KR20230032337A - Apparatus and method for MAC secure communication in mobile communication system - Google Patents

Abstract

An apparatus and method for providing Media Access Control (MAC) secure communication in a mobile communication system supporting Ethernet-type data such as a 5G mobile communication system are disclosed. According to one aspect, a control plane function device supporting MAC secure communication in a mobile communication system supporting Ethernet type data comprises: a communication interface connected with the subscriber management device and a user plane function device and connected with a user device via an access network; a memory to store instructions; and at least one processor connected to the memory and the communication interface. The at least one processor executes the instructions so that upon receiving a session establishment request from the user device, authentication for the user device is performed, a master key obtained as a result of authentication is transmitted to the user device and shared, and the session key generated by performing session key agreement with the user device is transmitted and shared to the user plane function device that supports MAC secure communication.

Description

Apparatus and method for MAC secure communication in mobile communication system

The present invention relates to an apparatus and method for secure communication in a mobile communication system, and more particularly to an apparatus and method for MAC (Media Access Control) secure communication in a 5G mobile communication system.

Since existing mobile communication standards supported only IP-type PDU (Protocal Data Unit), it was difficult to apply mobile communication technology to industrial networks where fieldbus protocols or industrial Ethernet are mainly used. In 5G mobile communication technology, various types of data such as Ethernet type and unstructured type are supported as well as the existing IP (Internet Protocol) type in order to satisfy various requirements of the industry such as smart factory.

As such, the newly supported Ethernet type in the 5G mobile communication standard made it possible to distribute L2 Ethernet traffic to the 5G communication channel area and data network area, which served as an opportunity for 5G mobile communication technology to enter the industrial communication field. . Security is one of the biggest requirements in an industrial network environment. This is because the data of facilities in industrial facilities are directly related to the confidentiality and stability of the company. To satisfy these security requirements, Media Access Control (MAC) security communication technology defined in the IEEE 802.1AE standard, that is, MACsec, may be considered. However, since MACsec is not designed in consideration of the mobile communication environment, it is difficult to apply it directly to the 5G mobile communication system.

The present invention is limited to solve the above problems, and the purpose of the present invention is to provide an apparatus and method for providing MAC (Media Access Control) secure communication in a mobile communication system supporting Ethernet type data such as a 5G mobile communication system. there is

According to one aspect, a control plane function device supporting MAC (Media Access Control) secure communication in a mobile communication system supporting Ethernet type data is connected to a subscriber management device and a user plane function device, and also provides an access network. a communication interface connected to a user device through; memory to store instructions; and at least one processor connected to the memory and the communication interface, wherein the at least one processor executes the commands to perform authentication of the user device upon receiving a session establishment request from the user device. and transmits and shares the master key obtained as a result of authentication to the user device, and transmits and shares the session key generated by performing a session key agreement with the user device to a user plane function device supporting secure MAC communication.

Upon reception of the session establishment request, the at least one processor may select a user plane function device supporting the secure MAC communication and perform authentication of the user device.

Upon reception of the session establishment request, the at least one processor selects a user plane function device that does not support MAC secure communication, performs authentication on the user device, and after authentication is completed, the user supporting the MAC secure communication. Select flat function devices can share the session key.

The at least one processor may share the session key by transmitting a session modification message including the session key to a user plane function device supporting the MAC secure communication.

The at least one processor may receive the master key from an authentication, authorization and accounting (AAA) that has performed an authentication procedure with the user device.

The at least one processor may receive subscription information for the MAC secure communication of the user device from the subscriber management device to determine whether the user device subscribes to and supports the MAC secure communication.

According to another aspect, a method for supporting Media Access Control (MAC) secure communication in a control plane functional device of a mobile communication system supporting Ethernet type data includes performing authentication on the user device; transmitting and sharing the master key obtained as a result of authentication to the user device; and transmitting and sharing the session key generated by performing session key agreement with the user device to a user plane functional device supporting MAC secure communication.

In the performing of the authentication, authentication of the user device may be performed by selecting a user plane function device supporting the MAC security communication.

In the performing of the authentication, authentication of the user device is performed by selecting a user plane function device that does not support MAC secure communication, and the method transmits the session key to a user plane function device that supports MAC secure communication. Prior to the transmitting and sharing, a step of establishing a session by selecting a user plane functional device supporting the secure MAC communication may be further included.

The step of transmitting and sharing the session key to a user plane function device supporting MAC security communication may include transmitting a session modification message including the session key to the user plane function device supporting MAC security communication, thereby transmitting the session key to the user plane function device supporting MAC security communication. can share.

The master key may be received from an authentication, authorization and accounting (AAA) that has performed an authentication procedure with the user device.

The performing of the authentication may include receiving subscription information for MAC secure communication of the user device from the subscriber management device and checking whether the user device subscribes to and supports MAC secure communication.

According to the present invention, it is possible to provide encryption for the L2 Ethernet PDU session of a mobile communication system that supports Ethernet type data such as a 5G mobile communication system, thereby enabling Ethernet such as 5G in the industrial network market such as various smart factories sensitive to security. Mobile communication technology that supports this type of data can be applied.

1 is a block diagram showing the architecture of a 5G mobile communication system according to an embodiment of the present invention.
2 is a flowchart illustrating a method for secure MAC communication in a mobile communication system according to an embodiment of the present invention.
3 is a flowchart illustrating a method for secure MAC communication in a mobile communication system according to another embodiment of the present invention.
4 is a hardware configuration diagram of a network node of a mobile communication system according to an embodiment of the present invention.

Hereinafter, the embodiments disclosed in this specification will be described in detail with reference to the accompanying drawings, but the same or similar components are given the same reference numerals regardless of reference numerals, and redundant description thereof will be omitted. In describing the embodiments disclosed in this specification, if it is determined that a detailed description of a related known technology may obscure the gist of the embodiment disclosed in this specification, the detailed description thereof will be omitted. In addition, the accompanying drawings are only for easy understanding of the embodiments disclosed in this specification, the technical idea disclosed in this specification is not limited by the accompanying drawings, and all changes included in the spirit and technical scope of the present invention , it should be understood to include equivalents or substitutes.

Singular expressions include plural expressions unless the context clearly dictates otherwise. In this application, terms such as "comprise" or "have" are intended to designate that there is a feature, number, step, operation, component, part, or combination thereof described in the specification, but one or more other features It should be understood that the presence or addition of numbers, steps, operations, components, parts, or combinations thereof is not precluded.

In implementing the present invention, components may be subdivided for convenience of description, but these components may be implemented in one device or module, or one component may be divided into multiple devices or modules may be implemented in

1 is a block diagram showing the architecture of a 5G mobile communication system according to an embodiment of the present invention. Referring to FIG. 1, the architecture of the 5G mobile communication system according to this embodiment may include various components (ie, Network Functions (NFs)), but FIG. 1 shows Media Access (MAC) among them. Control) shows only components for providing secure communication, that is, MACsec.

Referring to FIG. 1, a 5G mobile communication system for providing MACsec includes a user equipment (UE) 110, a radio access network (RAN) 120, a session management function (SMF: Session Management Function (130), Unified Data Management (UDM) (140), User Plane Function (UPF) (150), and Authentication Server (AAA: authentication, authorization and accounting) (160). include

The UE 110 may be fixed or mobile, and may include a terminal, a mobile station (MS), a user terminal (UT), a mobile subscriber station (MSS), a subscriber station (SS), and an advanced mobile station (AMS). , wireless terminal (WT), machine-type communication (MTC) device, machine-to-machine (M2M) device, device-to-device (D2D) device, and the like.

The UE 110 is a user device that supports MACsec, has an Access Point Name (APN) of an SMF that supports MACsec set, and sends an Ethernet-type PDU session establishment request (Session Establishment Request) using the APN of the corresponding SMF. send. The PDU session establishment request is transmitted through a NAS (Non Access Stratum) message, and the DN-Specific ID (NAI (Network Access Identity) format EAP (Extensible Authentication Protocol) credential, which is identification information for secondary authentication described below ).

The RAN 120, as a radio access network, may provide a radio channel for accessing the 5G core network. The RAN 120 may provide radio access to the UE 110 through the same base station (eg, gNodeB). A base station is a network infrastructure that provides wireless access to UEs 110 . A base station has coverage defined as a certain geographical area based on a distance over which a signal can be transmitted.

The UDM 140, as a subscriber information management device, stores and manages subscriber information of the UE 110, performs location registration of the UE 110, subscriber authentication, and the like. In this embodiment, the UDM 140 stores subscription information of subscribers using MACsec, and returns MACsec subscription information of subscribers to the SMF 130 upon request from the SMF 130 . Here, the MACsec subscription information includes MACsec subscription and support information of the UE 110 .

In this embodiment, the control plane and data plane functions of the authenticator defined in the IEEE 802.1AE standard are separated, and the SMF 130 is in charge of the control plane function. And the function of the data plane is in charge of the UFP (150). The 5G mobile communication system includes a plurality of SMFs and a plurality of UPFs, and some of the SMFs 130 and UPFs 150 are designed to support MACsec. The SMF (130) supporting MACsec performs Master Key Distribution and Session Key Agreement of the Authenticator of the MACsec standard, and the UPF (150) supporting MACsec performs MACsec standard authentication. Based on the session key received from the SMF 130 supporting the UE 110 and MACsec security session is established. It is explained in more detail below.

SMF 130 generally provides session management functions. Specifically, the SMF 130 includes session management, UE IP address allocation and management, selection and control of UPF functions, traffic steering settings for routing traffic to appropriate destinations in UPF, and policy control functions. ), implementation of policy and control part of QoS, and roaming function.

When receiving an Ethernet-type PDU session establishment request from the UE 110, the SMF 130 supporting MACsec requests and receives subscription information of the UE 110 from the UDM 140, and based on the received subscription information Primary authentication is performed whether the UE 110 subscribes to MACsec and supports it. If the SMF 130 needs to provide MACsec to the UE 110, it selects a UPF 150 that supports MACsec, establishes an N4 session with the corresponding UPF 150, and then connects the AAA 160 with the 3GPP standard and the MACsec standard. Perform secondary authentication according to the authentication procedure of

Specifically, the SMF 130 transmits an Authentication/Authorization Request to the AAA 160, and accordingly, the AAA 160 and the UE 110 perform EAP authentication through the SMF 130. do. For example, as EAP authentication, Protected Extensible Authentication Protocol (PEAP), Extensible Authentication Protocol Transport Layer Security (EAP-TLS), and the like may be performed. When the EAP authentication between the AAA 160 and the UE 110 succeeds, the SMF 130 sends an authentication/authorization response including a Connectivity Association Key (CAK), which is a master key, from the AAA 160. Response) is received. In addition, the SMF 130 transmits a PDU Session Establishment Response including the CAK to the UE 110.

After the SMF 130 shares the CK with the UE 110, it performs a Session Key Agreement with the UE 110 to generate a session key, Secure Association Key (SAK), and the UE 110 share with For example, the SAK is generated according to the EAPOL (Encapsulation over LAN)-MKA (MACsec Key Agreement) procedure defined in the IEEE 802.1X standard. In addition, the SMF 130 transmits the generated SAK to the UPF 150 and shares it with the UPF 150 as well. Preferably, the SMF 130 shares the SAK with the UPF 150 by transmitting an N4 Session Modification message including the generated SAK to the UPF 150.

In one embodiment, when the SMF 130 selects a general UPF that does not support MACsec without selecting the UPF 150 supporting MACsec to perform the second authentication, after completing the second authentication, the PDU session anchor As , an N4 session with the corresponding UPF 150 may be newly established by selecting a UPF 150 supporting MACsec.

In one embodiment, the SMF 130 drives a timer after generating the SAK, and when the timer expires, performs session key agreement again with the UE 110 to generate a new SAK and share it with the UE 110. It is also shared with UPF (150). That is, the SMF 130 periodically replaces the SAK to prevent security incidents caused by leakage of the SAK.

The UPF 150, in general, transmits to the UE 110 via a downlink protocol data unit (PDU) received from a data network (DN) such as the Internet, and transmits the UE via the RAN 120. The uplink PDU received from (110) may be delivered to the data network (DN).

The UPF 150 supporting MACsec establishes an N4 session with the corresponding SMF 130 according to the selection of the SMF 130 supporting MACsec, and the session key received from the SMF 130 supporting MACsec, SAK (Secure Association Key) and encrypts and decrypts the UE 110 and Ethernet data with the SAK.

2 is a flowchart illustrating a method for secure MAC communication in a mobile communication system according to an embodiment of the present invention.

Referring to FIG. 2, in step S201, the UE 110 sends an Ethernet-type PDU session establishment request (Session Establishment Request) according to the access point name (APN) of the SMF 130 supporting MACsec configured therein. It is transmitted to the SMF (130). The PDU session establishment request is transmitted through a Non Access Stratum (NAS) message and includes identification information, DN-Specific ID (Network Access Identity (NAI) format Extensible Authentication Protocol (EAP) credential).

In step S202, the SMF 130 requests subscription information of the UE 110 from the UDM 140, and receives subscription information of the UE 110 from the UDM 140 in step S203. In step S204, the SMF 130 first authenticates MACsec subscription and support of the UE 110 based on the received subscription information.

If the UE (110) subscribes to MACsec and can support it, in step S205, the SMF (130) selects the UPF (150) supporting MACsec. In step S206, the SMF 130 establishes an N4 session with the corresponding UPF 150, and starts secondary authentication with the AAA 160 according to the authentication procedures of the 3GPP standard and the MACsec standard.

In step S207, the SMF 130 transmits an Authentication/Authorization Request to the AAA 160. Accordingly, in step S208, the AAA 160 and the UE 110 perform EAP authentication through the SMF 130. For example, as EAP authentication, Protected Extensible Authentication Protocol (PEAP), Extensible Authentication Protocol Transport Layer Security (EAP-TLS), and the like may be performed.

After the EAP authentication succeeds, in step S209, the SMF 130 receives an Authentication/Authorization Response including a Connectivity Association Key (CAK) as a master key from the AAA 160. In step S210, the SMF 130 transmits a PDU Session Establishment Response including the CAK to the UE 110 to share the CAK with the UE 110.

In step S211, the SMF 130 performs a Session Key Agreement with the UE 110 to generate a session key, Secure Association Key (SAK), and share it with the UE 110. For example, the SAK is generated according to the EAPOL (Encapsulation over LAN)-MKA (MACsec Key Agreement) procedure defined in the IEEE 802.1X standard.

In step S212, the SMF 130 transmits an N4 Session Modification message including the generated SAK to the UPF 150 to share with the UPF 150. Therefore, the UE 110 and the UPF 150 mutually share the SAK, which is a session key. Accordingly, in step S213, the UPF 150 encrypts/decrypts Ethernet data with the UE 110 using the SAK, and transmits/receives the data. .

In one embodiment, the SMF 130 drives a timer after generating the SAK, and when the timer expires, performs session key agreement again with the UE 110 to generate a new SAK and share it with the UE 110. It is also shared with UPF (150). That is, the SMF 130 repeatedly performs from step S211 and periodically replaces the SAK to prevent a security accident due to leakage of the SAK.

3 is a flowchart illustrating a method for secure MAC communication in a mobile communication system according to another embodiment of the present invention.

Referring to FIG. 3, in step S301, the UE 110 sends an Ethernet-type PDU session establishment request (Session Establishment Request) according to the Access Point Name (APN) of the SMF 130 supporting MACsec configured therein. It is transmitted to the SMF (130). The PDU session establishment request is transmitted through a Non Access Stratum (NAS) message and includes identification information, DN-Specific ID (Network Access Identity (NAI) format Extensible Authentication Protocol (EAP) credential).

In step S302, the SMF 130 requests subscription information of the UE 110 from the UDM 140, and receives subscription information of the UE 110 from the UDM 140 in step S303. In step S304, the SMF 130 first authenticates MACsec subscription and support of the UE 110 based on the received subscription information.

If the UE 110 subscribes to MACsec and can support it, in step S305, the SMF 130 selects a general UPF 320 that does not support MACsec for secondary authentication. In step S306, the SMF 130 establishes an N4 session with the corresponding UPF 320, and starts secondary authentication with the AAA 160 according to the authentication procedures of the 3GPP standard and the MACsec standard.

In step S307, the SMF 130 transmits an Authentication/Authorization Request to the AAA 160. Accordingly, in step S308, the AAA 160 and the UE 110 perform EAP authentication through the SMF 130. For example, as EAP authentication, Protected Extensible Authentication Protocol (PEAP), Extensible Authentication Protocol Transport Layer Security (EAP-TLS), and the like may be performed.

After the EAP authentication succeeds, in step S309, the SMF 130 receives an Authentication/Authorization Response including a Connectivity Association Key (CAK) as a master key from the AAA 160.

In step S310, the SMF 130 selects the UPF 150 supporting MACsec. Then, in step S311, the SMF 130 establishes an N4 session with the UPF 150. In step S312, the SMF 130 transmits a PDU Session Establishment Response including the CAK to the UE 110 to share the CAK with the UE 110.

In step S313, the SMF 130 performs a Session Key Agreement with the UE 110 to generate a session key, Secure Association Key (SAK), and shares it with the UE 110. For example, the SAK is generated according to the EAPOL (Encapsulation over LAN)-MKA (MACsec Key Agreement) procedure defined in the IEEE 802.1X standard.

In step S314, the SMF 130 transmits an N4 session modification message including the generated SAK to the UPF 150 to share with the UPF 150. Therefore, the UE 110 and the UPF 150 mutually share the SAK, which is a session key. Accordingly, in step S315, the UPF 150 supporting MACsec encrypts/encrypts Ethernet data with the UE 110 using the SAK. Decrypt and send/receive.

In one embodiment, the SMF 130 drives a timer after generating the SAK, and when the timer expires, performs session key agreement again with the UE 110 to generate a new SAK and share it with the UE 110. It is also shared with UPF (150). That is, the SMF 130 repeatedly performs from step S313 and periodically replaces the SAK to prevent a security accident due to leakage of the SAK.

4 is a hardware configuration diagram of a network node of a mobile communication system according to an embodiment of the present invention. The network node shown in FIG. 4 may be the SMF 130, UDM 140, UPF 150, or AAA 160 described with reference to FIG. Referring to FIG. 4 , the hardware of the network node may include at least one processor 410, memory 420, and communication interface 430, which may be connected through a bus 440. In addition, hardware such as an input device and an output device may be included.

The processor 410 is a device for controlling the operation of a network node, and may be various types of processors that process commands included in a program loaded into the memory 420, for example, a Central Processing Unit (CPU) or MPU. (Micro Processor Unit), MCU (Micro Controller Unit), GPU (Graphic Processing Unit), and the like.

The memory 420 may store an operating system capable of driving programs and various data, programs, and the like required to execute operations described with reference to FIGS. 1 to 3 . The memory 420 may load a corresponding program to be processed by the processor 410 . The memory 420 may be, for example, read only memory (ROM) or random access memory (RAM). The processor 410 may execute a program, which is loaded into the memory 420 and includes instructions described for executing the operation described with reference to FIGS. 1 to 3 .

The communication interface 440 may be a wired/wireless communication module, and is connected to and communicates with other network nodes of the mobile communication system. For example, when the network node of FIG. 4 is the SMF 130, the communication interface 440 includes a subscriber management device (UDM) 140 and a UPF 150 performing the function of a data plane for secure MAC communication. Connected to, and also connected to the user equipment (UE) 110 through the access network 120.

According to the above embodiment, it is possible to provide encryption for the L2 Ethernet PDU session of the 5G mobile communication system, so that 5G mobile communication technology can be applied to industrial network markets such as various smart factories that are sensitive to security. In addition, it enables the development and distribution of the function as quickly as the modification of the principles and procedures of the existing 5G standard and MACsec standard is minimized.

While this specification contains many features, such features should not be construed as limiting the scope of the invention or the claims. Also, features described in separate embodiments in this specification may be implemented in combination in a single embodiment. Conversely, various features that are described in this specification in a single embodiment may be implemented in various embodiments individually or in combination as appropriate.

Although actions are described in a particular order in the drawings, it should not be understood that such actions are performed in the specific order as shown, or that the actions are performed in a series of sequential order, or that all described actions are performed to achieve a desired result. . Multitasking and parallel processing can be advantageous in certain circumstances. In addition, it should be understood that the division of various system components in the above-described embodiments does not require such division in all embodiments. The program components and systems described above may generally be implemented as a package in a single software product or multiple software products.

The method of the present invention as described above may be implemented as a program and stored in a recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.) in a computer-readable form. Since this process can be easily performed by a person skilled in the art to which the present invention belongs, it will not be described in detail.

The present invention described above is capable of various substitutions, modifications, and changes without departing from the technical spirit of the present invention to those skilled in the art to which the present invention belongs, and thus the above-described embodiments and It is not limited by drawings.

110: UE
120: RAN
130: SMF
140: UDM
150 : UPF
160: AAA
410: processor
420: memory
430: Storage
440: communication interface
450: bus

Claims (12)

In a control plane function device supporting MAC (Media Access Control) secure communication in a mobile communication system supporting Ethernet type data,
a communication interface connected to the subscriber management device and the user plane function device, and also to the user device through an access network;
memory to store instructions; and
and at least one processor connected to the memory and the communication interface, wherein the at least one processor executes the instructions,
Upon receiving a session establishment request from the user device, authentication of the user device is performed, and a master key obtained as a result of the authentication is transmitted to and shared with the user device;
The control plane function device characterized in that the session key generated by performing the session key agreement with the user device is transmitted to and shared with a user plane functional device supporting MAC secure communication. According to claim 1,
The at least one processor,
and upon receiving the session establishment request, selecting a user plane functional device supporting the MAC secure communication and performing authentication of the user device. According to claim 1,
The at least one processor,
Upon reception of the session establishment request, selecting a user plane function device that does not support MAC security communication and performing authentication of the user device;
After completion of the authentication, the control plane function device, characterized in that for sharing the session key by selecting a user plane function device supporting the secure MAC communication. According to claim 2 or 3,
The at least one processor,
and sharing the session key by transmitting a session modification message including the session key to the user plane function device supporting the MAC secure communication. According to claim 1,
The at least one processor,
Control plane function device, characterized in that for receiving the master key from AAA (authentication, authorization and accounting) that performed an authentication procedure with the user device. According to claim 1,
The at least one processor,
The control plane functional device, characterized in that, by receiving subscription information for the MAC security communication of the user device from the subscriber management device, confirming whether the user device subscribes to and supports the MAC security communication. As a method of supporting MAC (Media Access Control) secure communication in a control plane functional device of a mobile communication system supporting Ethernet type data,
Receiving a session establishment request from a user device;
performing authentication on the user device;
transmitting and sharing the master key obtained as a result of authentication to the user device; and
and transmitting and sharing a session key generated by performing a session key agreement with the user device to a user plane function device supporting secure MAC communication. According to claim 7,
The step of performing the authentication is,
and performing authentication of the user device by selecting a user plane functional device supporting the MAC secure communication. According to claim 7,
The step of performing the authentication is,
Selecting a user plane function device that does not support MAC secure communication and performing authentication on the user device;
Prior to the step of transmitting and sharing the session key to a user plane functional device supporting MAC secure communication,
and establishing a session by selecting a user plane functional device supporting the MAC secure communication. The method of claim 8 or 9,
The step of transmitting and sharing the session key to a user plane functional device supporting MAC secure communication,
and sharing the session key by transmitting a session modification message including the session key to the user plane function device supporting the MAC secure communication. According to claim 7,
The master key is
Characterized in that it is received from AAA (authentication, authorization and accounting) that performed an authentication procedure with the user device. According to claim 7,
The step of performing the authentication is,
and receiving subscription information for the MAC security communication of the user device from the subscriber management device and confirming whether the user device subscribes to and supports the MAC security communication.

Images