Block-Level Hash Integrity for Small Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing number of cellular Internet of Things (CIoT) devices transmitting small amounts of data frequently strains network resources and introduces security vulnerabilities, particularly in 5G networks, due to high security overhead and potential network attacks like Denial of Service (DoS) attacks, which existing security mechanisms struggle to manage efficiently.
Innovation Solution
Implementing a lightweight integrity protection mechanism using a hash function to reduce overhead in user plane transmissions, where a hash mark (HASH_MARK) is calculated for groups of PDCP packets and shared between the UE and the RAN or core network, providing data integrity and authenticity without embedding it in every packet, thus optimizing resource usage and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional integrity protection mechanisms are applied to frequent small data transmissions, then data security is improved, but network overhead and resource consumption increase significantly
Solution Approach 1:
The patent segments the integrity protection mechanism by separating the hash function computation from individual packet processing. Instead of applying integrity protection to each small data packet, the system divides data into larger blocks and applies hash functions at block level, reducing the frequency of security operations while maintaining protection coverage.
Solution Approach 2:
The patent changes the parameter of integrity protection granularity from packet-level to block-level. By adjusting this parameter, the system reduces the number of hash computations required for frequent small data transmissions, thereby lowering network overhead while preserving security through block-level verification.
2Reliability
If integrity protection is applied to every packet, then data authenticity is ensured, but processing complexity and resource usage increase
Solution Approach 1:
The patent segments the data stream into blocks and applies integrity protection at the block level rather than individual packet level. This segmentation reduces the total number of hash computations required, simplifying processing complexity while maintaining authenticity verification through block-level hash validation.
Solution Approach 2:
The patent applies partial action by selectively applying integrity protection only to certain data blocks rather than every single packet. This approach reduces processing complexity for frequent small data transmissions while still ensuring authenticity for the protected blocks, balancing security requirements with resource constraints.
3Reliability
If security mechanisms are strengthened for CIoT devices, then network security is improved, but resource consumption and transmission overhead increase
Solution Approach 1:
The patent changes the parameter of security application frequency from high (per-packet) to low (per-block). This parameter adjustment reduces resource consumption for CIoT devices engaged in frequent small data transmissions while maintaining network security through periodic block-level integrity verification.
Solution Approach 2:
The patent segments frequent small data transmissions into larger blocks for security processing purposes. This segmentation allows the system to maintain strong security mechanisms while reducing the overall resource consumption by decreasing the frequency of security operations from packet-level to block-level.
Data Source
AI summary
Packet protection is described. Data of a group of packets is concatenated with a security key and a sequence number of the packet. A hash mark of the concatenated data is calculated and sent with data or control information in a packet. If each packet has reserved bits, at least some of the packets each has data, a least a portion of the hash mark, and a header having: a first bit that indicates if the hash mark is present, and a second bit that indicates if the packet is used to determine the hash mark. Otherwise, a separate control packet is sent that contains the hash mark, a first sequence number of the group of packets, and a PDU type indicating that the control packet is an integrity protection packet for the group of PDCP packets.