NAS-Based UE Configuration Updates With End-to-End Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mobile networks require the deployment of a dedicated network element, such as an OTA Gateway, to update configuration parameters in User Equipment (UE), which is inefficient and lacks end-to-end security.
Innovation Solution
The solution involves using Non-Access Stratum (NAS) messages for secure updates of UE configuration parameters, where the Unified Data Management (UDM) assembles and secures the updates, which are then transmitted via the Access and Mobility Management Function (AMF) to the UE using a control plane message, ensuring end-to-end security and eliminating the need for a dedicated network element.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a dedicated network element (OTA Gateway) is deployed to update configuration parameters in UE, then the update function can be provided, but the device complexity and network infrastructure requirements increase
Solution Approach 1:
The patent extracts the configuration parameter update functionality from the dedicated OTA Gateway and integrates it into existing network elements (MME/AMF). This eliminates the need for separate dedicated network elements while maintaining the update capability. The MME/AMF already present in the network is enhanced to perform both mobility management and configuration parameter updates.
Solution Approach 2:
The patent makes the existing MME/AMF multi-functional by enabling it to handle both access and mobility management as well as configuration parameter updates. This universal approach allows a single network element to perform multiple functions, reducing overall network complexity and eliminating the need for dedicated OTA Gateway infrastructure.
2Productivity
If configuration parameters are updated using existing control plane messages, then the update process becomes more efficient, but security protection may be compromised
Solution Approach 1:
The patent applies preliminary security actions by protecting the configuration parameter update data before it is transported through the control plane. The UDM generates security protection data (integrity protection and/or ciphering) in advance, which is then included with the update parameters. This preliminary security measure ensures that even though existing control plane messages are used for transport, the data remains secure throughout the process.
Solution Approach 2:
The patent introduces security protection data as an intermediary mechanism that mediates between the efficiency of using existing control plane messages and the requirement for end-to-end security. The security protection data (integrity protection tags, ciphered content) acts as a mediator that enables secure transmission through the control plane without requiring new message types or protocols.
3Reliability
If security protection data is generated and transported with configuration parameter updates, then end-to-end security is achieved, but the message size and processing overhead increase
Solution Approach 1:
The patent changes the parameter state of security protection by applying it only to the configuration parameter update portion of the message, rather than the entire NAS message. This selective parameter change approach minimizes the amount of data that requires security processing, reducing message size overhead while maintaining security for the critical configuration parameters.
Solution Approach 2:
The patent applies partial security action by protecting only the configuration parameter update data rather than the entire message. This partial approach provides sufficient security for the critical parameters while avoiding the excessive overhead of protecting entire messages, achieving a balance between security and efficiency.
Data Source
AI summary
Systems and methods that update configuration parameters on a UE using control plane functionalities. In one embodiment, an AMF element of a mobile network receives a control plane message from a UDM element that includes a UE configuration parameter update for the UE. The UE configuration parameter update is security protected via a secured packet, integrity protection, etc. The AMF element is configured to transparently send the UE configuration parameter update to the UE. Thus, AMF element inserts the UE configuration parameter update (that is security protected) in a container of a Non-Access Stratum (NAS) message, and sends the NAS message to the UE. The UE may then update its configuration parameters based on the update when security checks are complete.