AKMA Context Deletion for Secure Subscription Data Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In the 5G network, when user subscription data is updated, the AKMA context is retained by network function nodes, potentially allowing attackers to abuse AKMA traffic.
Innovation Solution
A method and apparatus that ensures network function nodes delete the AKMA context upon subscription data updates by determining and communicating with the appropriate nodes to manage and update the AKMA context, preventing retention and abuse.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the AKMA context is retained by network function nodes after subscription data update, then the network function can maintain service continuity, but the security risk increases as attackers can abuse the retained AKMA traffic
Solution Approach 1:
The patent applies preliminary action by notifying the AAnF node about the upcoming subscription data update before it occurs. The AMF sends a notification message to the AAnF node in advance, allowing the AAnF to proactively delete the AKMA context associated with the affected SUPI. This preemptive deletion prevents the security vulnerability from existing in the first place, while the notification mechanism ensures service continuity by coordinating the update process across network functions.
Solution Approach 2:
The patent implements preliminary anti-action by having the AAnF node delete the AKMA context in anticipation of potential abuse. Instead of waiting for an attack to occur or reacting after the fact, the system proactively removes the vulnerable AKMA context when it detects that subscription data is about to be updated. This counter-measure neutralizes the security threat before it can be exploited by attackers.
2Object-affected harmful factors
If the AKMA context is deleted upon subscription data update, then the security risk is reduced, but the service continuity may be affected
Solution Approach 1:
The patent applies feedback by establishing a notification and response mechanism between the AMF and AAnF nodes. When the AMF detects a subscription data update, it sends a notification to the AAnF node. The AAnF node processes this notification by deleting the relevant AKMA context and sends a response message back to confirm the deletion. This feedback loop ensures that the context deletion is coordinated and controlled, maintaining service continuity while enhancing security.
3Object-affected harmful factors
If the network function nodes continuously monitor and manage AKMA context, then the security is enhanced, but the system complexity increases
Solution Approach 1:
The patent applies merging by integrating the AKMA context management functionality into the existing AMF and AAnF nodes rather than creating separate monitoring systems. The AMF node, which already handles authentication and mobility management, now also notifies the AAnF node about subscription data updates. The AAnF node, which already maintains AKMA contexts for service continuity, now proactively deletes them based on notifications. This consolidation leverages existing infrastructure to enhance security without significantly increasing system complexity.
Data Source
Figure 1~2
Figure 3~4
Figure 5~6
AI summary
Provided are a subscription data update method and apparatus, a node, and a storage medium, where the method includes: in a case where a first network function node determines that authentication and key management for applications (AKMA) subscription data of a user is updated, determining, by the first network function node, a second network function node storing an AKMA context of the user; sending, by the first network function node, a subscription data management notification message to the second network function node; and receiving, by the first network function node, a subscription data management notification response message sent by the second network function node; where the subscription data management notification response message is sent after the second network function node deletes the AKMA context of the user according to the subscription data management notification message.