SEPP Message Segmentation for 5G PLMN Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In 5G network function messaging, existing security measures fail to effectively protect and modify HTTP messages across different PLMNs while ensuring integrity and authorization of modifications made by intermediate nodes.
Innovation Solution
The solution involves forming an integrity-protected second message part that includes a modification structure for subsequent modifications by intermediate nodes, using encryption and integrity protection methods like JSON Web Encryption and JSON Web Signature, and a modification matrix to track and verify changes, ensuring that only authorized modifications are applied and recorded.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If HTTP messages are encrypted and integrity protected for security, then message security is improved, but intermediate nodes cannot modify messages as needed
Solution Approach 1:
The message is segmented into different parts with different protection levels. Critical message parts are integrity protected to prevent unauthorized modification, while non-critical parts are left unprotected to allow intermediate node modifications. This segmentation resolves the contradiction by applying security selectively rather than uniformly across the entire message.
Solution Approach 2:
Different parts of the message receive different quality of protection. Instead of applying uniform encryption and integrity protection to all message components, the patent applies these protections locally only to specific parts that require security, while leaving other parts accessible for modification by intermediate nodes.
2Reliability
If all message parts are integrity protected, then message integrity is improved, but authorized modifications by intermediaries cannot be performed
Solution Approach 1:
The message is prepared in advance with specific parts marked for integrity protection and other parts designated as modifiable. This preliminary classification allows intermediate nodes to know which parts they can modify without compromising message integrity, enabling both protection and modification capabilities to coexist.
Solution Approach 2:
The patent introduces a mechanism where intermediate nodes act as trusted mediators that can modify specific non-critical message parts. The system designates certain message parts as safe for intermediary modification, allowing intermediaries to perform necessary adjustments while maintaining integrity protection for critical parts.
3Reliability
If messages are protected end-to-end, then security is improved, but intermediate nodes cannot perform necessary modifications
Solution Approach 1:
The end-to-end message protection is segmented into critical and non-critical parts. Critical parts maintain end-to-end security through integrity protection, while non-critical parts are made accessible to intermediate nodes for necessary modifications, thus preserving both security and intermediary functionality.
Solution Approach 2:
Instead of applying uniform end-to-end protection to the entire message, the patent applies protection locally only where necessary. This allows intermediate nodes to access and modify specific parts of the message that do not require end-to-end security, while critical parts remain protected.
Data Source
Figure 1~5
Figure 3
Figure 4
AI summary
A security edge proxy, SEPP, receives a first message that has been sent by a first network function and addressed to a second network function. The first message has first message parts having: a request line or a response line; at least one header and an optional payload.Each first message part includes one or more features and optional sub-features. The SEPP forms:an encrypted second message part by encrypting as a single block a first set of the features and sub-features of the first message parts; and an integrity protected second message part that has a second set of the features and sub-features of the first message parts.The integrity protected second message part further has references to each of the features and sub-features of the first set. The SEPP forms a second message that contains the encrypted second message part; and the integrity protected second message part.