Network Slice Sessions with Signing Verification Against Counterfeit Apps
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The 3GPP standard does not limit the coding of the OSAppId, allowing counterfeit applications to potentially misuse specific network slices by stealing a package name, leading to unauthorized network connections.
Innovation Solution
An electronic device determines whether to establish a data session based on a URSP rule that includes information for verification, preventing the use of network slices by counterfeit applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the OSAppId coding is not limited (following 3GPP standard), then the ease of operation and flexibility in application identification is improved, but the reliability and security of network slice usage deteriorates due to counterfeit applications stealing package names
Solution Approach 1:
The patent applies preliminary action by obtaining and verifying the signing certificate of the application before establishing the data session with the network slice. The UE retrieves the signing certificate in advance (operation 705), verifies it against the URSP rule (operation 707), and only then proceeds with session establishment if verification succeeds (operation 709). This pre-verification mechanism prevents counterfeit applications from unauthorizedly accessing network slices while maintaining flexibility in application identification.
2Reliability
If verification information is added to the URSP rule, then the reliability and security of network slice usage is improved, but the device complexity and processing overhead increases
Solution Approach 1:
The patent uses the signing certificate as an intermediary verification mechanism. Instead of complex verification systems, it introduces a digital certificate (obtained from operation 705) that serves as a trusted intermediary to validate application authenticity. The certificate contains cryptographic signatures that can be verified using standard cryptographic algorithms, providing security without requiring complex custom verification logic in the UE.
Solution Approach 2:
The patent leverages existing cryptographic verification mechanisms that are already implemented in mobile operating systems. The signing certificate verification process reuses established cryptographic libraries and algorithms that are part of the OS's security infrastructure, avoiding the need to implement new verification logic from scratch and thus minimizing additional processing overhead.
3Reliability
If signing certificate verification is implemented, then the reliability of application authentication is improved, but the ease of operation and simplicity of session establishment deteriorates
Solution Approach 1:
The patent implements self-service by having the UE automatically obtain and verify the signing certificate without user intervention. The verification process is transparent to the user - the UE autonomously retrieves the certificate (operation 705), performs verification against the URSP rule (operation 707), and either establishes or blocks the session automatically (operations 709 or 711). This automation maintains ease of operation from the user perspective while ensuring reliable authentication.
Data Source
Figure 1
Figure 2a
Figure 2b
AI summary
According to various embodiments, an electronic device comprises a memory and at least one processor, wherein the at least one processor may be configured to: store, in the memory, information on the relationship between identification information of at least one application, verification information for verification of each of the at least one application, and information for establishing a PDU session for each of the at least one application; confirm a first value on the basis of a first application having first identification information included in the relationship information; confirm, by using the relationship information, a second value on the basis of verification information corresponding to the first identification information; establish, on the basis of the first value and the second value being the same, a PDU session by using the information for establishing a PDU session corresponding to the first application; and transmit and receive data related to the first application by using the PDU session. Various other embodiments are possible.