Service-Specific User Plane Security for 5G PDU Sessions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In 5G wireless communication systems, applying a uniform user plane security policy to all traffic within a PDU session can lead to unnecessary security of non-sensitive traffic, causing speed slowdowns, or inadequate protection of critical traffic, due to the inability to differentiate between different types of service data flows.
Innovation Solution
Implementing a method and device to apply a different security policy for each service traffic in a PDU session by configuring a new data structure, UpSecurityConfig, which includes a service data flow identifier and security policy, allowing prioritization and differentiation of security policies based on service data flow requirements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a uniform user plane security policy is applied to all traffic within a PDU session, then security coverage is improved, but transmission speed deteriorates due to unnecessary security processing on non-sensitive traffic
Solution Approach 1:
The patent segments the uniform security policy into differentiated security policies based on service data flow types. The network entity classifies service data flows into sensitive and non-sensitive categories, and applies security policies accordingly - full security processing for sensitive traffic while allowing faster transmission for non-sensitive traffic. This segmentation resolves the contradiction by enabling selective security application rather than blanket enforcement.
Solution Approach 2:
The patent implements local quality by applying different security policy characteristics to different parts of the traffic stream. Instead of applying the same security policy uniformly across all PDU session traffic, the system tailors security processing levels to local traffic characteristics - enhancing security for critical service data flows while reducing overhead for less critical traffic, thereby optimizing both security coverage and transmission speed.
2Stability of the object's composition
If a uniform user plane security policy is applied to all traffic within a PDU session, then security consistency is improved, but service quality differentiation deteriorates
Solution Approach 1:
The patent divides the homogeneous security policy into heterogeneous security policies matched to different service data flow types. By segmenting traffic into sensitive and non-sensitive categories and applying appropriate security policies to each segment, the system achieves both security consistency for critical traffic and service quality differentiation for varied traffic types.
Solution Approach 2:
The patent introduces dynamic security policy selection based on service data flow characteristics. Instead of a static uniform policy, the system dynamically adapts security processing based on real-time traffic classification, allowing the security policy to change and adjust to different service requirements while maintaining consistency for sensitive traffic and flexibility for non-sensitive traffic.
3Speed
If security policy differentiation is implemented for different service data flows, then transmission speed is improved for non-sensitive traffic, but device complexity increases
Solution Approach 1:
The patent applies universality by implementing a multi-functional security policy management mechanism that handles multiple service data flow types through a unified framework. The network entity performs traffic classification, policy selection, and security processing within a single integrated system, avoiding the need for separate complex security management systems for each traffic type while still achieving differentiated security and speed optimization.
Data Source
AI summary
A method and device for applying a different security policy, per service traffic, to a protocol data unit (PDU) session in a wireless communication system. The method comprises receiving, by a session management function (SMF) managing a session for a user equipment (UE), first configuration information about a first user plane security policy of the UE from a unified data management (UDM) managing subscription information about the UE, receiving, by the SMF, second configuration information about a second user plane security policy to be applied to a specific service data flow from a policy and control function (PCF) managing a policy and charging control (PCC) rule, and determining a user plane security policy to be applied to the UE based on one selected from the first user plane security policy and the second user plane security policy according to priority.