Method and system for designing security protocol for 6G network architecture
The present disclosure relates to a 5G communication system or a 6G communication system for supporting higher data rates beyond a 4G communication system such as long term evolution (LTE). The present disclosure provides a system and method for security protocol implemented in a communication network. The method performed by a first network entity includes determining based on a HUB being in a trusted area or in a non-trusted area, whether one or more network functions (NFs) are configured to perform security operations based on a generation of a message by a corresponding one or more NFs. Determining, based on a result of the determination that one or more NFs are not configured to perform the security operation, one or more network entities that are configured to perform the security operation, wherein the one or more network entities comprises at least one of the HUB, a Central Unit User Plane (CU-UP), and a Distributed Unit (DU), wherein a plurality of security keys are generated by the determined one or more network entities, and wherein the generated plurality of security keys is shared with a user equipment (UE).
1 . A method performed by a first network entity in a 6G communication network, the method comprising:
determining whether a HUB is in a trusted area or a non-trusted area of the 6G communication network;
determining, when the HUB is in the trusted area, the HUB and a Central Unit User Plane (CU-UP) as network entities to perform a security operation, and one or more network functions (NFs) generating a control plane signaling message as network entities that do not perform the security operation for the control plane signaling message; and
determining, when the HUB is in the non-trusted area, the one or more NFs and the HUB as network entities to perform a control plane security operation, and the CU-UP as a network entity to perform a user plane security operation,
wherein a plurality of security keys are generated by the determined one or more network entities, wherein the plurality of security keys generated change depending upon whether the HUB is the trusted area or non-trusted area, and wherein the generated plurality of security keys are shared with a user equipment (UE) for secure communication between the UE and the first network entity.
2 . The method as claimed in claim 1 ,
wherein the determined one or more network entities includes the HUB and the CU-UP, the method further comprising:
deriving a first security key (KHUB) and a second security key (KCUUP) from an anchor key (KSEAF), based on a plurality of parameters;
generating a first integrity key (KHUBint) and a first ciphering key (KHUBenc) based on the derived first security key (KHUB); and
generating a second integrity key (KUPint) and a second ciphering key (KUPenc) based on the derived second security key (KCUUP).
3 . The method as claimed in claim 2 , further comprising:
transmitting the first security key (KHUB) and the second security key (KCUUP) to the UE via a signaling message,
wherein the signaling message includes information related to security configuration.
4 . The method as claimed in claim 2 , wherein the plurality of parameters includes at least one of a physical cell id (PCI), a length of the PCI, a length of an Absolute Radio Frequency Channel Number downlink (ARFCN-DL), a length of a next hop (NH), a HUB identification (ID), or a transmit receive point (TRP) ID.
5 . The method as claimed in claim 2 , wherein the first security key (KHUB) is a security key generated for the HUB in a serving network,
wherein the second security key (KCUUP) is a security key generated for the CU-UP in the serving network, and
wherein the generated first integrity key (KHUBint) and the generated second integrity key (KUPint) are the integrity keys generated for the control plane and user plane.
6 . The method as claimed in claim 1 , wherein the trusted area is an area with no security threats for the HUB.
7 . A first network entity in a 6G communication network, the first network entity comprising:
a communication unit comprising communication circuitry; and
a processor, comprising processing circuitry, operably coupled with the communication unit and configured, individually and/or collectively, to:
determine whether a HUB is in a trusted area or a non-trusted area of the 6G communication network;
determine, when the HUB is in the trusted area, the HUB and a Central Unit User Plane (CU-UP) as network entities to perform a security operation, and one or more network functions (NFs) generating a control plane signaling message as network entities that do not perform the security operation for the control plane signaling message; and
determine, when the HUB is in the non-trusted area, the one or more NFs and the HUB as network entities to perform a control plane security operation, and the CU-UP as a network entity to perform a user plane security operation,
wherein a plurality of security keys are generated by the determined one or more network entities, wherein the plurality of security keys generated change depending upon whether the HUB is the trusted area or non-trusted area, and wherein the generated plurality of security keys are shared with a user equipment (UE) for secure communication between the UE and the first network entity.
8 . The first network entity as claimed in claim 7 ,
wherein the determined one or more network entities includes the HUB and the CU-UP, and
wherein the at least one processor is further configured, individually and/or collectively, to:
derive a first security key (KHUB) and a second security key (KCUUP) from an anchor key (KSEAF), based on a plurality of parameters,
generate a first integrity key (KHUBint) and a first ciphering key (KHUBenc) based on the derived first security key (KHUB), and
generate a second integrity key (KUPint) and a second ciphering key (KUPenc) based on the derived second security key (KCUUP).
9 . The first network entity as claimed in claim 8 ,
wherein the at least one processor is further configured, individually and/or collectively, to:
control the communication unit to transmit the first security key (KHUB) and the second security key (KCUUP) to the UE via a signaling message,
wherein the signaling message includes information related to security configuration.
10 . The first network entity as claimed in claim 8 , wherein the plurality of parameters includes at least one of a physical cell id (PCI), a length of the PCI, a length of an Absolute Radio Frequency Channel Number downlink (ARFCN-DL), a length of a next hop (NH), a HUB identification (ID), or a transmit receive point (TRP) ID.
11 . The first network entity as claimed in claim 8 , wherein the first security key (KHUB) is a security key generated for the HUB in a serving network,
wherein the second security key (KCUUP) is a security key generated for the CU-UP in the serving network, and
wherein the generated first integrity key (KHUBint) and the generated second integrity key (KUPint) are the integrity keys generated for the control plane and the user plane.
12 . The first network entity as claimed in claim 7 , wherein the trusted area is an area with no security threats for the HUB.