Application of integrity protection in a wireless communication network
A method in a first node of a wireless communications network comprises: inspecting a data packet or message to determine a characteristic of the data packet or message; and selectively activating integrity protection for onward transmission of the data packet or message to a second node of the wireless communications network based on the determined characteristic.
1. A method in a first node of a wireless communications network, the method comprising:
inspecting a data packet or message to determine a characteristic of the data packet or message, the characteristic of the data packet or message comprising the following associated with the data packet or message: a destination address, a source address, and a size; and
selectively activating integrity protection for onward transmission of the data packet or message to a second node of the wireless communications network based on the determined characteristic, selectively activating integrity protection for onward transmission of the data packet or message comprising:
activating integrity protection for onward transmission of the data packet or message responsive to a determination of the following:
the destination is associated with one or more first services,
the source address is associated with the one or more first services, and
the size is less than one or more thresholds; and
refraining from activating integrity protection for onward transmission of the data packet or message responsive to a determination of the following:
the destination address is associated with one or more second services;
the source address is associated with the one or more second services; and
the size is greater than the one or more thresholds.
2. The method according to claim 1 , wherein:
a plurality of data radio bearers are established for transmissions to the second node, the plurality of data radio bearers comprising a first data radio bearer configured for the transmission of data with integrity protection, and a second data radio bearer configured for the transmission of data without integrity protection; and
selectively activating integrity protection for onward transmission of the data packet or message to the second node comprises steering the data packet or message to one of the plurality of data radio bearers based on the determined characteristic.
3. The method according to claim 1 , wherein:
selectively activating integrity protection for onward transmission of the data packet or message to the second node comprises applying a flow indicator value to the data packet or message; and
the flow indicator value has one of a plurality of values including a first value associated with the application of integrity protection to the data packet or message and a second value associated with no application of integrity protection to the data packet or message.
4. The method according to claim 3 , wherein the flow indicator comprises a quality-of-service indicator.
5. The method according to claim 1 , wherein:
the first node comprises a core network node of the wireless communications network; and
selectively activating integrity protection for onward transmission of the data packet or message to the second node comprises forwarding the data packet or message to a third node for onward wireless transmission to the second node.
6. The method according to claim 1 , wherein:
the first node comprises a radio access network node of the wireless communications network; and
the second node comprises a user equipment (UE).
7. The method according to claim 1 , wherein:
the first node comprises a user equipment (UE); and
the second node comprises a radio access network node of the wireless communications network.
8. The method according to claim 1 , wherein selectively activating integrity protection for onward transmission of the data packet or message comprises:
activating integrity protection for onward transmission of the data packet or message by default; and
refraining from activating integrity protection for onward transmission of the data packet or message responsive to a determination that the characteristic meets one or more exception criteria.
9. The method according to claim 1 , wherein selectively activating integrity protection for onward transmission of the data packet or message comprises:
refraining from activating integrity protection for onward transmission of the data packet or message by default; and
activating integrity protection for onward transmission of the data packet or message responsive to a determination that the characteristic meets one or more exception criteria.
10. The method according to claim 1 , wherein:
the characteristic of the data packet or message comprises the presence or absence of a cryptographic security protocol applied to the data packet or message; and
selectively activating integrity protection for onward transmission of the data packet or message comprises:
activating integrity protection for onward transmission of the data packet or message responsive to a determination that a cryptographic security protocol has not been applied to the data packet or message; and
refraining from activating integrity protection for onward transmission of the data packet or message responsive to a determination that a cryptographic security protocol has been applied to the data packet or message.
11. The method according to claim 1 , wherein:
selectively activating integrity protection for onward transmission of the data packet or message to the second node comprises applying one or more functions to the determined characteristic to selectively activate integrity protection for onward transmission of the data packet or message; and
the method further comprises receiving at least one of the one or more functions from a fourth node of the wireless communications network.
12. A node in a wireless communication network, the node comprising:
power supply circuitry configured to supply power to the node; and
processing circuitry configured to:
inspect a data packet or message to determine a characteristic of the data packet or message, the characteristic of the data packet or message comprising the following associated with the data packet or message: a destination address, a source address, and a size; and
selectively activate integrity protection for onward transmission of the data packet or message to a second node of the wireless communications network based on the determined characteristic, selectively activating integrity protection for onward transmission of the data packet or message based on:
activating integrity protection for onward transmission of the data packet or message responsive to a determination of the following:
the destination is associated with one or more first services, the source address is associated with the one or more first services, and
the size is less than one or more thresholds; and
refraining from activating integrity protection for onward transmission of the data packet or message responsive to a determination of the following:
the destination address is associated with one or more second services;
the source address is associated with the one or more second services; and
the size is greater than the one or more thresholds.
13. The node according to claim 12 , wherein:
a plurality of data radio bearers is established for transmissions to the second node, the plurality of data radio bearers comprising a first data radio bearer being configured for the transmission of data with integrity protection, and a second data radio bearer being configured for the transmission of data without integrity protection; and
the processing circuitry is configured to selectively activate integrity protection for onward transmission of the data packet or message to the second node by steering the data packet or message to one of the plurality of data radio bearers based on the determined characteristic.
14. The node according to claim 12 , wherein:
the processing circuitry is configured to selectively activate integrity protection for onward transmission of the data packet or message to the second node by applying a flow indicator value to the data packet or message; and
the flow indicator value has one of a plurality of values including a first value associated with the application of integrity protection to the data packet or message and a second value associated with no application of integrity protection to the data packet or message.
15. The node according to claim 14 , wherein the flow indicator comprises a quality-of-service indicator.
16. The node according to claim 12 , wherein:
the node is a core network node of the wireless communications network; and
the processing circuitry is configured to selectively activate integrity protection for onward transmission of the data packet or message to the second node by forwarding the data packet or message to a third node for onward wireless transmission to the second node.
17. The node according to claim 12 , wherein:
the node is a radio access network node of the wireless communications network; and
the second node comprises a user equipment (UE).
18. The node according to claim 12 , wherein:
the node is a user equipment (UE); and
the second node comprises a radio access network node of the wireless communications network.
19. The node according to claim 12 , wherein the processing circuitry is configured to selectively activate integrity protection for onward transmission of the data packet or message based on:
activating integrity protection for onward transmission of the data packet or message by default; and
refraining from activating integrity protection for onward transmission of the data packet or message responsive to a determination that the characteristic meets one or more exception criteria.
20. The node according to claim 12 , wherein the processing circuitry is configured to selectively activate integrity protection for onward transmission of the data packet or message based on:
refraining from activating integrity protection for onward transmission of the data packet or message by default; and
activating integrity protection for onward transmission of the data packet or message responsive to a determination that the characteristic meets one or more exception criteria.
21. The node according to claim 12 , wherein:
the characteristic of the data packet or message comprises the presence or absence of a cryptographic security protocol applied to the data packet or message; and
the processing circuitry is configured to selectively activate integrity protection for onward transmission of the data packet or message based on:
activating integrity protection for onward transmission of the data packet or message responsive to a determination that a cryptographic security protocol has not been applied to the data packet or message, and
refraining from activating integrity protection for onward transmission of the data packet or message responsive to a determination that a cryptographic security protocol has been applied to the data packet or message.
22. The node according to claim 12 , wherein the processing circuitry is configured to:
selectively activate integrity protection for onward transmission of the data packet or message to the second node by applying one or more functions to the determined characteristic to selectively activate integrity protection for onward transmission of the data packet or message; and
receive at least one of the one or more functions from a fourth node of the wireless communications network.