# US 12,114,159 B2 · Security settings for user plane data sent over different accesses of a network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,114,159 B2 - Document ID: US12114159B2 - Status: Granted - Kind: B2 - Application number: 17/765,889 - Filed: 2020-09-30 - Published: 2022-10-27 - Granted: 2024-10-08 - Earliest claimed: 2019-10-03 - Assignees: Telefonaktiebolaget LM Ericsson (publ) - Applicants: Telefonaktiebolaget LM Ericsson (publ) - Inventors: Monica Wifvesson - Web page: https://patentgrep.com/patent/US12114159B2 ## CPC - H04W 12/08: Access security - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04W 12/37: Managing security policies for mobile devices or for controlling mobile applications - H04W 76/12: Setup of transport tunnels - H04W 76/16: Involving different core network technologies, e.g. a packet-switched [PS] bearer in combination with a circuit-switched [CS] bearer - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method of operating a network node of a communication network includes establishing a PDU session with a UE, configuring a first UP security policy for the PDU session that applies to radio bearers set up between the UE and a first RAN, and configuring a second UP security policy for the PDU session that applies to radio bearers set up between the UE and a second RAN. A method of operating a UE includes establishing a PDU session with a UPF in a core network, via a first RAN, configuring a first UP security policy for the PDU session that applies to radio bearers set up between the UE and the first RAN, and configuring a second UP security policy for the PDU session that applies to radio bearers set up between the UE and a second RAN. Related network nodes and UEs are disclosed. ## Claims ### Claim 1 A method of operating a core network node in a core network, comprising: establishing a protocol data unit, PDU, session with a user equipment, UE, over a first radio access network, RAN, wherein the PDU session is associated with a first user plane, UP, security policy; providing the first UP security policy used by a first radio bearer in the PDU session between the UE and a base station in the first RAN, wherein the first radio bearer is subject to the first UP security policy; and providing a second UP security policy, that is different from the first UP security policy, used by a second radio bearer in the PDU session between the UE and an interworking function that provides access to the core network through a second RAN, wherein the second radio bearer is subject to the second UP security policy. ### Claim 2 (depends on 1) The method of claim 1, further comprising activating and/or deactivating the second UP security policy independently from the first UP security policy. ### Claim 3 (depends on 1) The method of claim 1, wherein the first UP security policy includes a first code point defining whether integrity protection is required, preferred or not needed for the first radio bearer and/or a second code point defining whether confidentiality protection is required, preferred or not needed for the first radio bearer. ### Claim 4 (depends on 1) The method of claim 1, wherein the second UP security policy includes a third code point defining whether integrity protection is required, preferred or not needed for the second radio bearer and/or a fourth code point defining whether confidentiality protection is required, preferred or not needed for the second radio bearer. ### Claim 5 (depends on 1) The method of claim 1, wherein the first RAN comprises a third-generation partnership project, 3GPP, RAN and the second RAN comprises a non-3GPP RAN. ### Claim 6 (depends on 1) The method of claim 1, further comprising: providing a third UP security policy, that is different from the first UP security policy and the second UP security policy, used by a third radio bearer in the PDU session between the UE and an interworking function that provides access to the core network through a third RAN, wherein the third radio bearer is subject to the third UP security policy. ### Claim 7 A method of operating a core network node, comprising: establishing a protocol data unit, PDU, session with a user equipment, UE; configuring a first user plane, UP, security policy used in the PDU session that applies to radio bearers set up between the UE and a first radio access network; and configuring a second UP security policy, that is different from the first UP security policy, used in the PDU session that applies to radio bearers set up between the UE and a second radio access network. ### Claim 8 (depends on 7) The method of claim 7, further comprising activating and/or deactivating the second UP security policy independently from the first UP security policy. ### Claim 9 (depends on 7) The method of claim 7, wherein the first UP security policy includes a first code point defining whether integrity protection is required, preferred or not needed for a first radio bearer between the UE and the first radio access network and/or a second code point defining whether confidentiality protection is required, preferred or not needed for the first radio bearer. ### Claim 10 (depends on 7) The method of claim 7, wherein the second UP security policy includes a third code point defining whether integrity protection is required, preferred or not needed for a second radio bearer between the UE and the second radio access network and/or a fourth code point defining whether confidentiality protection is required, preferred or not needed for the second radio bearer. ### Claim 11 (depends on 7) A network node, comprising: a processing circuit; a transceiver coupled to the processing circuit; and a memory coupled to the processing circuit, wherein the memory comprises computer readable program instructions that, when executed by the processing circuit, cause the network node to perform operations according to claim 7. ### Claim 12 A method of operating a user equipment, UE, in a core network, comprising: establishing a protocol data unit, PDU, session with a first radio access network, RAN, wherein the PDU session is associated with a first user plane, UP, security policy; configuring the first UP security policy used by a first radio bearer in the PDU session between the UE and a base station in the first RAN, wherein the first radio bearer is subject to the first UP security policy; and configuring a second UP security policy, that is different from the first UP security policy, used by a second radio bearer in the PDU session between the UE and an interworking function that provides access to the core network through a second RAN, wherein the second radio bearer is subject to the second UP security policy. ### Claim 13 (depends on 12) The method of claim 12, wherein the first UP security policy includes a first code point defining whether integrity protection is required, preferred or not needed for the first radio bearer and/or a second code point defining whether confidentiality protection is required, preferred or not needed for the first radio bearer. ### Claim 14 (depends on 12) The method of claim 12, wherein the second UP security policy includes a third code point defining whether integrity protection is required, preferred or not needed for the second radio bearer and/or a fourth code point defining whether confidentiality protection is required, preferred or not needed for the second radio bearer. ### Claim 15 A method of operating a user equipment, comprising: establishing a protocol data unit, PDU, session with a user plane function, UPF, in a core network, via a first radio access network; configuring a first user plane, UP, security policy used in the PDU session that applies to radio bearers set up between the UE and the first radio access network; and configuring a second UP security policy, that is different from the first UP security policy, used in the PDU session that applies to radio bearers set up between the UE and a second radio access network. ### Claim 16 (depends on 15) The method of claim 15, wherein the first UP security policy includes a first code point defining whether integrity protection is required, preferred or not needed for a first radio bearer between the UE and the first radio access network and/or a second code point defining whether confidentiality protection is required, preferred or not needed for the first radio bearer. ### Claim 17 (depends on 15) The method of claim 15, wherein the second UP security policy includes a third code point defining whether integrity protection is required, preferred or not needed for a second radio bearer between the UE and the second radio access network and/or a fourth code point defining whether confidentiality protection is required, preferred or not needed for the second radio bearer. ### Claim 18 (depends on 15) A user equipment, comprising: a processing circuit; a transceiver coupled to the processing circuit; and a memory coupled to the processing circuit, wherein the memory comprises computer readable program instructions that, when executed by the processing circuit, cause the UE to perform operations according to claim 15. ### Claim 19 (depends on 12) A user equipment, comprising: a processing circuit; a transceiver coupled to the processing circuit; and a memory coupled to the processing circuit, wherein the memory comprises computer readable program instructions that, when executed by the processing circuit, cause the UE to perform operations according to claim 12. ### Claim 20 (depends on 1) A network node, comprising: a processing circuit; a transceiver coupled to the processing circuit; and a memory coupled to the processing circuit, wherein the memory comprises computer readable program instructions that, when executed by the processing circuit, cause the network node to perform operations according to claim 1.