5G SBI Selective Encryption with Headers for End-to-End Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a need for a mechanism to protect sensitive data transmitted in 5G and subsequent generation networks, as existing methods like HTTPS are not universally used, and TLS encryption is inefficient and lacks end-to-end security.
Innovation Solution
The method involves receiving or generating a Service Based Interface (SBI) request message, identifying the next-hop network function (NF), determining if it supports encrypted SBI request message parameters, and accordingly encrypting selected parameters, adding headers for identification and decryption, and transmitting the message.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If TLS encryption is used to secure data transfers, then data protection is improved, but encryption efficiency deteriorates and end-to-end security cannot be guaranteed across multiple network hops
Solution Approach 1:
The patent segments the data protection approach by encrypting only selected sensitive parameters (SUPI, GPSI, PEI, subscription data, policy data) rather than the entire transport layer payload. This selective encryption is implemented through a data protector that identifies and encrypts only the necessary sensitive elements in SBI request messages, significantly improving encryption efficiency while maintaining data protection for critical information.
Solution Approach 2:
The patent implements preliminary action by establishing end-to-end encryption capability before data transmission. The data protector encrypts sensitive parameters at the source (consumer NF or SCP) before the data enters the network transport layer. This preliminary encryption ensures that sensitive data remains protected throughout its journey across multiple network hops, eliminating the need for repeated decryption and re-encryption at each hop.
2Reliability
If TLS encryption is applied to all data transfers, then data security is improved, but device complexity and operational overhead increase
Solution Approach 1:
The patent applies local quality by implementing encryption only where and when it is needed - specifically for sensitive parameters in SBI request messages. The data protector selectively encrypts only certain parameters (SUPI, GPSI, PEI, subscription data, policy data) while leaving other non-sensitive data in plaintext. This localized approach to encryption reduces the complexity of implementation compared to universal TLS encryption, as it only affects specific data elements rather than the entire communication stream.
3Productivity
If selective parameter encryption is implemented, then encryption efficiency is improved, but the complexity of identifying and managing encrypted parameters increases
Solution Approach 1:
The patent implements feedback through header mechanisms that provide information about encrypted parameters. The data protector adds headers to SBI request messages that indicate which parameters have been encrypted and provide necessary decryption information. This feedback mechanism allows receiving nodes (producer NFs, SCPs, SEPPs) to automatically identify and handle encrypted parameters without requiring complex manual configuration or management, thus reducing the perceived complexity despite the selective encryption approach.
Data Source
AI summary
According to another aspect of the subject matter described herein, includes receiving or generating a service based interface (SBI) request message. The method further includes identifying a next-hop network function (NF) of the SBI request message. The method further includes determining, from a registered profile of the next-hop NF, whether the next-hop NF supports handling of encrypted SBI request message parameters. The method further includes in response to determining that the next-hop NF supports handling of encrypted SBI request message parameters: encrypting selected SBI request message parameters; adding one or more headers to the SBI request message or updating one or more headers in the SBI request message to facilitate identification and decryption of the encrypted SBI request message parameters; and transmitting the SBI request message to the next-hop NF.