User Plane Integrity Protection Mode Negotiation in 5G Registration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Integrity protection of User Plane (UP) data is not supported in Long Term Evolution (4G) networks, and there is a need for this feature in Next Generation (5G) networks to enhance security in communication networks.
Innovation Solution
Methods and apparatuses for a User Equipment (UE) to indicate its supported Integrity Protection for User Plane (IPUP) mode during registration, allowing negotiation and management of IPUP modes between the UE, radio access nodes, and core network nodes, including preferences and data rate settings, to ensure secure data transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If integrity protection is implemented for User Plane data in 4G LTE networks, then security of data transmission is improved, but device complexity and network compatibility deteriorate because the feature is not supported in existing 4G standards
Solution Approach 1:
The patent implements dynamic integrity protection by introducing multiple IPUP modes (mode 0, mode 1, mode 2) that can be negotiated between UE and network. The system dynamically selects the appropriate protection mode based on data rate thresholds and network policies, rather than applying static integrity protection to all User Plane data. This dynamic approach enables security enhancement while maintaining compatibility with existing 4G networks through optional negotiation.
Solution Approach 2:
The patent changes the parameter of integrity protection applicability by introducing data rate as a threshold parameter. When data rate exceeds a configured threshold, integrity protection is disabled; when below the threshold, it is enabled. This parameter-based approach allows the system to adapt security measures to actual data transmission characteristics, reducing complexity for high-rate traffic while enhancing security for low-rate IoT traffic.
2Reliability
If integrity protection is applied to all User Plane data, then security is improved, but data transmission efficiency deteriorates due to additional processing overhead
Solution Approach 1:
The patent introduces data rate as a dynamic parameter to control integrity protection application. A threshold is configured such that when data rate exceeds the threshold, integrity protection is disabled to maintain efficiency; when below the threshold, protection is enabled to ensure security. This parameter-based differentiation resolves the contradiction by adapting security measures to actual transmission requirements.
Solution Approach 2:
Instead of applying integrity protection universally to all User Plane data, the patent applies partial protection only to data flows that meet specific criteria (data rate below threshold, specific IPUP modes selected). This partial action approach avoids the excessive processing overhead of universal protection while maintaining security where genuinely needed, particularly for IoT devices with lower data rates.
3Reliability
If integrity protection negotiation is added to 4G networks, then security capability is improved, but network compatibility and standard adherence deteriorate
Solution Approach 1:
The patent implements dynamic negotiation of integrity protection capability between UE and network through extended capability indication messages. The UE indicates its IPUP mode support, and the network responds with the selected mode, creating a dynamic negotiation mechanism that works within existing 4G frameworks while enabling enhanced security where supported.
Solution Approach 2:
The patent creates a universal solution that works across multiple network types (4G LTE and 5G NR) and multiple device categories (IoT and mobile broadband). The IPUP mode negotiation mechanism is designed to be universally applicable, with fallback behavior that maintains compatibility with legacy networks while enabling enhanced functionality where supported.
4Adaptability or versatility
If multiple IPUP modes are supported for different data rates, then adaptability is improved, but device complexity increases due to mode negotiation and selection
Solution Approach 1:
The patent performs preliminary configuration of data rate thresholds and IPUP mode preferences during UE registration and capability indication, before actual data transmission begins. The network pre-negotiates the appropriate mode based on UE capabilities and network policy, storing this selection for subsequent data bearers. This preliminary action reduces runtime complexity by avoiding repeated negotiations for each data flow.
Solution Approach 2:
The UE indicates its own capability preferences for IPUP modes and data rate thresholds during registration, essentially self-describing its security requirements and capabilities. The network then uses this self-provided information to make the selection decision, reducing the computational burden on the network and simplifying the overall negotiation process.
Data Source
Figure 1
Figure 2a
Figure 2b
AI summary
A method (200) for operating a User Equipment (UE) is disclosed, the UE configured to connect to a communication network. The method comprises: indicating to the communication network an Integrity Protection for User Plane (IPUP) mode supported by the UE when requesting registration with the communication network (202). The IPUP mode comprises one of: use of Integrity Protection for User Plane data exchanged with the UE (202a), non-use of Integrity Protection for User Plane data exchanged with the UE (202b), or use of Integrity Protection for User Plane data, and non-use of Confidentiality Protection for User Plane data (202c). Also disclosed are an apparatus for operating a UE, methods and apparatus for operating a radio access node and a core node of a communication network, and a computer program operable to carry out methods for operating a UE, a radio access node and/or a core node of a communication network.