Network Function Key Retrieval for Sensitive Data Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication systems lack secure methods for protecting sensitive data, such as machine learning models, within network function service consumers and producers, particularly in 5G systems, where data integrity and encryption are not adequately addressed.
Innovation Solution
Implementing apparatuses and methods for network functions that enable secure retrieval, decryption, and integrity verification of sensitive data using encrypted keys and integrity protection keys, along with access token management, leveraging keyed hash message authentication codes (HMAC) for encryption and integrity protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If sensitive data is stored in network functions without encryption, then data accessibility and processing speed are improved, but data security and integrity are compromised
Solution Approach 1:
The patent segments the sensitive data protection mechanism by separating the encryption/decryption operations from the main data processing flow. Network function service consumers retrieve encrypted sensitive data from repositories and perform decryption locally using retrieved keys, rather than requiring centralized decryption services. This segmentation reduces the encryption complexity burden on individual network functions while maintaining overall data security.
Solution Approach 2:
The patent introduces key management functions and repository functions as intermediaries between data storage and data processing. These intermediary functions handle key generation, storage, and distribution, allowing network function service consumers to access encrypted data without directly managing cryptographic operations. This intermediary layer simplifies the encryption complexity for end users while ensuring robust data protection through standardized key management procedures.
2Ease of operation
If encryption keys are stored centrally, then key management is simplified, but security risks increase due to single point of failure
Solution Approach 1:
The patent segments key storage across multiple repository functions rather than centralizing keys in a single location. Each network function service consumer has access to specific repository functions that store keys relevant to their authorized data access. This segmentation distributes the security risk, eliminating the single point of failure associated with centralized key storage while maintaining ease of key management through organized repository structures.
Solution Approach 2:
The patent implements local quality by allowing different network function service consumers to have access to different repository functions with different key sets. Each consumer's key access rights are tailored to their specific authorization level and data access needs. This localized key management approach simplifies operations for each consumer while enhancing overall security by ensuring that compromise of one consumer's keys does not affect others.
3Reliability
If access control mechanisms are implemented for sensitive data, then data protection is enhanced, but system complexity and access time increase
Solution Approach 1:
The patent implements preliminary action by pre-establishing authorization relationships between network function service consumers and repository functions before actual data access occurs. Access tokens and key retrieval permissions are configured in advance based on consumer authorization levels. When data access is required, the consumer can immediately retrieve appropriate keys without real-time authorization checks, significantly reducing access time while maintaining robust data protection through pre-validated access control policies.
Data Source
AI summary
There is provided a method, computer program, and an apparatus for a network function service consumer, that causes the apparatus to perform: retrieving, from a first repository function, protected sensitive data; retrieving, from a second network function, at least one encrypted key; decrypting the retrieved at least one encrypted key using a private key associated with the network function service consumer to obtain a respective at least one key; and performing at least one of: decryption of the protected sensitive data using the at least one key to obtain sensitive data or integrity protected sensitive data; or verification of the integrity of the protected sensitive data using the at least one key.