Secure Application Descriptors for Reliable UE Session Creation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication systems face issues with tampered or forged application descriptors in session creation, leading to network reliability problems due to confusion in PDU session establishment.
Innovation Solution
Implementing a method where application descriptors bound to a signing certificate or digital fingerprint are read from a secure unit, ensuring security and preventing tampering, and allowing operators to manage and update these descriptors through OTA updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If application descriptors are stored in a non-secure location for easy access, then ease of operation is improved, but reliability deteriorates due to tampering and forgery risks
Solution Approach 1:
The system separates application descriptors into two storage locations: a secure unit (UICC/eUICC) for protected storage and the terminal system for processing. This segmentation allows the descriptors to be securely stored while still being accessible when needed, resolving the contradiction between ease of operation and reliability.
Solution Approach 2:
The secure unit acts as an intermediary between the application descriptors and the terminal system. The descriptors are read from the secure unit by the terminal system when needed, providing both security (through the secure unit's protection) and ease of operation (through the terminal system's ability to access and use the descriptors).
2Reliability
If application descriptors are centrally managed by operators through OTA updates, then reliability is improved through centralized control, but device complexity increases
Solution Approach 1:
The terminal system automatically receives and processes OTA updates from the operator without requiring complex user intervention. The system self-manages the update process, including receiving the updated application descriptors, validating them through authentication, and storing them in the secure unit, thereby reducing the perceived complexity for users while maintaining centralized control.
Solution Approach 2:
The secure unit serves multiple functions: it stores application descriptors, provides authentication, and manages updates through OTA. This multi-functionality reduces the need for separate dedicated components, thereby reducing overall device complexity while maintaining reliable centralized control.
3Reliability
If application descriptors are authenticated using signing certificates, then reliability is improved through tamper prevention, but ease of operation deteriorates due to authentication complexity
Solution Approach 1:
The authentication mechanism is pre-configured in the secure unit during manufacturing or initial setup. The signing certificates and authentication algorithms are already in place, so when application descriptors are read or updated, the authentication happens automatically without requiring user awareness or intervention. This preliminary preparation maintains reliability through authentication while preserving ease of operation.
4Reliability
If secure units (UICC/eUICC) are used to store application descriptors, then reliability is improved through security protection, but device complexity increases
Solution Approach 1:
The patent merges the secure unit functionality with the existing SIM card infrastructure (UICC/eUICC), which is already widely deployed in mobile devices. By integrating application descriptor storage into this existing secure element rather than introducing a completely new hardware component, the solution achieves enhanced security while minimizing the increase in device complexity.
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
A method for session creation and related products are provided in implementations of the disclosure. The method includes the following. A user equipment (UE) reads from a secure unit application descriptors 1 of a first application, where the application descriptors 1 is bound to a signing certificate of the first application or a digital fingerprint of the signing certificate. The UE creates a session by using the application descriptors1 as application descriptors in a UE route selection policy (URSP) rule. By adopting the method of the implementations of the disclosure, network reliability can be improved.