5G Network Function Messaging with Selective SEPP Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In 5G networks, securing messages exchanged between network functions across different PLMNs through roaming interfaces is challenging, as intermediaries modify parts of HTTP messages without proper integrity protection and modification tracking, compromising security.
Innovation Solution
Implementing a Security Edge Proxy (SEPP) that encrypts, integrity protects, and tracks modifications of message parts using JSON Web Encryption (JWE) and JSON Web Signature (JWS), allowing authorized intermediaries to modify specific message parts while ensuring integrity and authenticity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If intermediaries modify parts of HTTP messages to enable authorized modifications, then adaptability is improved, but integrity protection deteriorates
Solution Approach 1:
The SEPP applies integrity protection and encryption to message parts before they are transmitted through intermediaries. By pre-establishing security measures on protected message parts, the system enables intermediaries to modify non-protected parts while maintaining integrity verification for protected parts, thus resolving the contradiction between adaptability and integrity protection
Solution Approach 2:
The message is divided into protected message parts and non-protected message parts. The SEPP selectively applies integrity protection and encryption only to specific parts that require security, while leaving other parts modifiable by intermediaries. This segmentation allows simultaneous authorized modifications and integrity protection
2Reliability
If SEPP applies encryption and integrity protection to all message parts, then security is improved, but modification capability deteriorates
Solution Approach 1:
The SEPP applies different security measures to different parts of the message based on their specific requirements. Protected message parts receive encryption and integrity protection, while non-protected parts remain accessible for intermediary modifications. This local differentiation resolves the contradiction by providing security where needed while preserving modification capability where appropriate
3Reliability
If modification tracking is implemented to detect changes, then integrity protection is improved, but device complexity deteriorates
Solution Approach 1:
The SEPP acts as an intermediary that implements modification tracking by comparing received messages against stored protected message parts. This mediator approach centralizes the complexity of integrity verification in the SEPP nodes while keeping intermediate nodes simpler, resolving the contradiction between improved integrity protection and reduced overall system complexity
Data Source
Figure 1~2
Figure 3~4
Figure 5~8
AI summary
A sending security edge proxy SEPP receives a first message sent by a first network function to a second network function. The first message has a plurality of first message parts including: a request line or a response line; at least one header; and payload. Second message parts are formed from the features and optional sub-features of the first message parts. A security structure defines a required security measure individually for each second message part. The SEPP applies, according to the security structure definition, to each second message part by encrypting; integrity protecting; or modification tracking with integrity protecting; and forms a second message that contains the second message parts; and sends the second message towards the second network function. Corresponding methods, structures, computer programs and a system are disclosed for intermediate nodes and receiving SEPP.