SNPN Onboarding Security Policy for Protected User Plane Bearers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing wireless communication systems lack effective methods to protect standalone non-public network (SNPN) credentials during the onboarding process, as terminal devices cannot reliably ensure user plane security policies are correctly configured and trusted, leading to potential security risks.
Innovation Solution
The proposed solution involves configuring a user plane security policy for terminal devices to activate user plane encryption and integrity protection for data radio bearers (DRBs) within protocol data unit sessions, allowing access network devices to autonomously set security policies and ensuring terminal devices verify the security requirements before implementing these protections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If terminal devices access onboarding network to obtain SNPN credentials, then credential acquisition is enabled, but security risks arise from untrusted or faulty access network devices
Solution Approach 1:
The patent applies preliminary action by configuring user plane security policies before terminal devices transmit SNPN credentials. The access network device pre-configures encryption and integrity protection parameters, ensuring security measures are in place before sensitive credential data flows through the network, thereby preventing potential security breaches during the onboarding process
Solution Approach 2:
The patent implements parameter changes by dynamically adjusting user plane security policy parameters based on the terminal device's establishment cause. When onboarding is detected, the system modifies security parameters to enable enhanced encryption and integrity protection, adapting the security level to match the specific risk profile of credential transmission scenarios
2Reliability
If user plane security policy is configured to activate encryption and integrity protection, then security of SNPN credentials is enhanced, but device complexity increases
Solution Approach 1:
The patent applies local quality by implementing security policies specifically targeted at user plane data bearers carrying SNPN credentials, rather than uniformly applying complex security measures to all network traffic. The security enhancement is localized to the specific data radio bearers involved in credential transmission, reducing overall system complexity while maintaining necessary security
Solution Approach 2:
The patent uses copying by leveraging existing 5G security policy frameworks and configurations, adapting proven security mechanisms rather than creating entirely new complex security architectures. The solution copies and applies established encryption and integrity protection methods to the specific context of SNPN onboarding, simplifying implementation while ensuring security
Data Source
AI summary
The present disclosure provides a communication method and apparatus, and a device. The communication method may be applied to a communication system, such as an onboarding network (ONN) system. The method may include: an access network device receives a registration request message from a terminal device, establishment cause information carried in the registration request message being to log on to a standalone non-public network (SNPN); and the access network device configures a user plane security policy of the terminal device as a first security policy according to the establishment cause information so as to indicate to activate user plane encryption protection and/or user plane integrity protection for a DRB belonging to a PDU session.