Dual-Connectivity User Plane Security Activation in 4G-5G Access Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The transition from 4G to 5G networks introduces the need for on-demand user plane security protection mechanisms, which are not supported in conventional 4G networks, posing a challenge in NSA deployment scenarios where terminal devices are connected to both 4G and 5G networks.
Innovation Solution
A method for a first access network device to request and manage user plane security protection in dual connectivity scenarios by sending indication information to a second access network device, determining security activation status, and enabling user plane encryption and integrity protection based on terminal device capabilities and policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the on-demand user plane security protection mechanism is introduced to the 4G network, then user plane security flexibility is improved, but device complexity increases due to the need for additional signaling and coordination between access network devices
Solution Approach 1:
The patent segments the security activation process into distinct phases: capability indication from terminal to network, policy determination by the access network device, and selective activation of encryption and integrity protection. This segmentation allows complex security functionality to be implemented through modular, manageable steps rather than monolithic processing.
Solution Approach 2:
The patent implements preliminary action by having the terminal device indicate its security capabilities to the access network device before actual data transmission begins. The access network device then determines the security policy in advance and configures the appropriate protection level (encryption only, integrity protection only, or both) before user plane data flows through the network, ensuring security is pre-established rather than reactively applied.
2Reliability
If user plane integrity protection is enabled in 4G network, then security is improved, but signaling overhead increases due to additional security activation messages
Solution Approach 1:
The patent applies partial action by enabling only the necessary security protection type based on the determined policy. Instead of always enabling both encryption and integrity protection, the system selectively activates only what is required - either encryption protection alone, integrity protection alone, or both together - thereby reducing the signaling overhead associated with unnecessary security activation messages while maintaining adequate security levels.
Solution Approach 2:
The patent changes the security configuration parameters dynamically based on terminal capabilities and network policies. The access network device adjusts the security activation status (enabled/disabled) for different protection types (encryption, integrity protection) according to the determined policy, allowing flexible parameter adjustment that balances security requirements with signaling efficiency rather than using fixed maximum-security settings.
3Reliability
If the first access network device sends indication information to the second access network device, then security coordination in dual connectivity is improved, but communication overhead increases
Solution Approach 1:
The patent merges the security capability indication and security policy determination into a coordinated process between the first and second access network devices in dual connectivity scenarios. Rather than separate independent signaling exchanges, the security activation status is determined through combined assessment of terminal capabilities and network policies, with the first access network device sending consolidated indication information that triggers appropriate security configuration at the second access network device, reducing redundant communication.
4Adaptability or versatility
If on-demand security protection is implemented, then adaptability to different terminal capabilities is improved, but processing complexity at the access network device increases
Solution Approach 1:
The patent implements dynamics by making the security protection level adaptable and changeable based on terminal capabilities and network conditions. The access network device dynamically determines the security policy by evaluating terminal security capability indications and applying appropriate security activation status (none, encryption only, integrity protection only, or both), allowing the security configuration to flexibly adapt to different terminal types and scenarios rather than using a static one-size-fits-all approach.
Data Source
AI summary
This application provides security activation methods, communication apparatuses and computer-readable storage media. In an example method, a first access network device using a first communication standard requests a second access network device using a second communication standard to allocate a resource for dual connectivity of a terminal device, and sends, to the second access network device in response to determining that the terminal device supports user plane security protection, a user plane security policy and first indication information indicating that the terminal device supports user plane security protection. The first access network device receives, from the second access network device, identification information of a bearer and a security activation status indicating whether to enable user plane encryption protection and/or user plane integrity protection of the bearer, and the first access network device sends the identification information of the bearer and the security activation status to the terminal device.