Network Function Key Determination for Direct Terminal Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network architectures rely solely on the Access and Mobility Management Function (AMF) for security protection between terminals and other network functions, which is insufficient to meet future communication requirements.
Innovation Solution
Implement a method where network functions other than the AMF can determine security keys directly with terminals, reducing processing and communication overheads by deriving or obtaining keys from other network functions or pre-configured keys, and using additional information for enhanced security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security protection is implemented only through the AMF, then the network architecture is simple and easy to manage, but future communication requirements cannot be met and security coverage is insufficient
Solution Approach 1:
The patent segments the centralized security protection function into distributed security key determination capabilities across multiple network functions. Each network function (AMF, SMF, PCF, etc.) can independently determine security keys with terminals, dividing the security protection task from centralized (AMF-only) to distributed (multi-NF) architecture, thereby expanding security coverage while maintaining manageable complexity through modular design
2Reliability
If network functions derive security keys independently, then security coverage is improved, but processing overheads increase
Solution Approach 1:
The patent implements preliminary action by having network functions obtain or derive security keys in advance during initial authentication and setup phases. The AMF performs key derivation beforehand, and other network functions can obtain pre-derived keys or key material from the AMF, avoiding the need for each NF to perform complex key derivation operations in real-time, thus reducing processing overheads while maintaining independent security capability
Solution Approach 2:
The AMF serves as an intermediary that facilitates key distribution to other network functions. Instead of each NF independently deriving keys from scratch, the AMF acts as a key management intermediary that provides key material or derived keys to other NFs, reducing their processing burden while enabling them to establish secure connections with terminals
3Productivity
If network functions obtain keys from other network functions, then processing overheads are reduced, but communication overheads increase
Solution Approach 1:
The patent applies preliminary action by having the AMF derive and make security keys available to other network functions in advance, during initial setup or authentication phases. This pre-positioning of key material eliminates the need for real-time key request and response communications when other NFs need to establish secure connections with terminals, thereby reducing communication time and overheads
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
This application pertains to the field of communication technologies, and provides a security key determining method and apparatus, to resolve a problem that a future communication requirement cannot be met only by ensuring communication security between a terminal and an AMF. In the method, a terminal may directly communicate with a first network function in a network, and after the first network function receives a first request initiated by the terminal, a security connection may be established between the first network function and the terminal by determining a security key. In other words, a message between the first network function and the terminal may be protected by using the security key. In this way, when the terminal directly communicates with each network function, security protection can be implemented between the terminal and each network function, thereby ensuring communication security and meeting a future communication requirement.