IPsec Configuration for Lawful Interception in Roaming
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current mobile communication systems face challenges in legally intercepting communication, particularly in roaming scenarios where end-to-end encryption by IPsec protocols hinders lawful interception, especially in VoLTE modes.
Innovation Solution
A method where a network node determines whether a UE is roaming and adjusts the IPsec settings for lawful interception, potentially disabling encryption or using only integrity protection, during PDN connection establishment and tracking area updates, to facilitate lawful communication interception.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IPsec encryption is enabled for secure communication in roaming scenarios, then communication security is improved, but lawful interception capability deteriorates
Solution Approach 1:
The patent applies local quality by differentiating IPsec encryption application based on roaming status and service type. For roaming users requiring lawful interception, encryption is disabled or restricted to integrity protection only, while non-roaming users maintain full encryption. This localized differentiation resolves the contradiction by applying security measures selectively rather than universally.
Solution Approach 2:
The patent implements dynamic IPsec configuration where the encryption setting changes based on real-time detection of roaming status and service requirements. The system dynamically adjusts encryption parameters during PDN connection establishment and tracking area updates, allowing the same infrastructure to adapt between secure mode and lawful interception mode as needed.
2Object-generated harmful factors
If IPsec encryption is disabled to enable lawful interception, then lawful interception capability is improved, but communication security deteriorates
Solution Approach 1:
The patent applies local quality by differentiating IPsec encryption application based on roaming status and service type. For roaming users requiring lawful interception, encryption is disabled or restricted to integrity protection only, while non-roaming users maintain full encryption. This localized differentiation resolves the contradiction by applying security measures selectively rather than universally.
Solution Approach 2:
The patent changes the encryption parameter configuration based on detected conditions. When lawful interception is required, the encryption algorithm parameter is changed or disabled, while integrity protection parameters remain active. This parameter modification allows the system to maintain security where needed while enabling interception where legally required.
3Adaptability or versatility
If IPsec settings are dynamically adjusted based on roaming status, then adaptability is improved, but device complexity increases
Solution Approach 1:
The patent implements self-service by having the network node automatically detect roaming status and service type, then autonomously configure IPsec parameters without manual intervention. The system uses existing signaling messages like TAU request and PDN connectivity request to trigger appropriate IPsec settings, eliminating the need for complex manual configuration while maintaining high adaptability.
Solution Approach 2:
The patent applies preliminary action by configuring IPsec settings during the initial PDN connection establishment and tracking area update procedures, before actual data transmission begins. This preliminary configuration ensures that the correct security parameters are in place beforehand, simplifying the overall system operation while maintaining adaptability to different roaming scenarios.
Data Source
AI summary
One disclosure of the present specification provides a method for supporting an internet protocol security (IPsec). The method may be performed by a mobility management entity (MME) and comprise: receiving a tracking area update (TAU) request message from a user equipment (UE); determining whether to activate an encryption option of IPsec; and transmitting a TAU accept message including IPsec related information generated based on the determination.