Method and device for protecting sensitive user plane traffic
Disclosed herein are a communication technique for merging, with an IoT technology, a 5G communication system for supporting a data transmission rate higher than that of a 4G system; and a system therefor. Embodiments herein disclose a method of protecting sensitive user plane traffic in an User Equipment (UE) ( 100 ), the method comprising: transmitting, to a network ( 200 ), by the UE ( 100 ) a first NAS message comprising an indicator indicating that the UE ( 200 ) supports of a secure channel for domain name system (DNS); receiving, from the network ( 200 ), by the UE ( 100 ) a second NAS message including DNS server security information in response to transmitting the first NAS message; and transmitting, to the network ( 200 ), by the UE ( 100 ) the DNS over the secure channel based on the DNS server security information.
1. A method of a user equipment (UE), the method comprising:
transmitting, to a network entity, a protocol data unit (PDU) session establishment request message including an indicator indicating that the UE supports of domain name system (DNS) over transport layer security (TLS) or DNS over datagram TLS (DTLS); and
receiving, from the network entity, a PDU session establishment accept message including DNS server security information in response to transmitting the PDU session establishment request message,
wherein the DNS server security information comprises information on a security mechanism.
2. The method of claim 1 , wherein the indicator is included in protocol configuration options in the PDU session establishment request message.
3. The method of claim 1 , wherein the DNS server security information is included in protocol configuration options in the PDU session establishment accept message.
4. The method of claim 1 , wherein the DNS server security information comprises at least one of information on a service port, information on an authentication domain name, information on subject public key (SPKI), information on root certificate, and information on a raw public key.
5. A method of a network entity, the method comprising:
receiving, from a user equipment (UE), a protocol data unit (PDU) session establishment request message including an indicator indicating that the UE supports of domain name system (DNS) over transport layer security (TLS) or DNS over datagram TLS (DTLS); and
transmitting, to the UE, a PDU session establishment accept message including DNS server security information in response to receiving the PDU session establishment request message,
wherein the DNS server security information comprises information on a security mechanism.
6. The method of claim 5 , wherein the indicator is included in protocol configuration options in the PDU session establishment request message.
7. The method of claim 5 , wherein the DNS server security information is included in protocol configuration options in the PDU session establishment accept message.
8. The method of claim 5 , wherein the DNS server security information comprises at least one of information on a service port, information on an authentication domain name, information on subject public key (SPKI), information on root certificate, and information on a raw public key.
9. A user equipment (UE), the UE comprising:
a transceiver; and
a controller coupled with the transceiver and configured to control to:
transmit, to a network entity, a protocol data unit (PDU) session establishment request message including an indicator indicating that the UE supports of domain name system (DNS) over transport layer security (TLS) or DNS over datagram TLS (DTLS), and
receive, from the network entity, a PDU session establishment accept message including DNS server security information in response to transmitting the PDU session establishment request message,
wherein the DNS server security information comprises information on a security mechanism.
10. The UE of claim 9 , wherein the indicator is included in protocol configuration options in the PDU session establishment request message.
11. The UE of claim 9 , wherein the DNS server security information is included in protocol configuration options in the PDU session establishment accept message.
12. The UE of claim 9 , wherein the DNS server security information comprises at least one of information on a service port, information on an authentication domain name, information on subject public key (SPKI), information on root certificate, and information on a raw public key.
13. A network entity, the network entity comprising:
a transceiver; and
a controller coupled with the transceiver and configured to control to:
receive, from a user equipment (UE), a protocol data unit (PDU) session establishment request message including an indicator indicating that the UE supports of domain name system (DNS) over transport layer security (TLS) or DNS over datagram TLS (DTLS), and
transmit, to the UE, a PDU session establishment accept message including DNS server security information in response to receiving the PDU session establishment request message,
wherein the DNS server security information comprises information on a security mechanism.
14. The network entity of claim 13 , wherein the indicator is included in protocol configuration options in the PDU session establishment request message.
15. The network entity of claim 13 , wherein the DNS server security information is included in protocol configuration options in the PDU session establishment accept message.
16. The network entity of claim 13 , wherein the DNS server security information comprises at least one of information on a service port, information on an authentication domain name, information on subject public key (SPKI), information on root certificate, and information on a raw public key.