Selective Message Encryption for Control and User Plane Nodes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network systems using UDP-based communication lack selective message encryption, exposing them to security vulnerabilities such as data disclosure and Denial-of-Service attacks, particularly in scenarios where control plane and user plane nodes are geographically separated and connected via public networks.
Innovation Solution
The method involves negotiating an encryption level between control plane and user plane nodes, allowing for selective encryption of messages at the message, Information Element, or feature level using public/private key pairs or symmetric cryptographic keys, thereby balancing security needs with processing power requirements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If selective message encryption is implemented between control plane and user plane nodes, then network security is improved, but processing power requirements increase
Solution Approach 1:
The patent segments the message structure into distinct parts (headers and Information Elements) and applies encryption selectively to only the sensitive Information Elements rather than the entire message. This segmentation allows encryption to be applied only where needed, improving security while minimizing the processing overhead associated with encrypting entire messages.
Solution Approach 2:
The patent implements local quality by applying different encryption treatments to different parts of the message based on their sensitivity. Sensitive Information Elements are encrypted while non-sensitive headers and elements remain in plaintext. This localized approach to encryption provides security for critical data while conserving processing resources.
2Reliability
If full message encryption is applied to all communications, then security against DOS attacks is improved, but computational overhead increases
Solution Approach 1:
The patent applies partial action by encrypting only the necessary sensitive portions of messages (Information Elements) rather than applying full encryption to entire messages. This partial approach provides sufficient security protection against DOS attacks while avoiding the excessive computational overhead of encrypting all message components, thereby maintaining better computational efficiency.
3Reliability
If encryption is applied at the Information Element level, then security is improved, but message complexity increases
Solution Approach 1:
The patent segments the message into structured components (headers and Information Elements) with clear delimiters. This segmentation, while enabling selective encryption of Information Elements, maintains a regular and predictable message structure that does not significantly increase overall complexity. The segmented approach allows receiving nodes to efficiently identify and process encrypted portions without parsing entire messages.
Data Source
AI summary
A network node selectively encrypts messages between a user plane node and a control plane node in a network system. The user plane node and the control plane node negotiate a connection and indicate an encryption level for the connection. The encryption level is selected from an Information Element (IE) level, a message level, or a feature level. The user plane node and the control plane node selectively encrypt at least a portion of the messages between the user plane node and the control plane node based on the encryption level for the connection.