Integrity protection for user plane data in 5g network

Abstract

A method for integrity protection scheme by a mobile communication device or a core network entity according to a first exemplary aspect of the present disclosure includes configuring settings and parameters for integrity protection for user data with another party; receiving user plane data from the other party, calculating Message Authentication Code for Integrity (MAC-I) for a part of the data and checking integrity of the part of the data.

1 . A method of a User Equipment (UE), the method comprising:
 sending, to a Radio Access Node (RAN) node, first integrity algorithm information in UE security capability information for User Plane (UP) integrity protection;   receiving, from the RAN node, second integrity algorithm information for the UP integrity protection based on a decision of the RAN node;   calculating a Message Authentication Code for Integrity (MAC-I) based on the second integrity algorithm information; and   sending, to the RAN node, UP integrity protected data including the MAC-I.   
     
     
         2 . The method according to  claim 1 , wherein the RAN node decides whether or not to send the second integrity algorithm information to the UE. 
     
     
         3 . The method according to  claim 1 , wherein the RAN node is a New Generation (NG)-RAN or a gNodeB (gNB). 
     
     
         4 . A method of a Radio Access Node (RAN) node, the method comprising:
 receiving, from a User Equipment (UE), first integrity algorithm information in UE security capability information for User Plane (UP) integrity protection;   sending, to the UE, second integrity algorithm information for the UP integrity protection based on a decision of the RAN node; and   receiving, from the UE, UP integrity protected data including a Message Authentication Code for Integrity (MAC-I), wherein the MAC-I is calculated by the UE based on the second integrity algorithm information.   
     
     
         5 . The method according to  claim 4 , further comprising: deciding whether or not to send the second integrity algorithm information to the UE. 
     
     
         6 . The method according to  claim 4 , wherein the RAN node is a New Generation (NG)-RAN or a gNodeB (gNB). 
     
     
         7 . A User Equipment (UE), comprising:
 a memory configured to store instructions; and   a processor configured to execute the instructions to:   send, to a Radio Access Node (RAN) node, first integrity algorithm information in UE security capability information for User Plane (UP) integrity protection,   receive, from the RAN node, second integrity algorithm information for the UP integrity protection based on a decision of the RAN node,   calculate a Message Authentication Code for Integrity (MAC-I) based on the second integrity algorithm information, and   send, to the RAN node, UP integrity protected data including the MAC-I.   
     
     
         8 . The UE according to  claim 7 , wherein the RAN node decides whether or not to send the second integrity algorithm information to the UE. 
     
     
         9 . The UE according to  claim 7 , wherein the RAN node is a New Generation (NG)-RAN or a gNodeB (gNB). 
     
     
         10 . A Radio Access Node (RAN) node, comprising:
 a memory configured to store instructions; and   a processor configured to execute the instructions to:   receive, from a User Equipment (UE), first integrity algorithm information in UE security capability information for User Plane (UP) integrity protection,   send, to the UE, second integrity algorithm information for the UP integrity protection based on a decision of the RAN node, and   receive, from the UE, UP integrity protected data including a Message Authentication Code for Integrity (MAC-I), wherein the MAC-I is calculated by the UE based on the second integrity algorithm information.   
     
     
         11 . The RAN node according to  claim 10 , wherein the processor is further configured to execute the instructions to decide whether or not to send the second integrity algorithm information to the UE. 
     
     
         12 . The RAN node according to  claim 10 , wherein the RAN node is a New Generation (NG)-RAN or a gNodeB (gNB).