IAB Hop-by-Hop Integrity Protection for Early Tamper Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing IAB networks face inefficiencies in detecting and preventing data tampering and replay attacks due to end-to-end integrity protection schemes, which only detect modifications at the end of the transmission route, wasting network resources and being complex to implement.
Innovation Solution
Implementing hop-by-hop integrity protection at a layer below the IP layer using parameters like PDU sequence number, logical channel identifier, bearer identity, and UE identity to generate integrity keys, enabling early detection and discard of tampered data at each IAB node.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If end-to-end integrity protection is used in IAB networks, then security against data tampering is provided, but detection of modifications only occurs at the end of transmission route causing network resource waste and implementation complexity
Solution Approach 1:
The patent divides the end-to-end integrity protection into multiple hop-by-hop integrity protection segments. Each IAB node performs integrity verification on received data from its upstream neighbor and applies integrity protection to data before forwarding to its downstream neighbor. This segmentation allows local detection and discarding of tampered data at each hop, preventing waste of network resources and reducing implementation complexity compared to end-to-end verification.
2Reliability
If end-to-end integrity protection is used in IAB networks, then security against data tampering is provided, but transmission resources are wasted when tampered data reaches the end node
Solution Approach 1:
The patent implements preliminary integrity verification at each IAB node before data is forwarded downstream. Each node verifies the integrity of received data using security parameters and keys, and discards tampered data immediately upon detection. This preliminary action prevents wasteful transmission of compromised data through remaining network hops, conserving bandwidth and processing resources that would otherwise be consumed by end-to-end transmission of invalid data.
3Reliability
If hop-by-hop integrity protection is implemented at each IAB node, then early detection of tampered data is achieved, but security configuration complexity increases
Solution Approach 1:
The patent establishes a universal security configuration framework where the donor gNB generates and distributes identical security parameters (including keys derived from parent node keys, integrity protection algorithms, and verification rules) to all IAB nodes. This multi-functional configuration enables each node to independently perform both integrity verification on incoming data and integrity protection on outgoing data using the same parameter set, simplifying configuration management while enabling comprehensive hop-by-hop security throughout the IAB network.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods for applying hop-by-hop security in IAB networks. Integrity protection is applied at a layer below the IP layer for each link in a transmission route. Integrity is verified at the receiving node of each link of a route through an IAB network and if that verification fails the received traffic is discarded.