User Plane Integrity Protection in LTE and NR PDCP
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is no support for integrity protection of the user plane in LTE networks, particularly in Rel-15 UE and Rel-15 LTE eNBs, and Rel-15 gNBs in Enhanced Dual Connectivity, which limits the ability to securely manage user plane traffic.
Innovation Solution
Enabling user plane integrity protection (UP IP) in Rel-16 UE and Rel-16 LTE eNBs, and Rel-16 gNBs, by providing an indication of UP IP mode during attach requests and handover procedures, and implementing security mode commands to establish secure data radio bearers, ensuring integrity protection for user plane traffic in both LTE and NR PDCP protocols.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If user plane integrity protection is enabled in Rel-16 UE and network nodes, then data security and integrity are improved, but device complexity and protocol implementation difficulty increase
Solution Approach 1:
The integrity protection mechanism is segmented into distinct components: capability indication in attach requests, separate security mode command procedures, and specific PDCP configuration parameters. This segmentation allows the complex integrity protection feature to be implemented as modular additions to existing protocols rather than requiring complete protocol redesign.
Solution Approach 2:
The UE provides capability indication for UP IP mode during the attach request phase, before actual data transmission begins. This preliminary action allows the network to prepare appropriate security configurations and enables integrity protection to be activated seamlessly when needed, without disrupting ongoing communications.
2Reliability
If security mode commands are implemented to establish secure data radio bearers, then user plane traffic security is improved, but signaling overhead and procedure complexity increase
Solution Approach 1:
The security mode command procedure for activating UP IP is merged with existing security management workflows in the LTE and NR protocols. The capability indication is integrated into the attach request, and the activation follows standard security mode command patterns, allowing reuse of existing signaling structures rather than creating entirely new procedures.
Solution Approach 2:
The network node acts as an intermediary that receives capability indications from UEs, processes security requirements, and activates UP IP mode through standardized security mode commands. This intermediary approach allows complex security management to be handled centrally by the network while keeping UE implementation relatively simple.
3Reliability
If user plane integrity protection is activated during handover procedures, then mobility security is improved, but handover signaling overhead increases
Solution Approach 1:
The target network node receives and processes UP IP capability indications during the handover preparation phase, before the actual handover execution. This allows security configurations to be pre-established, so that when handover occurs, UP IP mode can be activated immediately without additional signaling delays during the critical handover execution window.
Data Source
AI summary
A method performed by a user equipment, UE, for enabling a user plane integrity protection mode in a radio access network packet data convergence protocol, PDCP, is provided. The method includes providing an indication of a user plane integrity protection, UP IP, mode supported by the UE. The method further includes receiving an activation message from a receiving node that includes an indication to the UE to activate the UP IP mode. The receiving node is a long term evolution eNodeB. Methods performed by a network node and a radio access node are also provided.