Group User Plane Security Policy for 5G Session Consistency

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

The flexibility of 5G User Plane (UP) Security Policies complicates security considerations in group communication scenarios, such as 5GLAN, where different devices within a group may have varying security levels, leading to the weakest link determining overall group security.

Innovation Solution

Implementing a Group User Plane (GUPSP) security policy that ensures all devices within a group have the same or minimum security policy for communication links, ensuring consistent security across all devices in the group.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If PDU Session-specific User Plane Security Policies are applied to provide flexibility for tailoring security on a session by session basis, then security adaptability is improved, but device complexity and security management complexity increase

Engineering Contradiction:
Improvesecurity adaptabilityVSAvoidsecurity management complexity
Core Design Contradiction:
Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The security policy is segmented into two distinct components: a Group User Plane Security Policy (GUPSP) that applies uniformly to all devices in a group, and session-specific overrides that allow individual customization when needed. This segmentation resolves the contradiction by providing default uniformity to reduce complexity while maintaining the option for customization to preserve adaptability.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent implements local quality by allowing session-specific security policy overrides for individual devices within a group when particular security requirements demand it, while the majority of devices operate under the common GUPSP. This enables security properties to vary locally where needed while maintaining global consistency elsewhere, balancing adaptability and complexity.

Inventive Principle:
Principle #3Local quality

2Adaptability or versatility

If different security levels are applied to different devices in a group, then individual security needs are met, but the weakest link determines overall group security

Engineering Contradiction:
Improveindividual security customizationVSAvoidoverall group security
Core Design Contradiction:
Adaptability or versatilityVSReliability

Solution Approach 1:

The GUPSP establishes equipotentiality by ensuring all devices in a group operate at the same security level by default, eliminating security weaknesses that could be exploited. This uniform baseline ensures that no single device becomes a vulnerable entry point, while still allowing individual customization when justified by specific security requirements.

Inventive Principle:
Principle #12Equipotentiality

Solution Approach 2:

The common GUPSP serves as a preliminary anti-action by pre-establishing a minimum security threshold for all group members before any session-specific variations are applied. This preemptive uniform security configuration prevents potential security breaches that could arise from inconsistent security levels across devices.

Inventive Principle:
Principle #9Preliminary anti-action

3Adaptability or versatility

If session-specific security policies are negotiated between UE and RAN node, then security flexibility is improved, but signaling overhead and procedure complexity increase

Engineering Contradiction:
Improvesecurity policy flexibilityVSAvoidsignaling overhead
Core Design Contradiction:
Adaptability or versatilityVSLoss of time

Solution Approach 1:

The GUPSP is configured in advance and stored in both the RAN node and UE before session establishment occurs. This preliminary configuration eliminates the need for time-consuming security policy negotiations during session setup, as both parties already possess the agreed-upon security parameters. Session-specific overrides can then be applied efficiently using pre-defined rules rather than requiring extensive real-time negotiation.

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentUS20250392907A1Securing the User Plane Path for a Group Communication Session based on a Security Policy Common to All Devices in the Group
Publication Date: 2025.12.25 TELEFONAKTIEBOLAGET LM ERICSSON (PUBL)
  • US20250392907A1 patent drawing
  • US20250392907A1 patent drawing
  • US20250392907A1 patent drawing

AI summary

A network node (26, 400) is configured for use in a wireless communication network (10). The network node (26, 400) receives a request to establish a session (14-1) for a device (12-1) in a group (18), e.g., a 5G Local Area Network group (18). The network node (26, 400) determines a user plane security policy (24-1) for the session (!4-1), based on a user plane security policy (28) for the group (18). The user plane security policy (28) for the group (18) may specify a policy for securing a user plane path of a session for any device in the group (18). The network node (26, 400) may then transmit, to an access node of the wireless communication network (10), control signaling indicating the determined user plane security policy (24-1).