UE Security Context Deregistration for Stale KAUSF Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing 3GPP-based 5G networks face challenges in maintaining the latest security keys (KAUSF) when user equipment (UE) registers simultaneously with both 3GPP and non-3GPP networks, leading to multiple key generation issues, and there is a risk of rogue network functions impersonating UE, causing denial-of-service scenarios and overcharging.
Innovation Solution
A method and apparatus for managing security context in UE, which identifies registration with a new AMF, detects old security contexts, and initiates de-registration with old AUSFs to clear stale keys, ensuring only the latest KAUSF is maintained across different networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If UE registers simultaneously with multiple networks (3GPP and non-3GPP), then network coverage and connectivity options are improved, but multiple security keys (KAUSF) are generated causing security management complexity
Solution Approach 1:
The patent segments the security key management by network type, maintaining separate security contexts for 3GPP and non-3GPP networks. Each network has its own AUSF and KAUSF, preventing key confusion while enabling multi-network registration. The UDM stores network-type identifiers alongside security keys to ensure proper segmentation.
Solution Approach 2:
The patent implements dynamic security key management where the network actively monitors UE registration status and dynamically updates security contexts. When UE registers with a new network, the system dynamically generates new keys and invalidates old ones. The UDM continuously tracks which networks UE is registered with and adjusts security key validity accordingly.
2Adaptability or versatility
If multiple AUSFs generate security keys for UE authentication, then authentication flexibility is improved, but stale keys may remain causing security vulnerabilities
Solution Approach 1:
The patent implements feedback mechanisms where the UDM continuously monitors UE registration status and provides feedback to AUSFs about which security keys are still valid. When UE deregisters from a network, the UDM sends feedback to the corresponding AUSF to invalidate stale keys. This feedback loop ensures only current, valid keys are used for authentication.
Solution Approach 2:
The patent takes preliminary action by having the UDM proactively track UE registration status across all networks before authentication occurs. The system pre-establishes which AUSFs are currently valid for UE authentication based on recent registration records, preventing stale keys from being used even if authentication attempts occur.
3Ease of operation
If rogue network functions impersonate UE, then network access is gained, but denial-of-service attacks and overcharging occur
Solution Approach 1:
The patent applies local quality by making each security key and authentication context specific to a particular network and UE combination. The UDM stores network-type identifiers and AUSF references alongside security keys, creating locally-specific authentication credentials. Rogue network functions cannot impersonate UE across different networks because each network has its own isolated security context.
Data Source
AI summary
Embodiments of present disclosure relates to an apparatus and method for managing security context related to a UE. Initially, registration of a UE with a new AMF in a communication network is identified. Further, generation of new security context by new AUSF selected by the new AMF for authentication of the UE is detected. Further, presence of one or more old security contexts elated to the UE and generated by one or more old AUSFs selected by one or more old AMFs for one or more previous authentications of the UE, is detected. Upon the detection, de-registration of the UE with the one or more old AUSFs is initiated for managing security context related to the UE in the communication network. Thus, stale and inactive security context related to the UE may be deleted in the network and security of communication with the UE is enhanced.