SEPP Protection Policy Signaling for Selective 5G Message Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In 5G Service Based Architecture, there is a need for efficient and selective protection of signaling messages between different public land mobile networks (PLMNs) using Security Edge Protection Proxies (SEPPs), as existing mechanisms do not adequately address the varying security requirements for different parts of HTTP messages.
Innovation Solution
A signaling-based approach for remote provisioning and updating of protection policies in the visiting SEPP (vSEPP) is implemented, where the home SEPP (hSEPP) obtains policy information from a repository or local configuration and distributes it to the vSEPP via an N32 interface, ensuring selective protection of outgoing messages based on network function types and operator-specific policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SEPP implements application layer security for all data exchanged between inter-network NFs, then security protection is improved, but device complexity increases due to the need to handle different protection levels for different message parts
Solution Approach 1:
The patent segments the HTTP message into different parts (Request/Response Line, Header, Payload) and applies different protection mechanisms to each segment. The SEPP selectively encrypts, integrity-protects, or leaves unprotected specific parts of the message based on policy requirements, rather than applying uniform protection to the entire message.
Solution Approach 2:
The patent implements local quality by applying different security protection levels to different parts of the message. Critical information elements receive encryption and integrity protection, while other parts may receive only integrity protection or no protection, optimizing the balance between security and complexity.
2Adaptability or versatility
If SEPP obtains security policies from centralized repository or local configuration, then adaptability to policy changes is improved, but information loss occurs when policies need to be synchronized between home and visited SEPP
Solution Approach 1:
The patent introduces the home SEPP as an intermediary that receives security policies from the centralized repository (NRF) or local configuration, processes them, and then distributes the necessary policy information to the visited SEPP through signaling messages. This mediator approach ensures consistent policy distribution while allowing the visited SEPP to operate autonomously with the received policies.
Solution Approach 2:
The patent implements preliminary action by having the home SEPP obtain and process security policies in advance before the visited SEPP needs them. The policies are prepared and distributed through signaling messages before actual message exchange occurs, ensuring the visited SEPP has the necessary protection information ready.
3Ease of operation
If signaling channel is used to distribute protection policy information from home SEPP to visited SEPP, then ease of operation is improved, but loss of time occurs during policy distribution and updating
Solution Approach 1:
The patent applies preliminary action by distributing security policies through signaling messages during the initial SEPP-SEPP connection establishment or during idle periods before they are needed for actual message protection. This reduces the time impact when policies need to be in place for immediate message exchange.
Solution Approach 2:
The patent implements continuity of useful action by establishing the signaling channel for policy distribution as part of the ongoing SEPP-SEPP interaction framework. The same signaling infrastructure used for message exchange is leveraged for policy distribution, eliminating the need for separate dedicated policy transfer mechanisms and reducing overall time loss.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method, apparatus and computer program product may be provided for signaling- based remote provisioning and updating of protection policy information in a SEPP of a visited network. A method may include obtaining, at a home network node (hSEPP), protection policy information from a local repository in a home network or via configuration. The hSEPP is a network node at a boundary of the home netowork, and the home network is a public land mobile network (hPLMN). The method includes distributing, via a signaling interface, the protection policy information to a visited network node (vSEPP) within a visited network (vPLMN). The vSEPP is a network node at a boundary of a second network. The protection policy information includes information regarding protection of signaling messages addressed for network functions (NFs) hosted in the hPLMN and is configured for enabling the vSEPP to selectively protect outgoing messages to hSEPP in the home network.