Method and apparatus for selecting selective security mode and flow management in a wireless communication system
The disclosure relates to a fifth generation (5G) communication system or a sixth generation (6G) communication system for supporting higher data rates beyond a fourth generation (4G) communication system such as long term evolution (LTE). A method performed by a core network entity 107 for selecting a selective security mode for applying selective security is provided. The method receives first information block from RAN 106 . The first information block includes UE capability to support selective security and preferred selective security mode. Further, core network entity may determine if RAN and core network entity are capable of supporting the preferred selective security mode. Finally, the core network entity applies the preferred selective security on the one or more incoming data packets based on the encryption status of the incoming data packets, when at least one of RAN and core network entity supports the preferred selective security mode.
1 . A method performed by a core network entity, the method comprising:
receiving, from a radio access network (RAN), a first information block comprising at least one of an indication of capability of a user equipment (UE) to support a selective security, and a preferred selective security mode from one or more selective security modes;
determining whether at least one of the core network entity or the RAN is capable of supporting the preferred selective security mode indicated by the UE;
determining whether each of one or more incoming data packets are encrypted or unencrypted based on header information of the each of the one or more incoming data packets and a length of un-ciphered headers in the each of the one or more incoming data packets, in case that the at least one of the core network entity or the RAN are determined to be capable of supporting the preferred selective security mode; and
transmitting, to the RAN, ciphering information including information indicating whether the each of the one or more incoming data packets are encrypted or unencrypted and information indicating the length of the un-ciphered headers,
wherein the selective security through the preferred selective security mode is applied to the each of the one or more incoming data packets based on the ciphering information.
2 . The method of claim 1 , wherein the core network entity comprises a user plane function (UPF) entity.
3 . The method of claim 1 , wherein the receiving the first information block comprises receiving the first information block during a protocol data unit (PDU) session establishment between the UE and the core network entity.
4 . The method of claim 1 , wherein the first information block further comprises an indication of presence of hardware accelerator (HWA) for the selective security.
5 . The method of claim 1 , further comprising:
receiving, from the RAN, a second information block during a PDU session establishment between the UE and the core network entity, wherein the second information block comprises an indication of capability of the RAN to support the one or more selective security modes.
6 . A method performed by a radio access network (RAN), the method comprising:
transmitting, to a core network entity associated with the RAN, a first information block comprising at least one of an indication of capability of a user equipment (UE) to support a selective security, and a preferred selective security mode from one or more selective security modes;
receiving, from the core network entity, information indicating whether at least one of the core network entity or the RAN is capable of supporting the preferred selective security mode indicated by the UE;
receiving, from the core network entity, ciphering information including information indicating whether each of one or more incoming data packets are encrypted or unencrypted and information indicating a length of un-ciphered headers; and
applying the selective security to the each of the one or more incoming data packets through the preferred selective security mode based on the ciphering information,
wherein whether the each of the one or more incoming data packets are encrypted or unencrypted is determined based on header information of the each of the one or more incoming data packets.
7 . The method of claim 6 , wherein the core network entity comprises a user plane function (UPF) entity.
8 . The method of claim 6 , wherein the transmitting the first information block comprises transmitting the first information block during a protocol data unit (PDU) session establishment between the UE and the core network entity.
9 . The method of claim 6 , wherein the first information block further comprises an indication of presence of hardware accelerator (HWA) for the selective security.
10 . The method of claim 6 , further comprising:
transmitting, to the core network entity, a second information block during a PDU session establishment between the UE and the core network entity, wherein the second information block comprises an indication of capability of the RAN to support the one or more selective security modes.
11 . A core network entity comprising:
at least one processor; and
at least one memory, communicatively coupled to the at least one processor, storing instructions executable by the at least one processor individually or in any combination to cause the core network entity to:
receive, from a radio access network (RAN), a first information block comprising at least one of an indication of capability of a user equipment (UE) to support a selective security, and a preferred selective security mode from one or more selective security modes,
determine whether at least one of the core network entity or the RAN is capable of supporting the preferred selective security mode indicated by the UE,
determine whether each of one or more incoming data packets are encrypted or unencrypted based on header information of the each of the one or more incoming data packets and a length of un-ciphered headers in the each of the one or more incoming data packets in case that the at least one of the core network entity or the RAN are determined to be capable of supporting the preferred selective security mode; and
transmit, to the RAN, ciphering information including information indicating whether the each of the one or more incoming data packets are encrypted or unencrypted and information indicating the length of the un-ciphered headers,
wherein the selective security through the preferred selective security mode is applied to the each of the one or more incoming data packets based on the ciphering information.
12 . The core network entity of claim 11 , wherein the core network entity comprises a user plane function (UPF) entity.
13 . The core network entity of claim 11 , wherein the instructions further cause the core network entity to:
receive the first information block during a protocol data unit (PDU) session establishment between the UE and the core network entity.
14 . The core network entity of claim 11 , wherein the first information block further comprises an indication of presence of hardware accelerator (HWA) for the selective security.
15 . The core network entity of claim 11 , wherein the instructions further cause the core network entity to:
receive, from the RAN, a second information block during a PDU session establishment between the UE and the core network entity, wherein the second information block comprises an indication of capability of the RAN to support the one or more selective security modes.
16 . A Radio Access Network (RAN) comprising:
at least one transceiver; and
at least one processor communicatively coupled to the at least one transceiver; and
at least one memory, communicatively coupled to the at least one processor, storing instructions executable by the at least one processor individually or in any combination to cause the RAN to:
transmit, to a core network entity associated with the RAN, a first information block comprising at least one of an indication of capability of a user equipment (UE) to support a selective security, and a preferred selective security mode from one or more selective security modes,
receive, from the core network entity, information indicating whether at least one of the core network entity or the RAN to is capable of supporting the preferred selective security mode indicated by the UE,
receive, from the core network entity, ciphering information including information indicating whether each of one or more incoming data packets are encrypted or unencrypted and information indicating a length of un-ciphered headers, and
apply the selective security to the each of the one or more incoming data packets based on the ciphering information,
wherein whether the each of the one or more incoming data packets are encrypted or unencrypted is determined based on header information of the each of the one or more incoming data packets.
17 . The RAN of claim 16 , wherein the core network entity comprises a user plane function (UPF) entity.
18 . The RAN of claim 16 , wherein the instructions further cause the RAN to:
transmit the first information block during a protocol data unit (PDU) session establishment between the UE and the core network entity.
19 . The RAN of claim 16 , wherein the first information block further comprises an indication of presence of hardware accelerator (HWA) for the selective security.
20 . The RAN of claim 16 , wherein the instructions further cause the RAN to:
transmit, to the core network entity, a second information block during a PDU session establishment between the UE and the core network entity, wherein the second information block comprises an indication of capability of the RAN to support the one or more selective security modes.