Method and device for protecting sensitive user plane traffic
Disclosed herein are a communication technique for merging, with an IoT technology, a 5G communication system for supporting a data transmission rate higher than that of a 4G system; and a system therefor. Embodiments herein disclose a method of protecting sensitive user plane traffic in an User Equipment (UE) ( 100 ), the method comprising: transmitting, to a network ( 200 ), by the UE ( 100 ) a first NAS message comprising an indicator indicating that the UE ( 200 ) supports of a secure channel for domain name system (DNS); receiving, from the network ( 200 ), by the UE ( 100 ) a second NAS message including DNS server security information in response to transmitting the first NAS message; and transmitting, to the network ( 200 ), by the UE ( 100 ) the DNS over the secure channel based on the DNS server security information.
1. A method of a user equipment (UE), the method comprising:
transmitting, to a network, a first non-access stratum (NAS) message including an indicator indicating that the UE supports of domain name system (DNS) over transport layer security (TLS) or DNS over datagram TLS (DTLS);
receiving, from the network, a second NAS message including DNS server security information in response to transmitting the first NAS message; and
transmitting, to the network, a message based on the DNS server security information,
wherein the DNS server security information comprises information on a security mechanism, information on a service port, and information on an authentication domain name.
2. The method of claim 1 , wherein the first NAS message comprises one of a protocol data unit (PDU) session establishment request message, a registration request message, or a service request message.
3. The method of claim 2 , wherein the indicator is included in protocol configuration options in the first NAS message.
4. The method of claim 1 , wherein the second NAS message comprises one of a PDU session establishment accept message, a registration accept message, or a service accept message.
5. The method of claim 4 , wherein the DNS server security information is included in protocol configuration options in the second NAS message.
6. The method of claim 1 , wherein the DNS server security information comprises at least one of information on subject public key (SPKI), information on root certificate, and information on a raw public key.
7. A method of a network, the method comprising:
receiving, from a user equipment (UE), a first non-access stratum (NAS) message including an indicator indicating that the UE supports of domain name system (DNS) over transport layer security (TLS) or DNS over datagram TLS (DTLS);
transmitting, to the UE, a second NAS message including DNS server security information in response to transmitting the first NAS message; and
receiving, from the UE, a message based on the DNS server security information,
wherein the DNS server security information comprises information on a security mechanism, information on a service port, and information on an authentication domain name.
8. The method of claim 7 ,
wherein the first NAS message comprises one of a protocol data unit (PDU) session establishment request message, a registration request message, or a service request message, and
wherein the second NAS message comprises one of a PDU session establishment accept message, a registration accept message, or a service accept message.
9. The method of claim 8 , wherein the indicator is included in protocol configuration options in the first NAS message.
10. The method of claim 8 , wherein the DNS server security information is included in protocol configuration options in the second NAS message.
11. The method of claim 7 , wherein the DNS server security information comprises at least one of information on subject public key (SPKI), information on root certificate, information on a raw public key.