C-RAN Control Plane Security via DU Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In centralized 5G RAN architectures, the latency of RRC signaling is increased due to the long F1-C link between the CU and DU, which is not acceptable for latency-critical services, and the F1-C interface is vulnerable to attacks, causing RRC signaling congestion.
Innovation Solution
Implementing a portion of the control plane protocol layer, including RRC signaling and security, in the DU to move the control plane closer to the UE, while keeping the user plane in the cloud, and changing CP keys during DU changes to ensure security separation between DUs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the control plane protocol layer is implemented at the CU in a centralized RAN architecture, then security management is centralized and simplified, but RRC signaling latency increases and the F1-C interface becomes vulnerable to attacks
Solution Approach 1:
The patent segments the control plane functionality by implementing a portion of the control plane protocol layer (specifically RRC signaling and security functions) at the DU while keeping other control plane functions at the CU. This segmentation allows RRC signaling to be processed locally at the DU, reducing latency for latency-critical services, while the CU maintains centralized security management and key generation capabilities. The F1-C interface continues to carry user plane data and non-latency-critical control signaling.
Solution Approach 2:
The patent introduces a key derivation mechanism where the CU generates master keys and security parameters, which are then used by the DU to derive local RRC signaling keys. This intermediary key derivation process enables the DU to independently secure RRC signaling without requiring direct CU involvement in each signaling transaction, thus reducing latency while maintaining centralized security policy enforcement.
2Loss of time
If the control plane protocol layer is implemented at the DU to reduce latency, then RRC signaling latency decreases, but security separation between DUs becomes necessary and complex
Solution Approach 1:
The patent applies local quality by enabling each DU to independently derive and use its own RRC signaling keys based on its identity and the master key from the CU. This allows each DU to have customized security parameters tailored to its specific context while maintaining overall system security. The DU uses its unique identifier (such as gNB-DU ID or cell ID) combined with the master key to derive localized security credentials, ensuring that compromise of one DU does not affect others.
Solution Approach 2:
The patent changes security parameters dynamically by deriving different RRC signaling keys for different DUs based on their identities and the master key. The key derivation function takes as inputs the master key, freshness parameters (such as counter values or random nonces), and DU-specific identifiers, producing unique security parameters for each DU. This parameter differentiation ensures security separation without requiring complex manual configuration.
3Ease of manufacture
If centralized security key management is maintained at the CU, then key generation and distribution is simplified, but the F1-C interface becomes a single point of failure for security
Solution Approach 1:
The patent implements preliminary action by having the CU generate master keys and security parameters in advance during initial network setup or handover preparation, and distribute them to DUs before actual RRC signaling begins. The DU then uses these pre-distributed master keys to locally derive RRC signaling keys when needed, eliminating the need for real-time key exchange over the F1-C interface during critical signaling operations. This preliminary key distribution reduces the F1-C interface's exposure to attacks.
Solution Approach 2:
The patent applies preliminary anti-action by implementing forward secrecy through key derivation mechanisms that ensure past RRC signaling keys cannot be used to derive future keys, and future keys cannot protect past communications. The use of freshness parameters (such as increasing counter values or new random nonces) in each key derivation ensures that even if the F1-C interface is compromised, attackers cannot retroactively decrypt or predict RRC signaling. This preliminary security measure counteracts potential F1-C interface attacks.
Data Source
AI summary
Techniques for secure control plane communications between a User Equipment (UE) and a gNB are provided. A RAN network entity decides to handover a UE from a source base station (BS) to a target BS, wherein the RAN network entity controls a plurality of BSs including at least one of the source BS or the target BS, and wherein at least a portion of a control plane (CP) protocol layer is implemented at the target BS. The network entity generates at least one key specific to the target BS, based on a master key and a freshness parameter, the master key associated with the network entity. The network entity transmits an indication of the at least one key to the target BS, wherein the target BS exchanges control signaling with the UE based on the CP protocol layer using the at least one key.