Group User Plane Security Policy for 5G Session Consistency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The flexibility of 5G User Plane (UP) Security Policies complicates security considerations in group communication scenarios, such as 5GLAN, where different devices within a group may have varying security levels, leading to the weakest link determining overall group security.
Innovation Solution
Implementing a Group User Plane (GUPSP) security policy that ensures all devices within a group have the same or minimum security policy for communication links, ensuring consistent security across all devices in the group.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If PDU Session-specific User Plane Security Policies are applied to provide flexibility for tailoring security on a session by session basis, then security adaptability is improved, but device complexity and security management complexity increase
Solution Approach 1:
The security policy is segmented into two distinct components: a Group User Plane Security Policy (GUPSP) that applies uniformly to all devices in a group, and session-specific overrides that allow individual customization when needed. This segmentation resolves the contradiction by providing default uniformity to reduce complexity while maintaining the option for customization to preserve adaptability.
Solution Approach 2:
The patent implements local quality by allowing session-specific security policy overrides for individual devices within a group when particular security requirements demand it, while the majority of devices operate under the common GUPSP. This enables security properties to vary locally where needed while maintaining global consistency elsewhere, balancing adaptability and complexity.
2Adaptability or versatility
If different security levels are applied to different devices in a group, then individual security needs are met, but the weakest link determines overall group security
Solution Approach 1:
The GUPSP establishes equipotentiality by ensuring all devices in a group operate at the same security level by default, eliminating security weaknesses that could be exploited. This uniform baseline ensures that no single device becomes a vulnerable entry point, while still allowing individual customization when justified by specific security requirements.
Solution Approach 2:
The common GUPSP serves as a preliminary anti-action by pre-establishing a minimum security threshold for all group members before any session-specific variations are applied. This preemptive uniform security configuration prevents potential security breaches that could arise from inconsistent security levels across devices.
3Adaptability or versatility
If session-specific security policies are negotiated between UE and RAN node, then security flexibility is improved, but signaling overhead and procedure complexity increase
Solution Approach 1:
The GUPSP is configured in advance and stored in both the RAN node and UE before session establishment occurs. This preliminary configuration eliminates the need for time-consuming security policy negotiations during session setup, as both parties already possess the agreed-upon security parameters. Session-specific overrides can then be applied efficiently using pre-defined rules rather than requiring extensive real-time negotiation.
Data Source
AI summary
A network node (26, 400) is configured for use in a wireless communication network (10). The network node (26, 400) receives a request to establish a session (14-1) for a device (12-1) in a group (18), e.g., a 5G Local Area Network group (18). The network node (26, 400) determines a user plane security policy (24-1) for the session (!4-1), based on a user plane security policy (28) for the group (18). The user plane security policy (28) for the group (18) may specify a policy for securing a user plane path of a session for any device in the group (18). The network node (26, 400) may then transmit, to an access node of the wireless communication network (10), control signaling indicating the determined user plane security policy (24-1).


