UE Security Context Cleanup Across 3GPP and Non-3GPP Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing 5G communication systems face challenges in managing multiple security contexts and keys when user equipment (UE) simultaneously registers with both 3GPP and non-3GPP networks or transitions between different access networks, leading to potential security vulnerabilities and denial-of-service scenarios due to stale or unused security keys.
Innovation Solution
A method and apparatus for managing security context in UE, which includes identifying registration with a new AMF, detecting old security contexts, and initiating de-registration with old AUSFs to clear stale security keys, ensuring only the latest keys are maintained and used.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If UE simultaneously registers with multiple networks (3GPP and non-3GPP) and transitions between different access networks, then network coverage and connectivity flexibility are improved, but multiple security contexts and keys are generated leading to potential security vulnerabilities and denial-of-service scenarios
Solution Approach 1:
The patent extracts and removes stale security contexts from the system. When a UE re-authenticates with a new AUSF, the system identifies and removes old security contexts associated with previous AUSFs, ensuring only current valid keys are maintained. This extraction of obsolete security data eliminates the vulnerability of having multiple concurrent security contexts while preserving the ability to register with multiple networks.
2Adaptability or versatility
If multiple security contexts are maintained for different network registrations, then authentication flexibility is improved, but system complexity and risk of stale key usage increase
Solution Approach 1:
The system performs preliminary identification and removal of stale security contexts before new authentication occurs. By proactively managing security contexts and removing obsolete ones in advance, the system prevents complexity from accumulating and ensures only relevant keys are available for authentication, maintaining flexibility without excessive complexity.
3Loss of information
If old security contexts are not cleaned up, then historical authentication data is preserved, but rogue network functions can impersonate UE and denial-of-service attacks become more feasible
Solution Approach 1:
The patent converts the potential harm of retaining old security contexts into a benefit by implementing a targeted cleanup mechanism. Old security contexts are removed not because historical data is lost, but because the system selectively eliminates only the vulnerable stale keys while preserving the ability to authenticate with current networks. This transforms the risk of data retention into enhanced security through selective removal.
Data Source
AI summary
Embodiments of present disclosure relates to an apparatus and method for managing security context related to a UE. Initially, registration of a UE with a new AMF in a communication network is identified. Further, generation of new security context by new AUSF selected by the new AMF for authentication of the UE is detected. Further, presence of one or more old security contexts related to the UE and generated by one or more old AUSFs selected by one or more old AMFs for one or more previous authentications of the UE, is detected. Upon the detection, de-registration of the UE with the one or more old AUSFs is initiated for managing security context related to the UE in the communication network. Thus, stale and inactive security context related to the UE may be deleted in the network and security of communication with the UE is enhanced.