UE User Plane Security Policy for DRB-IP Capacity Limits

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

In 5G systems, the establishment of multiple integrity protected PDU sessions without considering the UE's maximum DRB-IP rate can lead to rejection of sessions and service delays due to mismatched security policy assignments exceeding the UE's computational capacity.

Innovation Solution

A mechanism is introduced to manage the Max DRB-IP rate centrally, allowing the UE to track and adjust its available capacity before AS resource allocation, ensuring it has sufficient computational resources for integrity protection.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If multiple integrity protected PDU sessions are established without considering UE's maximum DRB-IP rate, then security coverage is improved, but UE computational capacity is exceeded leading to session rejection

Engineering Contradiction:
Improvesecurity coverageVSAvoidsession establishment success rate
Core Design Contradiction:
ReliabilityVSProductivity

Solution Approach 1:

The UE calculates and reports its available DRB-IP rate before the PDU session establishment procedure begins. This preliminary action allows the SMF to make informed decisions about security policy activation, preventing capacity overload while maximizing security coverage. The UE proactively provides capacity information rather than reacting to failures after sessions are established.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The UE includes feedback information about its available DRB-IP rate in the PDU Session Establishment Request message. This feedback mechanism enables the network to adjust security policies based on actual UE capacity, creating a closed-loop system that prevents session rejection while maintaining comprehensive security coverage.

Inventive Principle:
Principle #23Feedback

2Reliability

If UP security policy is activated for all DRBs, then security protection is improved, but UE processing overhead increases

Engineering Contradiction:
Improvedata protectionVSAvoidcomputational overhead
Core Design Contradiction:
ReliabilityVSUse of energy by moving object

Solution Approach 1:

The patent applies different security treatments to different DRBs based on their specific requirements and the UE's available capacity. Not all DRBs need integrity protection - the system selectively activates it only where necessary, optimizing the balance between security coverage and processing overhead. This localized approach allows granular control over security resource allocation.

Inventive Principle:
Principle #3Local quality

Solution Approach 2:

The system dynamically adjusts security parameters (integrity protection activation) based on the UE's available DRB-IP rate. When capacity is limited, the system changes the security parameter from 'integrity protection activated' to 'integrity protection deactivated' for certain DRBs, optimizing the trade-off between protection level and computational burden.

Inventive Principle:
Principle #35Parameter changes

3Productivity

If security policy negotiation is centralized, then resource allocation efficiency is improved, but system complexity increases

Engineering Contradiction:
Improveresource allocation efficiencyVSAvoidsecurity management architecture
Core Design Contradiction:
ProductivityVSDevice complexity

Solution Approach 1:

The UE performs self-assessment of its available DRB-IP rate and autonomously includes this information in the PDU Session Establishment Request. This self-service approach eliminates the need for complex centralized management systems to track and control security policies, as the UE manages its own capacity reporting while still benefiting from coordinated resource allocation.

Inventive Principle:
Principle #25Self-service

Data Source

PatentEP3782394B1UE controlled handling of the security policy for user plane protection in 5g systems
Publication Date: 2026.03.04 TELEFONAKTIEBOLAGET LM ERICSSON (PUBL)
  • EP3782394B1 patent drawingFigure 1
  • EP3782394B1 patent drawingFigure 2
  • EP3782394B1 patent drawingFigure 3

AI summary

A method to operate a UE for handling security policy for user plane protection of communications in a communications system is provided. The method includes transmitting a packet data unit (PDU) session establishment request network access stratum (NAS) message toward an Access and Mobility Management Function (AMF) to establish a PDU session. The 5 method further includes receiving an access network (AN) specific resource setup message indicating whether the UE is to activate integrity protection for data radio bearers (DRBs) serving the PDU session.