Per-IE Security Indicators in 5G SEPPs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Security management in 5G communication systems faces challenges due to the need for enhanced security protocols to protect diverse information elements (IEs) in HTTP messages transmitted between network functions, where each IE requires specific security operations such as encryption or integrity protection, which existing solutions do not adequately address.
Innovation Solution
The implementation of Security Edge Protection Proxies (SEPPs) that utilize per-IE indicators within Network Function Restful APIs to identify and apply appropriate security mechanisms, such as encryption or integrity protection, using the JavaScript Object Signing and Encryption (JOSE) framework for each information element in HTTP messages, ensuring secure communication between network functions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If per-IE security indicators and JOSE framework are implemented, then security protection accuracy for individual information elements is improved, but message construction complexity and processing overhead increase
Solution Approach 1:
The patent segments the HTTP message into individual information elements (IEs) and applies security indicators to each IE separately. This allows selective security operations on specific IEs rather than treating the entire message as a single unit, improving security precision while managing complexity through modular processing of individual IEs.
Solution Approach 2:
The patent implements local quality by applying different security operations (encryption, integrity protection, or neither) to different information elements based on their specific security requirements. Each IE can have its own security indicator specifying the appropriate security operation, allowing tailored security protection for each element rather than uniform security application.
2Reliability
If security operations are applied to each information element individually, then security coverage is improved, but processing time and network latency increase
Solution Approach 1:
The patent implements preliminary action by setting security indicators during the message construction phase at the network function, before the message is transmitted to the SEPP. This allows security requirements to be predetermined and documented in the message structure itself, enabling the SEPP to efficiently apply the appropriate security operations without requiring complex real-time analysis of each IE's security needs.
3Ease of operation
If existing security protocols are used without per-IE indicators, then message transmission simplicity is maintained, but security management capability for diverse information elements deteriorates
Solution Approach 1:
The patent introduces security indicators as an intermediary mechanism between the network function and the SEPP. These indicators act as a communication bridge that conveys security requirements for each information element from the message creator to the security processing entity, enabling sophisticated per-IE security management while maintaining the simplicity of the underlying HTTP message transmission protocol.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In a communication system (600) comprising a first network (610) operatively coupled to a second network (630), wherein the first network comprises a first security edge protection proxy element (616) operatively coupled to a second security edge protection proxy element of the second network (636); the method comprises constructing a message (617) at a network function in the first network destined for the second network, wherein the message comprises at least one information element and an indicator, wherein the indicator is set to specify at least one security operation to be applied to the at least one information element before sending the message to the second security edge protection proxy element of the second network.