Wireless Network Message Integrity with Proxy-Modifiable Headers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In wireless communication networks with service-based architectures, interposing a service communication proxy (SCP) between consumer and producer network functions complicates integrity and confidentiality protection, as direct TLS-based protection is not feasible for indirect communications.
Innovation Solution
Integrity protection is applied to a portion of the message, such as the body, while allowing the SCP to modify the unprotected header, using a digitally signed assertion with integrity verification information, enabling proxy functions like path modification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a service communication proxy (SCP) is interposed between consumer and producer network functions, then signaling aggregation, routing, load balancing, and message parameter harmonization are improved, but communication integrity and confidentiality protection deteriorate because direct TLS-based protection is no longer feasible
Solution Approach 1:
The message is segmented into two parts: a protected portion (body) and an unprotected portion (headers). The integrity verification information is generated only for the protected portion, allowing the SCP to modify unprotected headers while maintaining integrity protection for the message body.
Solution Approach 2:
Different parts of the message have different integrity protection properties. The message body is integrity-protected while the headers are left unprotected, allowing each part to serve its specific function - the body maintains data integrity and the headers allow SCP modification for routing purposes.
2Reliability
If integrity verification information is generated for the entire message, then communication integrity is improved, but the ability of the SCP to modify message headers for routing purposes deteriorates
Solution Approach 1:
The message is divided into protected and unprotected portions. The integrity verification information is calculated only for the protected portion (message body), which enables the SCP to freely modify unprotected portions (headers) without affecting integrity verification.
Solution Approach 2:
The integrity protection is applied locally only to the message body rather than the entire message. This localized approach preserves the SCP's ability to modify headers while maintaining integrity protection where it is most needed - in the message payload.
Data Source
AI summary
Network equipment implements a network function in a wireless communication network. The network equipment obtains integrity verification information that is a function of only a portion of a message. The message is either a request for a service to be consumed by the network function or a response to a request for a service provided by the network function. The network equipment digitally signs an assertion that includes the integrity verification information, and then sends the message and the digitally signed assertion to a service communication proxy. Other network equipment that receives the message and the digitally signed assertion may check an integrity of the portion of the message, based on integrity verification information that the other network equipment obtains and on the integrity verification information included in the digitally signed assertion.