristic identification, generate QCD information element insertion instruction, and trigger the QUIC acceleration process. 10.The method of claim 9, wherein: The AMF allocates a geographical area label for each connection identifier, triggers pre-migration when the user equipment leaves the label area, and the UPF enables forward error correction coding for the satellite link related QUIC flow, Including the following steps, Based on base station location information and coverage range, a geographic area label containing latitude and longitude and radius parameters is generated, which is bound with the primary and backup connection identifiers of the terminal to form a mapping table. When the location information reported by the terminal exceeds the original boundary, the AMF generates a candidate CID list for pre-migration in combination with the load state of the target base station, and triggers the connection migration process in advance. For satellite link scenarios, the UPF dynamically derives the forward error correction level based on the Max_Streams field value in the QCD, configures the RS encoding parameters based on the level and real-time channel quality, and activates the corresponding error correction encoder.

Images