Application-Specific User Plane Security for PDU Sessions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing wireless communication systems fail to consider the user plane security policies of individual applications when establishing PDU sessions, leading to unnecessary security protection or latency issues due to mismatched security requirements.
Innovation Solution
Implement a method where a terminal apparatus receives user plane security indication information to associate or establish PDU sessions based on the security attribute requirements of applications, ensuring that the selected sessions meet the necessary security policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the network device performs encryption and integrity protection on all data packets in a PDU session, then security is improved, but latency increases and unnecessary security protection is applied
Solution Approach 1:
The patent applies different security policies to different applications within the same PDU session. Specifically, it identifies which applications require encryption and integrity protection at the user plane level, and applies these protections only to those applications' data packets, rather than uniformly to all packets in the session. This resolves the contradiction by providing security only where needed, eliminating unnecessary latency for applications that don't require such protection.
Solution Approach 2:
The patent segments the PDU session into application-specific data flows, allowing independent security policy application for each application. By identifying and separating data packets based on their originating application, the system can apply encryption and integrity protection selectively to only those applications that require it, thereby reducing overall latency while maintaining necessary security.
2Reliability
If the terminal establishes a new PDU session for each application with different security requirements, then security policy compliance is improved, but device complexity and session management overhead increase
Solution Approach 1:
The patent makes the existing PDU session universal by enabling it to carry multiple applications with different security requirements simultaneously. Instead of requiring separate PDU sessions for each application, the system extends the functionality of a single PDU session to accommodate diverse security policies through application identification and selective policy application, thereby reducing session management complexity.
Solution Approach 2:
The patent introduces dynamic security policy application within a PDU session, where security protections are applied or removed based on the specific application's requirements. This dynamic approach allows the system to adapt security measures to each application's needs without establishing separate static sessions, reducing the number of sessions required while maintaining policy compliance.
3Ease of manufacture
If the network device applies uniform security policies to all PDU sessions, then implementation simplicity is improved, but adaptability to different application requirements deteriorates
Solution Approach 1:
The patent enables local quality differentiation within PDU sessions by applying security policies at the application level rather than uniformly across all sessions. The system identifies specific applications requiring particular security measures and applies those measures locally to their data packets, maintaining implementation simplicity while achieving application-specific adaptability.
Solution Approach 2:
The patent changes the parameter of security policy application from session-level uniformity to application-level variability. By introducing application identification mechanisms and allowing security parameters (encryption, integrity protection) to vary based on the application, the system maintains relatively simple implementation while achieving high adaptability to different security requirements.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
This application discloses a method for implementing a user plane security policy, an apparatus, and a system. In an implementation, a terminal apparatus may associate or establish a PDU session based on user plane security indication information that is of an application and that is sent by a network device. In another implementation, a PCF adds an obtained user plane security attribute requirement of the application to a PCC rule and sends the PCC rule to an SMF, so that the SMF performs QoS flow binding based on the user plane security attribute requirement. According to the foregoing method, the user plane security attribute requirement of the application can be met.