SEPP Provisioning for 5G PLMN Security Element Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
5G communication systems face challenges in security management due to the need for enhanced security protocols in Service-Based Architecture (SBA) that effectively protect diverse information elements across different network functions, especially when communicating between visiting and home public land mobile networks (PLMNs) over the N32 reference point.
Innovation Solution
Implementing a Security Edge Protection Proxy (SEPP) that is provisioned with information about the expected information elements and required security mechanisms, allowing it to apply appropriate security operations such as encryption and integrity protection using the JOSE framework on HTTP messages, ensuring secure communication across PLMNs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a centralized security function in SEPP applies security operations on HTTP message payload, then security protection is provided for information elements, but the application layer becomes completely unaware of security considerations and cannot format payload according to security needs
Solution Approach 1:
The patent segments the security processing function into a separate SEPP component that operates independently from the application layer. The SEPP parses HTTP messages, identifies information elements, and applies security operations (encryption, integrity protection) separately from the application layer formatting process. This segmentation allows the application layer to focus on business logic while the SEPP handles security considerations.
Solution Approach 2:
The SEPP acts as an intermediary component between the application layer and the network. It receives HTTP messages from network functions, applies security operations to the payload, and forwards the secured messages. This intermediary role allows security operations to be applied without requiring the application layer to be aware of or modify its formatting behavior.
2Reliability
If SEPP parses HTTP messages and identifies all IEs requiring confidentiality protection, then appropriate security operations are applied to each IE, but processing complexity and time increase
Solution Approach 1:
The SEPP performs preliminary parsing of the HTTP message structure to identify information elements and their security requirements before applying security operations. By pre-identifying which IEs require confidentiality protection and which require integrity protection, the SEPP can efficiently apply the appropriate security operations without repeated analysis during the security processing phase.
Solution Approach 2:
The patent applies different security operations to different information elements based on their specific security requirements. Some IEs require confidentiality protection (encryption), while others require only integrity protection. The SEPP applies the appropriate security operation locally to each IE based on its security characteristics, rather than applying a uniform security approach to the entire message payload.
3Reliability
If SEPP applies encryption and signature operations on JSON IEs, then confidentiality and integrity are protected, but device complexity and computational overhead increase
Solution Approach 1:
The patent changes the security processing parameters based on the type of information element being protected. For JSON IEs, the SEPP applies JSON Web Encryption (JWE) for confidentiality and JSON Web Signature (JWS) for integrity. For binary payload, separate security procedures are executed. This parameter-based approach allows the system to apply appropriate security operations based on the data format and security requirements, optimizing the balance between security and complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In a communication system comprising a first network operatively coupled to a second network, wherein the first network comprises a first security edge protection proxy element operatively coupled to a second security edge protection proxy element of the second network, a method comprises provisioning at least a given one of the first and second security edge protection proxy elements with configuration information that enables the given security edge protection proxy element to identify at least one security operation to be applied to at least one information element in a received message before sending the message to the other one of the first and second security edge protection proxy elements.