Indirect Data Forwarding ACL Enforcement in S1 and NG Handovers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current 3GPP technical specifications do not allow the core network function to include the source address in the Handover Request message during S1 and NG handovers, leading to challenges in supporting Access Control Lists (ACLs) for indirect data forwarding, as the GTP-U source address is not significant in packet processing and not negotiated between tunnel endpoints.
Innovation Solution
A method is introduced where a network function, such as the MME or SMF, receives a handover-related message and transmits a request to establish a forwarding tunnel, obtaining a response with the source address to be used by the target RAN node, which is then communicated to the target RAN node or another network function to enforce ACLs by verifying and discarding packets from invalid source addresses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the source address is not included in the Handover Request message, then the handover procedure remains simple and compatible with existing specifications, but ACL control for indirect data forwarding cannot be implemented
Solution Approach 1:
The solution segments the source address information into separate components: the GTP-U TEID is included in the Handover Request, while the actual source IP address is obtained through a separate request to the UPF. This segmentation allows ACL control to be implemented without fundamentally changing the existing handover procedure structure.
Solution Approach 2:
The network function performs preliminary actions by first requesting and obtaining the source IP address from the UPF before including it in the Handover Request message. This preliminary retrieval of address information enables ACL control to be prepared in advance without disrupting the main handover flow.
2Reliability
If the GTP-U source address is made significant for packet processing, then ACL control becomes possible, but the existing GTP-U packet processing mechanism is disrupted
Solution Approach 1:
The network function acts as an intermediary between the UPF and the target RAN node. It retrieves the source IP address from the UPF and forwards this information to the target RAN node, enabling ACL control without requiring changes to the fundamental GTP-U packet processing mechanism at the radio access network level.
Solution Approach 2:
The solution extracts the source IP address information from the UPF (User Plane Function) and separates it from the GTP-U packet processing. By taking out the address information retrieval operation and handling it separately through the network function, the existing GTP-U packet processing mechanism remains largely intact while enabling ACL control.
3Reliability
If the source address is obtained through additional signaling, then ACL control can be enforced, but the handover time is increased
Solution Approach 1:
The network function performs the address retrieval action in advance, before the handover execution phase. By obtaining the source IP address from the UPF during the preparation phase and including it in the Handover Request, the actual handover execution does not need to wait for additional address retrieval, thus minimizing time impact.
Solution Approach 2:
The network function uses feedback from the UPF regarding the source IP address to inform the Handover Request message. This feedback mechanism ensures that the correct address information is available for ACL control without requiring repeated signaling during the handover process itself.
Data Source
AI summary
A method (500) performed by a first network function. The method includes receiving a handover related message related to a handover of UE from a source RAN node to a target RAN node. The method also includes after receiving the handover related message, transmitting to a second network function a request message for establishing a forwarding tunnel. The method also includes receiving a response message transmitted by the second network function, wherein the response message is responsive to the request message for establishing a forwarding tunnel, and further wherein the response message comprises an address that the second network function will use as a source address when forwarding packets for the UE via the established forwarding tunnel to the target RAN node. The method also includes after receiving the response message, transmitting a message comprising the source address, wherein the message is transmitted to: i) the target RAN node or ii) a third network function that is configured to transmit the source address to the target RAN node.