Method and apparatus for using NAS message for data protection
A method, performed by a user equipment (UE), for protecting data includes: transmitting an attach request message including at least one security protection parameter regarding a UE capability to support a security protection for a user plane, to a mobility management entity (MME) via a base station; and in case that a security policy is determined at a policy charging function (PCF) based on the attach request message and information of the security policy is received at the MME, receiving an attach accept message including at least one security protection parameter regarding a network capability for the security policy related with an evolved packet system (EPS) bearer, from the MME via the base station.
1. A method of a user equipment (UE) for protecting data, the method comprising:
transmitting, to a mobility management entity (MME) via a base station, an attach request message including at least one security protection parameter associated with a UE capability to support a security protection for a user plane; and
when a first security policy is determined at a policy control entity based on the attach request message and information of the first security policy is received at the MME, receiving, from the MME via the base station, an attach accept message including at least one security protection parameter associated with a network capability for the first security policy related with an evolved packet system (EPS) bearer.
2. The method of claim 1 , wherein:
the attach request message further includes maximum data rate information related with the security protection; and
the maximum data rate information includes at least one of information for a maximum data rate corresponding to each UE used for a user plane integrity protection or information for the maximum data rate corresponding to each UE used for the security protection.
3. The method of claim 2 , wherein:
the attach request message piggybacks a packet data network (PDN) connectivity request message; and
the information for the maximum data rate related with the security protection is piggybacked in the PDN connectivity request message.
4. The method of claim 1 , further comprising:
when a second security policy is determined at the policy control entity and information for the second security policy is received at the MME, receiving an activate dedicated EPS bearer context request message including the at least one security protection parameter associated with a network capability for the second security policy related with another EPS bearer.
5. A method of a mobility management entity (MME) for protecting data, the method comprising:
receiving, from a user equipment (UE) via a base station, an attach request message including at least one security protection parameter associated with a UE capability to support a security protection for a user plane; and
when a first security policy is determined at a policy control entity based on the attach request message and information of the first security policy is received at the MME, transmitting, to the UE via the base station, an attach accept message including at least one security protection parameter associated with a network capability for the first security policy related with an evolved packet system (EPS) bearer.
6. The method of claim 5 , wherein:
the attach request message further includes maximum data rate information related with the security protection; and
the maximum data rate information includes at least one of information for a maximum data rate corresponding to each UE used for a user plane integrity protection or information for the maximum data rate corresponding to each UE used for the security protection.
7. The method of claim 6 , wherein:
the attach request message piggybacks a packet data network (PDN) connectivity request message; and
the information for the maximum data rate related with the security protection is piggybacked in the PDN connectivity request message.
8. The method of claim 5 , further comprising:
when a second security policy is determined at the policy control entity and information for the second security policy is received at the MME, transmitting an activate dedicated EPS bearer context request message including the at least one security protection parameter associated with a network capability for the second security policy related with another EPS bearer.
9. A user equipment (UE) for protecting data, the UE comprising:
a transceiver; and
at least one processor coupled with the transceiver and configured to:
transmit, to a mobility management entity (MME) via a base station, an attach request message including at least one security protection parameter associated with a UE capability to support a security protection for a user plane, and
when a first security policy is determined at a policy control entity based on the attach request message and information of the first security policy is received at the MME, receive, from the MME via the base station, an attach accept message including at least one security protection parameter associated with a network capability for the first security policy related with an evolved packet system (EPS) bearer.
10. The UE of claim 9 , wherein:
the attach request message further includes maximum data rate information related with the security protection; and
the maximum data rate information includes at least one of information for a maximum data rate corresponding to each UE used for a user plane integrity protection or information for the maximum data rate corresponding to each UE used for the security protection.
11. The UE of claim 10 , wherein:
the attach request message piggybacks a packet data network (PDN) connectivity request message; and
the information for the maximum data rate related with the security protection is piggybacked in the PDN connectivity request message.
12. The UE of claim 9 , wherein the at least one processor is further configured to
when a second security policy is determined at the policy control entity and information for the second security policy is received at the MME, receive an activate dedicated EPS bearer context request message including the at least one security protection parameter associated with a network capability for the second security policy related with another EPS bearer.
13. A mobility management entity (MME) for protecting data, the MME comprising:
a transceiver; and
at least one processor coupled with the transceiver and configured to:
receive, from a user equipment (UE) via a base station, an attach request message including at least one security protection parameter associated with a UE capability to support a security protection for a user plane, and
when a first security policy is determined at a policy control entity based on the attach request message and information of the first security policy is received at the MME, transmit, to the UE via the base station, an attach accept message including at least one security protection parameter associated with a network capability for the first security policy related with an evolved packet system (EPS) bearer.
14. The MME of claim 13 , wherein:
the attach request message further includes maximum data rate information related with the security protection; and
the maximum data rate information includes at least one of information for a maximum data rate corresponding to each UE used for a user plane integrity protection or information for the maximum data rate corresponding to each UE used for the security protection.
15. The MME of claim 14 , wherein:
the attach request message piggybacks a packet data network (PDN) connectivity request message; and
the information for the maximum data rate related with the security protection is piggybacked in the PDN connectivity request message.
16. The MME of claim 13 , wherein the at least one processor is further configured to:
when a second security policy is determined at the policy control entity and information for the second security policy is received at the MME, transmit an activate dedicated EPS bearer context request message including the at least one security protection parameter associated with a network capability for the second security policy related with another EPS bearer.