Slice-Specific Keying for Secure Local NAS Path Termination
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional techniques fail to achieve localization and shortening of the NAS signal transmission path while ensuring security in communications between the RAN and the core network.
Innovation Solution
A network node generates unique keys for each network slice or network node type to establish secure communication paths, distributing these keys to ensure confidentiality and integrity protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Length of moving object
If the RAN terminates NAS signals carrying a transport function and serves as a termination point for communications with confidentiality and integrity protection, then the NAS signal transmission path is localized and shortened, but the security of communication between the RAN and the core network is not sufficiently guaranteed for NAS signals other than those carrying a transport function
Solution Approach 1:
The patent segments the key management system by generating separate keys for different network nodes and network slices. Each network node receives a unique key from the AMF, and each network slice has its own dedicated key. This segmentation ensures that security is maintained at the individual node and slice level while allowing the RAN to terminate NAS signals locally, thus resolving the contradiction between path shortening and security guarantee.
Solution Approach 2:
The patent implements local quality by providing differentiated security keys to different network nodes based on their specific roles and network slices. Each network node has its own locally-valid key generated by the AMF, allowing the RAN to provide security services locally without compromising the security of other nodes. This enables the RAN to terminate NAS signals while maintaining appropriate security levels for each specific node and slice.
2Reliability
If unique keys are generated for each network node and network slice to ensure security, then communication security is guaranteed, but the system complexity increases
Solution Approach 1:
The patent applies universality by using a single AMF (Access and Mobility Management Function) that performs multiple functions: it manages keys for all network nodes, generates slice-specific keys, and distributes keys to appropriate nodes. This multi-functional approach consolidates the complexity into a single universal component rather than requiring separate key management systems for each node, thus maintaining security while managing complexity centrally.
Solution Approach 2:
The patent implements preliminary action by having the AMF generate and distribute all necessary keys to network nodes before the nodes need to terminate NAS signals. The key establishment process occurs in advance during network initialization or slice setup, so that when the RAN needs to terminate NAS signals, the security keys are already in place. This eliminates the need for complex real-time key generation and distribution mechanisms.
Data Source
AI summary
Provided is a network node which, in order to establish a safe communication path between another network node and a terminal, comprises a control unit which generates a key used in the other network node on the basis of information indicating the type of the other network node or a network slice to which the other network node belongs such that the key has a value unique to the type or the network slice, and a transmission unit which transmits a message including the key to the other network node.