WO2023125675A1

WO2023125675A1 - User plane data integrity protection method and system for network slice

Info

Publication number: WO2023125675A1
Application number: PCT/CN2022/142873
Authority: WO
Inventors: 常洁; 林黛娣; 严黎明; 毕家瑜; 黄海昆; 项春林; 陈正文; 曾祥宇
Original assignee: 天翼物联科技有限公司
Priority date: 2021-12-30
Filing date: 2022-12-28
Publication date: 2023-07-06
Also published as: CN114339761A

Abstract

A user plane data integrity protection method and system for a network slice. The method comprises: once access authentication of a user UE succeeds, an AUSF generates a network slice anchoring key K1 for the user UE to form a mapping relationship <S-NSSAI, K1>, wherein S-NSSAI is a network slice identifier; the AUSF sends the mapping relationship <S-NSSAI, K1> to an AMF, and the AMF saves the mapping relationship <S-NSSAI, K1>; the AUSF returns a network slice identifier S-NSSAI requiring user plane data encryption and an indication of data transmission security protection to the user UE; and the user UE generates a network slice anchoring key K1 for the network slice identifier S-NSSAI according to the indication of data transmission security protection. By means of adding service information to a mapping relationship, self-adaptive integrity protection of data transmitted by a network slice user plane in different service environments is achieved.

Description

A user plane data integrity protection method and system for network slicing

technical field

The present invention relates to the technical field of 5G network slicing data security, in particular to a user plane data integrity protection method and system for network slicing.

Background technique

As the application of network technology becomes more and more extensive, the scenarios of network application are different. The deployment methods and locations of network functional units (control plane and service plane) required by different application scenarios will also be different.

Network slicing is a collection of network functions, resources for running network functions, and network function-specific configurations. Network functions and their corresponding configurations form a complete logical network, including network features required by specific services.

Since network slicing involves end-to-end network elements, service capacity involves the number and configuration of network elements, and connection and delay involve network topology and interface configuration and deployment. In the future, network slicing will carry a lot of high-value application data and sensitive information such as privacy, which will greatly increase the security requirements of 5G networks. Therefore, network slicing user plane security mechanisms are essential, but only user plane data integrity protection based on network slicing However, in different business scenarios, it cannot meet the requirements of 5G high traffic, low latency, and large connections.

Contents of the invention

The purpose of the present invention is to provide a user plane data integrity protection method and system for network slicing, aiming to solve the problem that the prior art cannot meet the requirements of 5G high traffic, low delay and large connection in different business scenarios The problem.

In a first aspect, an embodiment of the present invention provides a user plane data integrity protection method for network slicing, including:

After the user UE access authentication is successful, the AUSF generates a network slice anchor key K1 for the user UE to form a mapping relationship <S-NSSAI, K1>, where S-NSSAI is the network slice identifier;

The AUSF sends the mapping relationship <S-NSSAI, Ki> to the AMF, and the AMF saves the mapping relationship <S-NSSAI, Ki>;

The AUSF returns the network slice identifier S-NSSAI that needs to be encrypted for user plane data and an indication of data transmission security protection to the user UE;

The user UE generates a network slice anchor key K1 for the network slice identifier S-NSSAI according to the instruction of data transmission security protection, and the user UE generates the network slice identifier S-NSSAI and the network slice anchor key K1 The corresponding service information is introduced into the mapping relationship, and the mapping relationship among the network slice identifier S-NSSAI, service information and network slice anchor key K1 is saved.

In a second aspect, an embodiment of the present invention provides a user plane data integrity protection system for network slicing, which operates through the user plane data integrity protection method for network slicing, including:

The user UE is configured to generate a network slice anchor key K1 for the network slice identifier S-NSSAI according to the instruction of data transmission security protection; and a mapping relationship between the network slice identifier S-NSSAI and the network slice anchor key K1 Introducing corresponding service information, and saving the mapping relationship between the network slice identifier S-NSSAI, service information and network slice anchor key K1;

The AUSF is used to generate a network slice anchor key K1 for the user UE after successful user access authentication to form a mapping relationship <S-NSSAI, K1>, where S-NSSAI is a network slice identifier; and send the AUSF the The above mapping relationship <S-NSSAI, K1>; return to the user UE the network slice identifier S-NSSAI that needs to be encrypted for user plane data, and an indication of data transmission security protection;

AMF, configured to store the mapping relationship <S-NSSAI, K1>.

In the embodiment of the present invention, by adding service information into the mapping relationship, the data transmitted by the user plane of the network slice is adaptively protected in different service environments, which can reduce the previous configuration and realize the purpose of data integrity protection of the user plane of the network slice, and It can reduce the calculation load and greatly improve the delay of user plane data transmission, which has a certain degree of practicability.

Description of drawings

In order to illustrate the technical solutions of the embodiments of the present invention more clearly, the drawings that need to be used in the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are some embodiments of the present invention. Ordinary technicians can also obtain other drawings based on these drawings on the premise of not paying creative work.

FIG. 1 is a schematic flowchart of a user plane data integrity protection method for network slicing provided by an embodiment of the present invention;

Fig. 2 is a block diagram of a user plane data integrity protection system for network slicing provided by an embodiment of the present invention.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are some of the embodiments of the present invention, but not all of them. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

It should be understood that when used in this specification and the appended claims, the terms "comprising" and "comprises" indicate the presence of described features, integers, steps, operations, elements and/or components, but do not exclude one or Presence or addition of multiple other features, integers, steps, operations, elements, components and/or collections thereof.

It should also be understood that the terminology used in the description of the present invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the present invention. As used in this specification and the appended claims, the singular forms "a", "an" and "the" are intended to include plural referents unless the context clearly dictates otherwise.

It should also be further understood that the term "and/or" used in the description of the present invention and the appended claims refers to any combination and all possible combinations of one or more of the associated listed items, and includes these combinations .

SUCI (Subscription Concealed Identifier, user concealed identifier);

S-NSSAI (Single Network Slice Selection Assistance Information, single network slice selection assistance information);

AMF (Access and Mobility Management Function, access and mobility management function); AUSF (Authentication Server Function, authentication server function);

UDM (Unified Data Management, unified data management);

SUPI (Subscription Permanent Identifier, user permanent identifier);

SMF (Session Management Function, session management function);

UPF (UserPlane Function user plane function);

gNB is a 5G base station;

NSSF (The Network Slice Selection Function, network slice selection function);

The authentication phase before the user UE access authentication succeeds is:

1. The user UE accesses the 5G network, initiates an initial registration request, and the request carries information such as the user identifier SUCI, the network slice identifier S-NSSAI supported by the user UE;

2. After the AMF accepts the UE registration request, it sends an authentication request to the AUSF;

3. After the AUSF receives the authentication request, if there is no user subscription information (user ID), it requests the user subscription information from UDM. The request message contains the user ID SUCI. By matching the user subscription information corresponding to the user ID SUCI in the UDM information;

4. UDM executes the conversion from SUCI to SUPI, and returns the corresponding user subscription information to AUSF;

The user subscription information includes an indication of the network slices (S-NSSAI identifiers) that the user is allowed to access and which network slice identifiers corresponding to the S-NSSAI need to perform user plane data security protection;

5. The UDM generates an authentication vector for the user UE's access authentication request and returns it to the AUSF together with the user subscription information;

6. The AUSF receives the user subscription information and the authentication vector, and completes the two-way authentication process for the user UE to access the network with the AMF and the user UE.

Please refer to Figure 1, a user plane data integrity protection method for network slicing, including:

The AUSF sends the mapping relationship <S-NSSAI, K1> to the AMF, and the AMF saves the mapping relationship <S-NSSAI, K1>;

In this embodiment, after the user UE access authentication succeeds, the AUSF generates an anchor key KAUSF for the user UE, and identifies S-NSSAI for the corresponding network slice according to the indication of user plane data security protection returned by the UDM. KAUSF uses the key generation algorithm to generate the network slice anchor key K1 for user plane data security protection;

<S-NSSAI, K1> indicates that user plane data security protection needs to be performed for the network slice corresponding to the user UE access network slice identifier S-NSSAI.

After the AUSF saves the mapping relationship of the user UE accessing the network and completes other registration processes, it returns a response message of successful authentication to the user UE, and the response message includes the corresponding network slice identifier S-NSSAI that needs to establish user plane data security protection Instructions for establishing user plane data security protection.

The user UE receives the authentication success response message returned by the network, generates the anchor key KAUSF, and instructs to use KAUSF and the above-mentioned key generation algorithm to generate a user plane data security protected network for the corresponding network slice identifier S-NSSAI slice anchor key K1;

Due to the same KAUSF and key generation algorithm, it is guaranteed that the network slice anchor key K1 generated by the user UE and AUSF is the same;

By adding business information to the mapping relationship, the adaptive integrity protection of the data transmitted by the user plane of the network slice under different business environments can reduce the previous configuration to achieve the purpose of data integrity protection of the user plane of the network slice, and can reduce the calculation load , which greatly improves the delay of data transmission on the user plane, and has a certain degree of practicability.

In an embodiment, the service information includes data network name DNN information, service quality QoS, service priority, base station side reservation information, bandwidth and delay requirement indicators for 5G service transmission, and the like.

In this embodiment, the service information includes the data network name DNN information, service quality QoS, service priority, base station side reserved information, bandwidth and delay requirement indicators for 5G service transmission, etc., so that the information in the service information can be Merit selection in network slicing.

In an embodiment, the user UE generates a network slice anchor key K1 for the network slice identifier S-NSSAI according to the indication of data transmission security protection, and the user UE is the network slice identifier S-NSSAI and the network slice anchor key K1. Determine the mapping relationship of the key K1 to introduce the corresponding service information, and save the mapping relationship between the network slice identifier S-NSSAI, service information and the network slice anchor key K1, and then include:

According to the information in the mapping relationship <S-NSSAI, service information, K1>, the user UE generates an integrity key k3' using a one-way irreversible function based on a preset method, saves the integrity key k3', and saves the mapping Relationship <S-NSSAI, Service Information, k3'>.

In this embodiment, the preset method can be set according to the actual situation; the one-way irreversible function is an existing function with a one-way irreversible effect, and a function can be selected according to the actual situation; the mapping relationship <S-NSSAI, business information, The information in K1> includes business information, etc.

The user UE initiates a session establishment request in the access network slicing process to the AMF;

The AMF obtains, according to the mapping relationship <S-NSSAI, Ki>, the network slice identifier S-NSSAI that needs to be accessed by the user UE, and performs user plane data security protection;

The SMF selects the AMF, the AMF generates an integrity key k3' for user plane data security protection for the network slice identifier S-NSSAI, and the AMF stores the mapping relationship <S-NSSAI, service information, k3'>.

In this embodiment, the generated integrity key k3' is used to adaptively protect the integrity of the data transmitted in the user plane of the network slice under different service environments.

In an embodiment, the session establishment request includes: the network slice identifier S-NSSAI that the user UE requests to access and corresponding service information.

In this embodiment, the network slice identifier S-NSSAI and the corresponding service information are included in the session request, which is convenient for generating the mapping relationship <S-NSSAI, service information, k3'> at the next level, and also facilitates the service information at the subsequent level Save during transfer.

In an embodiment, the SMF selects the AMF, the AMF generates an integrity key k3' for user plane data security protection for the network slice identifier S-NSSAI, and the AMF stores the mapping relationship <S-NSSAI, service Information, k3'>, after that includes:

The AMF searches for a corresponding SMF according to the network slice identifier S-NSSAI;

A session is established between the AMF and the corresponding SMF, the AMF sends the mapping relationship <S-NSSAI, service information, k3'> to the SMF, and the SMF saves the mapping relationship <S-NSSAI, business information, k3'>;

The SMF searches for a corresponding UPF according to the network slice identifier S-NSSAI;

A session is established between the SMF and the corresponding UPF, the SMF sends the mapping relationship <S-NSSAI, service information, k3'> to the UPF, and the UPF stores the mapping relationship <S-NSSAI, service information, k3 '>.

In this embodiment, UPF saves the mapping relationship and establishes a binding between k3' and the network slice session, that is, when data is transmitted using the network slice session, the integrity key k3' is used for data transmission safety protection.

After the user UE completes the session establishment process for accessing the network slice, it can use the network slice session to carry out application services.

In an embodiment, a session is established between the SMF and the corresponding UPF, the SMF sends the mapping relationship <S-NSSAI, service information, k3'> to the UPF, and the UPF stores the mapping relationship <S- NSSAI, business information, k3′>, after that include:

The SMF communicates the message after the session authentication and authorization with the AMF through the N1N2 interface;

Perform a session establishment request and response between the AMF and the gNB;

The gNB performs radio resource reservation;

Establish other sessions between the user UE and the SMF, and complete the access network slicing session establishment process.

In this embodiment, wireless resource reservation is to classify network slices according to priority according to service information and corresponding network slice identifier S-NSSAI, and reserve a certain resource space for priority transmission with high priority.

In an embodiment, other sessions are established between the user UE and the SMF, and the access network slice session establishment process is completed, and then includes:

When the user UE conducts application services between the UPF and the network slice session, the user UE identifies the user plane data, and according to the service information and the mapping relationship <S-NSSAI, service information, k3'>, for the PDCP SDU Adaptively generate MAC-I based on the mapping relationship <S-NSSAI, service information, k3'>, and add MAC-I to the user plane data.

In this embodiment, the data MAC-I is a delay requirement flag, which is identified by calculating the MAC-I and adding corresponding user plane data when the delay requirement is met, so as to facilitate identification and transmission.

In an embodiment, when the user UE conducts application services between the UPF through the network slice session, the user UE identifies the user plane data, and according to the service information and the mapping relationship <S-NSSAI, service information, k3'>, adaptively generate MAC-I for PDCP SDU based on the mapping relationship <S-NSSAI, service information, k3'>, including:

judging whether the service information corresponding to the user plane data has a high latency requirement;

If so, use the service information in the concatenation information of the user plane data as the MESSAGE of the integrity key k3' based on the adaptive algorithm, and generate a MAC-I through the integrity key k3', and the generated MAC-I added to the end of the user plane data;

If not, integrity protection is performed based on all information in the concatenated information.

In this embodiment, the data MAC-I is a high-latency flag, and is added to the end of the user plane data when the high-latency is high.

Referring to FIG. 2, a user plane data integrity protection system for network slicing operates through the user plane data integrity protection method for network slicing, including:

AMF, configured to store the mapping relationship <S-NSSAI, K1>.

Through the above process, the security of the application service data during transmission in the network slice with the network slice identifier S-NSSAI can be guaranteed. For the S-NSSAI identity that does not require user plane data security protection, the corresponding protection key will not be generated between the user UE and the UPF, and correspondingly, the user plane data transmitted in its network slice will not be protected for transmission security .

The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person familiar with the technical field can easily think of various equivalents within the technical scope disclosed in the present invention. Modifications or replacements shall all fall within the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

A user plane data integrity protection method for network slicing, characterized in that it includes:

After the user UE access authentication is successful, the AUSF generates a network slice anchor key K1 for the user UE to form a mapping relationship <S-NSSAI, K1>, where S-NSSAI is the network slice identifier;

The AUSF sends the mapping relationship <S-NSSAI, K1> to the AMF, and the AMF saves the mapping relationship <S-NSSAI, K1>;

The AUSF returns the network slice identifier S-NSSAI that needs to be encrypted for user plane data and an indication of data transmission security protection to the user UE;

The user UE generates a network slice anchor key K1 for the network slice identifier S-NSSAI according to the instruction of data transmission security protection, and the user UE generates the network slice identifier S-NSSAI and the network slice anchor key K1 The corresponding service information is introduced into the mapping relationship, and the mapping relationship among the network slice identifier S-NSSAI, service information and network slice anchor key K1 is saved.
The user plane data integrity protection method for network slicing according to claim 1, wherein the service information includes data network name DNN information, service quality QoS, service priority, base station side reserved information, 5G Bandwidth and delay requirements for service transmission, etc.
The user plane data integrity protection method for network slicing according to claim 1, wherein the user UE generates a network slice anchor key for the network slice identifier S-NSSAI according to the instruction of data transmission security protection. Key K1, the user UE introduces corresponding service information for the mapping relationship between the network slice identifier S-NSSAI and the network slice anchor key K1, and saves the network slice identifier S-NSSAI, service information and network slice anchor key K1 The mapping relationship between the three, then includes:

According to the information in the mapping relationship <S-NSSAI, service information, K1>, the user UE generates an integrity key k3' using a one-way irreversible function based on a preset method, saves the integrity key k3', and saves the mapping Relationship <S-NSSAI, Service Information, k3'>.
The user plane data integrity protection method for network slicing according to claim 1, wherein the user UE generates a network slice anchor key for the network slice identifier S-NSSAI according to the instruction of data transmission security protection. Key K1, the user UE introduces corresponding service information for the mapping relationship between the network slice identifier S-NSSAI and the network slice anchor key K1, and saves the network slice identifier S-NSSAI, service information and network slice anchor key K1 The mapping relationship between the three, then includes:

The user UE initiates a session establishment request in the access network slicing process to the AMF;

According to the mapping relationship <S-NSSAI, K1>, the AMF acquires the network slice identifier S-NSSAI that needs to be accessed by the user UE and performs user plane data security protection;

The SMF selects the AMF, the AMF generates an integrity key k3' for user plane data security protection for the network slice identifier S-NSSAI, and the AMF stores the mapping relationship <S-NSSAI, service information, k3'>.
The user plane data integrity protection method for network slicing according to claim 4, wherein the session establishment request includes: the network slice identifier S-NSSAI and the corresponding business information.
The user plane data integrity protection method for network slicing according to claim 4, wherein the SMF selects the AMF, and the AMF generates user plane data security protection for the network slice identifier S-NSSAI The integrity key k3' of the AMF saves the mapping relationship <S-NSSAI, business information, k3'>, and then includes:

The AMF searches for a corresponding SMF according to the network slice identifier S-NSSAI;

A session is established between the AMF and the corresponding SMF, and the AMF maps the relationship <S-NSSAI, service information, k3'>

Send to the SMF, and the SMF saves the mapping relationship <S-NSSAI, service information, k3'>;

The SMF searches for a corresponding UPF according to the network slice identifier S-NSSAI;

A session is established between the SMF and the corresponding UPF, the SMF sends the mapping relationship <S-NSSAI, service information, k3'> to the UPF, and the UPF stores the mapping relationship <S-NSSAI, service information, k3 '>.
The user plane data integrity protection method for network slicing according to claim 6, wherein a session is established between the SMF and the corresponding UPF, and the SMF uses the mapping relationship <S-NSSAI, service The information, k3'> is sent to the UPF, and the UPF saves the mapping relationship <S-NSSAI, service information, k3'>, and then includes:

The message conveyed by the SMF after performing session authentication and authorization with the AMF through the N1N2 interface:

The session establishment request and response between the AMF and the gNB:

The gNB performs radio resource reservation;

Establish other sessions between the user UE and the SMF, and complete the access network slicing session establishment process.
The user plane data integrity protection method for network slicing according to claim 7, wherein other sessions are established between the user UE and the SMF, and the access network slicing session establishment process is completed, and then include:

When the user UE conducts application services between the UPF and the network slice session, the user UE identifies the user plane data, and according to the service information and the mapping relationship <S-NSSAI, service information, k3'>, for the PDCP SDU Adaptively generate MAC-I based on the mapping relationship <S-NSSAI, service information, k3'>, and add MAC-I to the user plane data.
The user plane data integrity protection method for network slicing according to claim 8, wherein when the user UE conducts application services with the UPF through the network slicing session, the user UE identifies User plane data, according to the service information and mapping relationship <S-NSSAI, service information, k3'>, adaptively generate MAC-I based on the mapping relationship <S-NSSAI, service information, k3'> for PDCP SDU, including:

judging whether the service information corresponding to the user plane data has a high latency requirement;

If so, use the service information in the concatenation information of the user plane data as the MESSAGE of the integrity key k3' based on the adaptive algorithm, and generate a MAC-I through the integrity key k3', and use the generated MAC-I added to the end of the user plane data;

If not, integrity protection is performed based on all information in the concatenated information.
A user plane data integrity protection system for network slicing, operated by the user plane data integrity protection method for network slicing according to any one of claims 1-9, characterized in that it includes:

The user UE is configured to generate a network slice anchor key K1 for the network slice identifier S-NSSAI according to the instruction of data transmission security protection; and a mapping relationship between the network slice identifier S-NSSAI and the network slice anchor key K1 Introducing corresponding service information, and saving the mapping relationship between the network slice identifier S-NSSAI, service information and network slice anchor key K1;

The AUSF is used to generate a network slice anchor key K1 for the user UE after successful user access authentication to form a mapping relationship <S-NSSAI, K1>, where S-NSSAI is a network slice identifier; and send the AUSF the The above mapping relationship <S-NSSAI, K1>; return to the user UE the network slice identifier S-NSSAI that needs to be encrypted for user plane data, and an indication of data transmission security protection;

AMF, configured to store the mapping relationship <S-NSSAI, K1>.