Network Slice-Specific Keying for Cross-Slice Security Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing 5G networks use a single set of security keys for all network slices, which can lead to security vulnerabilities and attacks due to varying security requirements among different applications hosted on these slices, such as Denial-of-Service attacks and information disclosure.
Innovation Solution
Implementing network slice-specific security keys (SSKs) for each network slice, where both the user equipment (UE) and the provider network generate unique key sets for secure communication with each slice, ensuring differentiated security levels based on application-specific needs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single set of security keys is used for all network slices, then device complexity is reduced and ease of operation is improved, but security reliability deteriorates due to varying security requirements among different applications
Solution Approach 1:
The patent segments the single set of security keys into multiple network slice-specific key sets, with each key set dedicated to a specific network slice. This segmentation allows different security levels to be applied to different slices based on their requirements, thereby improving security reliability without requiring complete redesign of the entire system.
Solution Approach 2:
The patent implements local quality by assigning different security key characteristics to different network slices according to their specific security requirements. Each network slice can have customized security parameters (such as key strength, encryption algorithms) tailored to its application needs, rather than applying a uniform security level across all slices.
2Reliability
If network slice-specific security keys are implemented for each network slice, then security reliability is improved by preventing cross-slice attacks, but device complexity increases due to multiple key sets
Solution Approach 1:
The patent divides the security key management into separate segments for each network slice, allowing independent key generation, storage, and management. This segmentation prevents cross-slice attacks by ensuring that compromise of one slice's keys does not affect other slices, while the modular structure helps manage complexity through organized separation.
Solution Approach 2:
The patent introduces an intermediary key management function that mediates between the multiple network slice-specific key sets and the authentication procedures. This intermediary layer simplifies the complexity by providing standardized interfaces and automated key selection, reducing the burden on devices while maintaining multiple key sets for enhanced security.
3Object-affected harmful factors
If network slice-specific security keys are used, then harmful factors are reduced by preventing Denial-of-Service and information disclosure attacks, but ease of operation deteriorates due to differentiated security levels
Solution Approach 1:
The patent segments security operations into slice-specific procedures, where each network slice has its own key set and authentication流程. This segmentation isolates harmful factors within individual slices, preventing attacks from propagating across the entire network, while automated key management systems handle the operational complexity.
Solution Approach 2:
The patent implements feedback mechanisms in the key management system that automatically adjust security parameters based on detected threats and operational conditions. This feedback loop maintains ease of operation by automating security adjustments, reducing the need for manual intervention while continuously adapting to prevent harmful factors.
Data Source
AI summary
A device may comprise a processor. The processor may be configured to: receive, from a User Equipment device (UE), a registration request; receive, from a network function, an indication that the first network device is to use a first set of security keys for communications between the UE and a first network slice and a second set of security keys for communications between the UE and a second network slice; generate the first set of security keys and the second set of security keys in response to receiving the indication; use the first set of security keys for securing first communications between the UE and the first network slice; and use the second set of security keys for securing second communications between the UE and the second network slice.