Hashed Target Interception in Virtualized Network Functions

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In virtualized network functions, the lack of physical security and shared resources poses significant security risks for lawful interception (LI) functions, as unauthorized users can read or modify sensitive data related to interception targets.

Innovation Solution

A method involving a Lawful Interception Administrative Function (LI ADMF) that obtains a random value and calculates a target hash value using a one-way hash function, which is then transmitted to the Intercept Access Point (IAP) in a virtualized network function (VNF), ensuring that only hashed targets are provided, reducing the risk of unauthorized data access.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If clear-text targets are provided to IAP for lawful interception, then the IAP can accurately identify and intercept target communications, but unauthorized users can read or modify sensitive interception target data

Engineering Contradiction:

Improveaccuracy of target identificationVSAvoidunauthorized access to sensitive data

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

A hash value intermediary is introduced between the target identification data and the IAP. Instead of providing clear-text target identifiers, the system provides hashed target identifiers that the IAP can verify without being able to read the original sensitive data. This intermediary transformation layer protects the sensitive information while maintaining the functionality of target identification.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The target identification data is transformed from clear-text form to hashed form through a cryptographic hash function. This parameter change converts the readable sensitive data into an unreadable but verifiable format, maintaining the identification functionality while eliminating the security vulnerability of clear-text storage and transmission.

Inventive Principle:

Principle #35Parameter changes

2Object-affected harmful factors

If physical security measures are implemented for LI functions, then unauthorized access to interception data is prevented, but these measures are not applicable in virtualized network environments

Engineering Contradiction:

Improveunauthorized access preventionVSAvoidapplicability in virtualized environments

Core Design Contradiction:

Object-affected harmful factorsVSAdaptability or versatility

Solution Approach 1:

Physical security measures are replaced with cryptographic security measures suitable for virtualized environments. Instead of relying on physical access controls, the system uses cryptographic hash functions to protect target identification data, enabling security in software-based virtualized network functions where physical security boundaries do not exist.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Object-affected harmful factors

If encryption mechanisms are used in virtualized infrastructure, then data security is improved, but complex key management such as TPM adoption is required

Engineering Contradiction:

Improvedata securityVSAvoidkey management complexity

Core Design Contradiction:

Object-affected harmful factorsVSDevice complexity

Solution Approach 1:

Instead of using complex encryption mechanisms requiring TPM and key management infrastructure, the system uses simple cryptographic hash functions that require no key management. The hash function is a deterministic transformation that does not require secrets or keys, making it suitable for virtualized environments where key management complexity is prohibitive.

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

Data Source

PatentUS12244651B2Lawful interception security

Publication Date: 2025.03.04 TELEFONAKTIEBOLAGET LM ERICSSON (PUBL)

AI summary

A lawful interception administrative function (LI ADMF) provides a virtual network function (VNF) implemented (i.e. implemented in a cloud infrastructure) LI intercept access point (IAP) only with one-way encrypted targets instead of clear-text targets while keeping the lawful interception triggering capability of the IAP unaffected. The ADMF, being external to the cloud infrastructure in which the IAP is running, executes hashing of targets before the targets are provided to the IAP. The IAP will never receive targets in clear text and thereby greatly reducing the LI security risks.