O-RAN Central Unit Security Testing Using TEID and IP Checks

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing information security testing methods for central units in O-RAN architecture lack efficiency and accuracy, failing to determine whether the central unit has a security mechanism for checking Tunnel End Identifier (TEID) and Internet Protocol (IP) addresses, and do not effectively test alertness and integrity protection capabilities.

Innovation Solution

An information security testing method and device that obtains legitimate user TEID and IP addresses through signal analysis, deriving integrity and encryption keys, and generates test packets to determine if the central unit has security mechanisms for checking these identifiers and addresses, while also testing alertness and integrity protection functions.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If random TEID and IP address are used for testing, then the testing process is simple to implement, but the testing accuracy and efficiency are poor

Engineering Contradiction:

Improvetesting process simplicityVSAvoidsecurity mechanism detection accuracy

Core Design Contradiction:

Ease of operationVSMeasurement precision

Solution Approach 1:

The patent copies legitimate user TEID and IP address information from actual network signaling messages (N1, N2, N3 interfaces) to construct test packets. This allows the testing device to use real network parameters rather than random values, enabling accurate detection of security mechanisms while maintaining test implementability through automated signal capture and processing

Inventive Principle:

Principle #26Copying

Solution Approach 2:

The patent introduces a signal analysis module as an intermediary between the network and testing device. This intermediary captures signaling messages from the core network, base station, and user equipment, extracts TEID and IP address information, and provides accurate test parameters to the testing device, thereby resolving the contradiction between operational simplicity and measurement precision

Inventive Principle:

Principle #24Intermediary (Mediator)

2Productivity

If blind attack on central unit is performed, then the testing speed is fast, but the testing reliability is low

Engineering Contradiction:

Improvetesting speedVSAvoidsecurity capability verification reliability

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent implements feedback by capturing actual signaling messages from the network, extracting real TEID and IP address information, and using this feedback to construct targeted test packets. This feedback mechanism allows the testing device to adapt to actual network conditions, maintaining high testing speed while significantly improving the reliability of security capability verification

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The patent performs preliminary signal analysis and key derivation before constructing test packets. By pre-processing the signaling messages to extract accurate TEID, IP address, and encryption key information, the system prepares reliable test parameters in advance, enabling both fast and reliable security testing

Inventive Principle:

Principle #10Preliminary action

3Device complexity

If existing testing method is used, then the testing device complexity is low, but the testing cannot determine alertness and integrity protection capabilities

Engineering Contradiction:

Improvetesting device structureVSAvoidsecurity capability testing coverage

Core Design Contradiction:

Device complexityVSAdaptability or versatility

Solution Approach 1:

The patent makes the testing device universal by enabling it to test multiple security capabilities (TEID checking, IP address validation, encryption protection, integrity protection, and alertness detection) through a single unified approach. The device captures signals from multiple network interfaces, extracts various security parameters, and constructs test packets that can verify all these capabilities, thereby increasing testing coverage without proportionally increasing device complexity

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The patent changes the parameters used in testing from random values to real network parameters extracted from signaling messages. By dynamically adjusting test parameters (TEID, IP address, encryption keys) based on actual network conditions, the testing device can accurately verify multiple security capabilities while maintaining manageable complexity through automated parameter extraction and processing

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS12501262B2Information security testing method and information security testing device

Publication Date: 2025.12.16 INSTITUTE FOR INFORMATION INDUSTRY

AI summary

An information security testing method and an information security testing device are provided. The information security testing method and the information security testing device can obtain at least one integrity key, at least one encryption key, a Tunnel End Identifier (TEID), a first Internet Protocol (IP) address of user plane of central unit, a second IP address of distributed unit and a third IP address of user equipment from the signaling transmitted after the user equipment, base station and core network establishing the communication connection, and generate a first test packet transmitted to the user plane of the central unit to determine whether the central unit has a first security mechanism for checking the TEID, the third IP address or a first source IP address.