URSP Policy Protection for Secure 5G Roaming Routing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In 5G networks, there is a lack of mechanisms to prevent visited public land mobile networks (VPLMN) from modifying user equipment route selection policy (URSP) rules sent by the home public land mobile network (HPLMN), leading to potential unauthorized changes in traffic routing and security vulnerabilities.
Innovation Solution
Implementing security procedures to integrity-protect and optionally encrypt URSP rules using message authentication codes (MAC-I) generated from a key authentication service function, ensuring that only the HPLMN can provide secure URSP data to the UE, thereby maintaining the integrity and confidentiality of these policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If URSP rules are transmitted without security protection to enable roaming connectivity, then network interoperability and subscriber convenience are improved, but security vulnerabilities and unauthorized modifications by VPLMN increase
Solution Approach 1:
The HPLMN applies security protection (integrity protection and/or encryption) to the URSP rules before transmitting them to the UE. This preliminary security processing ensures that when the rules are later forwarded by the VPLMN, they cannot be unauthorizedly modified, thus maintaining security while enabling roaming connectivity.
Solution Approach 2:
The patent introduces security mechanisms (integrity protection using MAC-I and/or encryption) as intermediaries between the HPLMN and UE communication. These security layers act as mediators that allow the VPLMN to forward the data while preventing unauthorized modifications, resolving the contradiction between roaming capability and security.
2Reliability
If security protection mechanisms are implemented for URSP rules, then integrity and confidentiality are improved, but device complexity and processing overhead increase
Solution Approach 1:
The UE autonomously verifies the integrity and/or decrypts the URSP rules using security credentials stored in its USIM card. This self-service approach allows security verification to be performed by the UE itself without requiring additional network infrastructure or complex processing at the VPLMN, thus maintaining data integrity while limiting the increase in overall system complexity.
3Productivity
If URSP rules are sent through VPLMN without protection, then network efficiency and subscriber convenience are improved, but loss of information and unauthorized modifications increase
Solution Approach 1:
The HPLMN performs integrity protection and/or encryption on the URSP rules before transmission. This preliminary action ensures that the data maintains its integrity throughout the roaming process, preventing information loss or unauthorized modifications while the data passes through the VPLMN.
Solution Approach 2:
The UE verifies the integrity of received URSP rules by checking the MAC-I and/or decrypting the data using stored credentials. This feedback mechanism allows the UE to detect any unauthorized modifications, ensuring that policy data integrity is maintained even when transmitted through multiple networks.
Data Source
AI summary
Techniques for managing user equipment policy data in a communication network environment are disclosed. For example, techniques are provided for managing user equipment policy data to be sent to user equipment by protecting the user equipment policy data in a communication network to which the user equipment is subscribed (e.g., a home communication network) such that the user equipment policy data can be sent to the user equipment through a communication network to which the user equipment is attached (e.g., a visited communication network) in a secure manner.