NAS Security Bootstrapping for Zero-Trust Network Function Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional telecommunications networks lack a secure and flexible method for establishing non-access stratum communication links between user equipment and multiple network functions or services, relying on a single trusted domain that may compromise user privacy and data security, especially in roaming scenarios.
Innovation Solution
Establish a non-access stratum communication link using a user equipment bootstrapping function that enables direct security contexts with multiple network functions or services, allowing for a zero-trust architecture by providing endpoint information and authentication, thereby bypassing the reliance on a single trusted domain.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single trusted domain architecture is used for non-access stratum communication, then network security is simplified and easier to manage, but user privacy and data security are compromised in roaming scenarios
Solution Approach 1:
The patent segments the traditional single trusted domain architecture into multiple independent trusted domains, each corresponding to a specific network function or service. This allows the UE to establish separate security contexts with different network functions, enabling fine-grained security control and protecting user privacy in roaming scenarios while maintaining manageable security architecture.
2Reliability
If direct communication between user equipment and multiple network functions is established, then security and trust are enhanced, but system complexity increases
Solution Approach 1:
The patent implements preliminary action by establishing security contexts and obtaining endpoint information through a bootstrapping process before actual communication with multiple network functions. This preliminary setup phase creates the necessary security framework in advance, allowing direct authenticated communications to proceed without ad-hoc security negotiations, thus enhancing security while managing system complexity.
3Reliability
If a bootstrapping function is introduced to enable direct security contexts, then authentication and security are improved, but the number of network components increases
Solution Approach 1:
The bootstrapping function serves multiple purposes: it establishes initial security contexts, provides endpoint information for multiple network functions, and enables the UE to communicate directly with various network functions. By consolidating these diverse functions into a single bootstrapping component, the patent improves authentication capabilities while minimizing the increase in network components.
4Adaptability or versatility
If decentralized deployments are enabled, then adaptability and deployment flexibility are improved, but security management becomes more difficult
Solution Approach 1:
The patent applies local quality by allowing each trusted domain and network function to have its own security context and authentication mechanism tailored to its specific requirements. This enables decentralized deployments with different security policies for different network functions while maintaining overall security through the unified bootstrapping framework that manages all local security contexts.
Data Source
AI summary
A method for establishing a non-access stratum communication link between a user equipment and one of a plurality of network functions or services of a telecommunications network includes: in a first step, a non-access stratum security context is established between the user equipment and a user equipment bootstrapping function or service; in a second step, the user equipment bootstrapping function or service provides a non-access stratum endpoint information regarding a specific network function or service or regarding a specified network function or service corresponding to a specific kind of network function functionality; and in a third step, the non-access stratum endpoint information is used to establish a considered non-access stratum security context and/or to conduct authentication of the user equipment with regard to either the specific network function or service, or the specified network function or service corresponding to the specific kind of network function functionality.