UE User Plane Security Policy for DRB-IP Capacity Limits
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In 5G systems, the establishment of multiple integrity protected PDU sessions without considering the UE's maximum DRB-IP rate can lead to rejection of sessions and service delays due to mismatched security policy assignments exceeding the UE's computational capacity.
Innovation Solution
A mechanism is introduced to manage the Max DRB-IP rate centrally, allowing the UE to track and adjust its available capacity before AS resource allocation, ensuring it has sufficient computational resources for integrity protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple integrity protected PDU sessions are established without considering UE's maximum DRB-IP rate, then security coverage is improved, but UE computational capacity is exceeded leading to session rejection
Solution Approach 1:
The UE calculates and reports its available DRB-IP rate before the PDU session establishment procedure begins. This preliminary action allows the SMF to make informed decisions about security policy activation, preventing capacity overload while maximizing security coverage. The UE proactively provides capacity information rather than reacting to failures after sessions are established.
Solution Approach 2:
The UE includes feedback information about its available DRB-IP rate in the PDU Session Establishment Request message. This feedback mechanism enables the network to adjust security policies based on actual UE capacity, creating a closed-loop system that prevents session rejection while maintaining comprehensive security coverage.
2Reliability
If UP security policy is activated for all DRBs, then security protection is improved, but UE processing overhead increases
Solution Approach 1:
The patent applies different security treatments to different DRBs based on their specific requirements and the UE's available capacity. Not all DRBs need integrity protection - the system selectively activates it only where necessary, optimizing the balance between security coverage and processing overhead. This localized approach allows granular control over security resource allocation.
Solution Approach 2:
The system dynamically adjusts security parameters (integrity protection activation) based on the UE's available DRB-IP rate. When capacity is limited, the system changes the security parameter from 'integrity protection activated' to 'integrity protection deactivated' for certain DRBs, optimizing the trade-off between protection level and computational burden.
3Productivity
If security policy negotiation is centralized, then resource allocation efficiency is improved, but system complexity increases
Solution Approach 1:
The UE performs self-assessment of its available DRB-IP rate and autonomously includes this information in the PDU Session Establishment Request. This self-service approach eliminates the need for complex centralized management systems to track and control security policies, as the UE manages its own capacity reporting while still benefiting from coordinated resource allocation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method to operate a UE for handling security policy for user plane protection of communications in a communications system is provided. The method includes transmitting a packet data unit (PDU) session establishment request network access stratum (NAS) message toward an Access and Mobility Management Function (AMF) to establish a PDU session. The 5 method further includes receiving an access network (AN) specific resource setup message indicating whether the UE is to activate integrity protection for data radio bearers (DRBs) serving the PDU session.