Remote UE Security Using Permanent Identifiers in ProSe Relay
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Security platforms are unable to identify the subscriber or equipment identity for UEs that have Proximity-based services (ProSe) enabled and communicate via a UE-to-Network Relay in 4G/LTE or 5G networks, hindering effective identity-based security enforcement and logging for remote UEs.
Innovation Solution
A security platform is deployed in the mobile network to inspect control signaling traffic, collecting permanent identifiers such as IMSI, IMEI, MSISDN, and IP address information to provide visibility and enforcement for remote UEs not directly connected to the network, applying security policies based on these identifiers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If UEs communicate via UE-to-Network Relay in ProSe mode, then remote UEs can access network services, but security platforms cannot identify subscriber or equipment identity for effective security enforcement
Solution Approach 1:
The patent introduces a security platform as an intermediary component that inspects control signaling traffic between remote UEs and the network. This mediator extracts permanent identifiers (IMSI, IMEI, MSISDN) from the signaling messages, enabling identity-based security enforcement without requiring direct connection between the UE and the security system. The intermediary resolves the information loss by capturing identity data in the control plane before it is lost in the relayed data plane communication.
2Ease of operation
If firewalls filter traffic based on traditional IP addresses, then basic routing and filtering work, but permanent identifier-based security enforcement cannot be applied to remote UEs
Solution Approach 1:
The patent changes the identification parameter from transient IP addresses to permanent identifiers (IMSI, IMEI, MSISDN). By extracting these permanent identifiers from control signaling traffic and storing them in a database, the system enables reliable identity-based security enforcement. The security platform can then associate these permanent identifiers with device profiles and apply appropriate security policies, transforming the filtering mechanism from IP-based to identity-based for robust security enforcement.
Data Source
AI summary
Various techniques for permanent identifier based security for remote User Equipment devices (UEs) in mobile networks are disclosed. Specifically, new and improved techniques for permanent identifiers for applying intelligent security for remote UEs in mobile networks (e.g., a UE-to-Network Relay in a 5G network or a 4G/LTE network) that uses Proximity-based services (ProSe) are disclosed. In an example implementation, a security platform is deployed in the mobile network. The security platform is configured to inspect control signaling traffic (e.g., GTP control signaling traffic). More specifically, the security platform collects remote UE identities including, for example, IMSI, IMEI, MSISDN, and IP address information, to provide visibility and enforcement capabilities for remote UEs that are not directly connected to the mobile network.