Network security architecture

A client device, comprising:

• a communication circuit configured to communicate with one or more network entities;
• and
• a processing circuit coupled to the communication circuit, the processing circuit configured to
• register to the network;
• obtain at least a user plane key shared with a user plane network function implemented at a first network node or a control plane key shared with a control plane network function implemented at a second network node;
• and
• protect a data packet with the user plane key or a control packet with the control plane key, wherein the data packet includes first destination information indicating that the data packet is to be processed at the first network node, the first destination information enabling a network access node to forward the data packet to the first network node, and wherein the control packet includes second destination information indicating that the control packet is to be processed at the second network node, the second destination information enabling the network access node to forward the control packet to the second network node;
• and
• transmit the data packet or the control packet.

A method for a network access node, comprising:

• receiving a first packet from a client device;
• determining a next hop network node based on a network attach mode of the client device;
• and
• forwarding the first packet to the next hop network node without verifying the first packet received from the client device when the network attach mode is a reduced data transfer mode.

A network access node, comprising:

• a communication circuit configured to communicate with one or more network entities;
• and
• a processing circuit coupled to the communication circuit, the processing circuit configured to:
• receive a first packet from a client device;
• determine a next hop network node based on a network attach mode of the client device;
• and
• forward the first packet to the next hop network node without verifying the first packet received from the client device when the network attach mode is a reduced data transfer mode.

A method for a first network node, comprising:

• establishing, at a control plane network function implemented at the first network node, a security context for a client device;
• obtaining, at the control plane network function implemented at the first network node, a user plane key for a user plane network function implemented at a second network node;
• and
• transferring, from the control plane network function implemented at the first network node, the user plane key to the user plane network function implemented at the second network node.

A first network node, comprising:

• a communication circuit configured to communicate with one or more network entities;
• and
• a processing circuit coupled to the communication circuit, the processing circuit configured to:
• establish, at a control plane network function implemented at the first network node, a security context for a client device;
• obtain, at the control plane network function implemented at the first network node, a user plane key for a user plane network function implemented at a second network node;
• and
• transfer, from the control plane network function implemented at the first network node, the user plane key to the user plane network function implemented at the second network node.

A method for a network node, comprising:

• obtaining, at a user plane network function implemented at the network node, a security context for a client device;
• determining, at the user plane network function implemented at the network node, a key to be used at least for decryption or verification of a data packet from the client device;
• receiving, at the user plane network function implemented at the network node, the data packet from the client device;
• and
• decrypting and verifying, at the user plane network function implemented at the network node, the data packet from the client device based on the key.

A network node, comprising:

• a communication circuit configured to communicate with one or more network entities;
• and
• a processing circuit coupled to the communication circuit, the processing circuit configured to:
• obtain, at a user plane network function implemented at the network node, a security context for a client device;
• determine, at the user plane network function implemented at the network node, a key to be used at least for decryption or verification of a data packet from the client device;
• receive, at the user plane network function implemented at the network node, the data packet from the client device;
• and
• decrypt and verify, at the user plane network function of the network node, the data packet from the client device based on the key.