Terminal Analytics Authorization via UDM in 5G Core Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The 5G core network lacks the capability to authorize analytics requests from terminal devices at a per-device level, posing a security risk and hindering secure AI/ML operations.
Innovation Solution
Implement a system where terminal devices transmit a subscription for analytics with an identity to the Unified Data Management (UDM), which registers device information and sends a subscribed identity, enabling subsequent authorization and data exchange with Session Management Function (SMF) or Application Function (AF) to receive analytics results.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the 5G core network enables AI/ML services with data transmission support, then the functionality and versatility of the network is improved, but security risks and authorization vulnerabilities worsen due to lack of per-terminal device level authorization
Solution Approach 1:
The patent segments the authorization mechanism into per-terminal device level controls. The UDM stores and manages authorization information specifically for each terminal device, enabling granular authorization decisions for analytics requests rather than blanket network-wide authorization. This segmentation allows the network to maintain AI/ML service versatility while implementing device-specific security controls.
Solution Approach 2:
The UDM acts as an intermediary between the terminal device and the analytics processing functions (SMF/AF). It receives analytics requests, verifies terminal device authorization based on stored subscription information, and only permits authorized requests to proceed. This intermediary role resolves the contradiction by enabling AI/ML functionality while filtering out unauthorized access attempts through centralized authorization management.
2Reliability
If the network implements per-terminal device authorization for analytics requests, then authorization security is improved, but the device complexity and operational overhead worsen
Solution Approach 1:
The UDM performs multiple functions within the 5G core network architecture, including subscription management, user profile management, and now authorization management for analytics requests. By making the UDM multi-functional, the patent avoids adding separate dedicated authorization servers, thereby improving security without proportionally increasing overall network device complexity. The existing UDM infrastructure is leveraged for the additional authorization function.
Solution Approach 2:
The terminal device's authorization status is determined automatically by the UDM based on pre-stored subscription information. The system self-services the authorization verification process without requiring manual intervention or complex external authorization protocols. The UDM autonomously checks whether the terminal device is authorized to receive analytics based on its stored data, reducing operational overhead while maintaining security.
3Measurement precision
If the UDM stores and manages terminal device information for authorization, then authorization accuracy is improved, but the data management complexity and information storage requirements worsen
Solution Approach 1:
The UDM performs preliminary action by storing terminal device authorization information (such as analytics subscription data) in advance, before actual analytics requests are made. This pre-stored information enables rapid and accurate authorization decisions when requests arrive, improving authorization accuracy without requiring complex real-time analysis. The data management complexity is justified by the security benefits of having pre-validated authorization records.
Data Source
AI summary
Embodiments of the present disclosure relate to terminal device authorization for requesting analytics. A terminal device transmits a subscription for an analytics with an analytics identity to a Unified Data Management (UDM), receives a subscribed analytics identity from the UDM, according to the subscription for the analytics, transmits a request comprising the analytics identity to a Session Management Function (SMF) or an Application Function (AF), and receives analytics result data from the SMF or the AF, according to the the analytics identity after authorization of the request. The terminal device authorization for requesting analytics as provided in the present disclosure is more secure.