Selective F1-U PDU Encryption in 5G vRAN to Limit Overhead
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing 5G virtual Radio Access Networks (vRAN) lack effective security solutions that minimize performance impact while addressing new threat models from cloud environments, including tenants and cloud providers, particularly in the context of F1-U PDUs that are not fully protected by PDCP.
Innovation Solution
Implement selective encryption for Protocol Data Units (PDUs) in 5G vRAN, using an IPsec Security Gateway (SEG) to determine and apply encryption only to PDUs that are not otherwise protected, such as PDCP Control PDUs and certain F1-U PDUs, minimizing overhead and latency by confining secure sessions to the gNB-CU-UP - SEG domain.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If generic protection is applied to all PDUs, then security level is improved, but overhead on gNB-CU-UP side increases
Solution Approach 1:
The patent applies different security treatments to different types of PDUs based on their specific characteristics. PDCP data PDUs that are already encrypted receive no additional protection, while PDCP control PDUs and other unprotected F1-U PDUs receive selective encryption. This localized security approach ensures that security resources are applied only where needed, reducing overall overhead while maintaining appropriate security levels for each PDU type.
2Reliability
If encryption is applied to all PDUs, then security assurance is improved, but latency overhead increases
Solution Approach 1:
The patent implements partial encryption action by selectively encrypting only those PDUs that require additional security protection. Instead of applying encryption universally to all PDUs, the system identifies and encrypts only PDCP control PDUs and other unprotected F1-U PDUs, leaving already-encrypted PDCP data PDUs unchanged. This partial action approach reduces latency overhead while maintaining sufficient security assurance for vulnerable traffic types.
3Productivity
If selective encryption is implemented, then performance impact is reduced, but security coverage may be insufficient
Solution Approach 1:
The patent employs feedback mechanisms through security determination logic that assesses each PDU's encryption status and security requirements before applying protection. The system receives feedback about PDU types and their existing protection status, then makes intelligent decisions about whether additional encryption is needed. This feedback-driven approach ensures that security coverage is sufficient for unprotected traffic while avoiding redundant encryption of already-secure PDUs, thus maintaining both performance and security coverage.
Data Source
Figure 1
Figure 2
Figure 3~5
AI summary
Systems and methods for selective User Plane protection in a 5G virtual RAN are provided. A method performed by a gNB Central Unit (gNB-CU) for communicating with a gNB-Distributed Unit (gNB-DU) includes determining whether to selectively encrypt a PDU to be sent to the gNB-DU if the PDU is not otherwise encrypted. In response to determining to selectively encrypt, the method includes encrypting the PDU to be sent to the gNB-DU. In response to determining to not selectively encrypt, the method includes passing the PDU to be sent to the gNB-DU. In this way, additional security is provided while performance impact is minimized. In some embodiments, this provides a lower overhead on the gNB-CU-UP side compared to applying a generic protection of all PDUs. Additionally, the latency overhead is limited since a secure session establishment and handshake is confined to the gNB-CU-UP – SEG domain instead of gNB-CU-UP to gNB-DU.