# US 2023/0053937 A1 · Method and device for applying user plane security policy for pdu session in wireless communication system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2023/0053937 A1 - Document ID: US20230053937A1 - Status: Published application - Kind: A1 - Application number: 17/817,630 - Filed: 2022-08-04 - Published: 2023-02-23 - Earliest claimed: 2021-08-04 - Assignees: Samsung Electronics Co., Ltd. - Applicants: Samsung Electronics Co., Ltd. - Inventors: Hongjin CHOI; Duckey LEE; Jungje SON; Taehyung LIM; Youngkyo BAEK - Web page: https://patentgrep.com/patent/US20230053937A1 ## CPC - H04W 12/086: using security domains - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04M 15/66: {Policy and charging system} - H04W 12/033: of the user plane, e.g. user's traffic - H04W 12/10: Integrity - H04W 12/106: Packet or message integrity - H04W 12/37: Managing security policies for mobile devices or for controlling mobile applications - H04W 12/69: Identity-dependent - H04W 28/0268: {using specific QoS parameters for wireless networks, e.g. QoS class identifier [QCI] or guaranteed bit rate [GBR] (negotiating SLA or negotiating QoS H04W28/24)} - H04L 12/1407: {Policy-and-charging control [PCC] architecture} - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04M: TELEPHONIC COMMUNICATION (circuits for controlling other apparatus via a telephone cable and not involving telephone switching apparatus G08) ## Abstract A method and device for applying a different security policy, per service traffic, to a protocol data unit (PDU) session in a wireless communication system. The method comprises receiving, by a session management function (SMF) managing a session for a user equipment (UE), first configuration information about a first user plane security policy of the UE from a unified data management (UDM) managing subscription information about the UE, receiving, by the SMF, second configuration information about a second user plane security policy to be applied to a specific service data flow from a policy and control function (PCF) managing a policy and charging control (PCC) rule, and determining a user plane security policy to be applied to the UE based on one selected from the first user plane security policy and the second user plane security policy according to priority. ## Claims ### Claim 1 A method for determining a user plane security policy for a protocol data unit (PDU) session in a wireless communication system, the method comprising: receiving, by a session management function (SMF) managing a session for a user equipment (UE), first configuration information about a first user plane security policy of the UE from a unified data management (UDM) managing subscription information about the UE; receiving, by the SMF, second configuration information about a second user plane security policy to be applied to a specific service data flow from a policy and control function (PCF) managing a policy and charging control (PCC) rule; and determining, by the SMF, a user plane security policy to be applied to the UE based on one selected from the first user plane security policy and the second user plane security policy according to priority. ### Claim 2 (depends on 1) The method of claim 1, wherein a different user plane security policy is applied, per UE, to the specific service data flow, and wherein the determining comprises determining the user plane security policy to be applied to the UE based on information about the priority in case that at least one of the first configuration information and the second configuration information includes the information about the priority. ### Claim 3 (depends on 1) The method of claim 1, wherein a different user plane security policy is applied, per UE, to the specific service data flow, and wherein the first configuration information received from the UDM takes priority over the second configuration information received from the PCF in determining the user plane security policy. ### Claim 4 (depends on 1) The method of claim 1, wherein a user plane security policy different from another service data flow is applied to the specific service data flow, and wherein a same user plane security policy is commonly applied between UEs to which the specific service data flow is applied, and wherein the determining comprises determining the user plane security policy to be applied to the UE based on information about the priority in case that at least one of the first configuration information and the second configuration information includes the information about the priority. ### Claim 5 (depends on 1) The method of claim 1, wherein a user plane security policy different from another service data flow is applied to the specific service data flow, and wherein the second configuration information received from the PCF takes priority over the first configuration information received from the UDM in determining the user plane security policy. ### Claim 6 (depends on 1) The method of claim 1, further comprising creating and transmitting to a user plane function (UPF) in charge of transferring data in a user plane, by the SMF, a quality-of-service (QoS) enforcement rule (QER) including a packet detection rule (PDR) to be used upon classifying traffic in the UPF and information related to QoS enforcement of traffic identified by the PDR, based on the determined user plane security policy. ### Claim 7 (depends on 1) The method of claim 1, further comprising transferring, by the SMF, a message including security indication information corresponding to the determined user plane security policy and quality-of-service flow identifier (QFI) to a base station linked to the UE through an access and mobility management function (AMF) managing mobility of the UE, wherein the security indication information includes at least one of ciphering information and integrity protection information. ### Claim 8 (depends on 7) The method of claim 7, wherein the security indication information and the QFI are used for creation of a data radio bearer (DRB) for the specific service data flow. ### Claim 9 A session management function (SMF) configured to manage a protocol data unit (PDU) session for a user equipment (UE) in a wireless communication system, the SMF comprising: a transceiver; and a processor configured to: receive, through the transceiver, first configuration information about a first user plane security policy of the UE from a unified data management (UDM) configured to manage subscription information about the UE, receive, through the transceiver, second configuration information about a second user plane security policy to be applied to a specific service data flow from a policy and control function (PCF) configured to manage a policy and charging control (PCC) rule, and determine a user plane security policy to be applied to the UE based on one selected from the first user plane security policy and the second user plane security policy according to priority. ### Claim 10 (depends on 9) The SMF of claim 9, wherein a different user plane security policy is applied, per UE, to the specific service data flow, and wherein the processor is configured to determine the user plane security policy to be applied to the UE based on information about the priority in case that at least one of the first configuration information and the second configuration information includes the information about the priority. ### Claim 11 (depends on 9) The SMF of claim 9, wherein a different user plane security policy is applied, per UE, to the specific service data flow, and wherein the first configuration information received from the UDM takes priority over the second configuration information received from the PCF in determining the user plane security policy. ### Claim 12 (depends on 9) The SMF of claim 9, wherein a user plane security policy different from another service data flow is applied to the specific service data flow, and wherein a same user plane security policy is commonly applied between UEs to which the specific service data flow is applied, and wherein the processor is configured to determine the user plane security policy to be applied to the UE based on information about the priority in case that at least one of the first configuration information and the second configuration information includes the information about the priority. ### Claim 13 (depends on 9) The SMF of claim 9, wherein a user plane security policy different from another service data flow is applied to the specific service data flow, and wherein the second configuration information received from the PCF takes priority over the first configuration information received from the UDM in determining the user plane security policy. ### Claim 14 (depends on 9) The SMF of claim 9, wherein the processor is further configured to create and transmit to a user plane function (UPF), in charge of transferring data in a user plane, a quality-of-service (QoS) enforcement rule (QER) including a packet detection rule (PDR) to be used upon classifying traffic in the UPF and information related to QoS enforcement of traffic identified by the PDR, based on the determined user plane security policy. ### Claim 15 (depends on 9) The SMF of claim 9, wherein the processor is further configured to transfer a message including security indication information corresponding to the determined user plane security policy and quality-of-service flow identifier (QFI) to a base station linked to the UE through an access and mobility management function (AMF) managing mobility of the UE, wherein the security indication information includes at least one of ciphering information and integrity protection information. ### Claim 16 (depends on 15) The SMF of claim 15, wherein the security indication information and the QFI are used for creation of a data radio bearer (DRB) for the specific service data flow. ### Claim 17 A method for determining a user plane security policy for a protocol data unit (PDU) session of a user equipment (UE) in a wireless communication system, the method comprising: creating, by a policy and control function (PCF) managing a policy and charging control (PCC) rule, configuration information including information about a priority for a user plane security policy to be applied to a specific service data flow; and transmitting, by the PCF, the configuration information including the information about the priority to a session management function (SMF) managing the PDU session for the UE, wherein the user plane security policy to be applied to the PDU session of the UE is determined based on the priority. ### Claim 18 (depends on 17) The method of claim 17, wherein the PCC rule includes the user plane security policy to be applied to the specific service data flow, and the user plane security policy is provided from an operator server. ### Claim 19 A policy and control function (PCF) managing a policy and charging control (PCC) rule in a wireless communication system, the PCF comprising: a transceiver; and a processor configured to: create configuration information including information about a priority for a user plane security policy to be applied to a specific service data flow, and transmit, through the transceiver, the configuration information including the information about the priority to a session management function (SMF) managing a protocol data unit (PDU) session for a user equipment (UE), wherein a user plane security policy to be applied to the PDU session of the UE is determined based on the priority. ### Claim 20 (depends on 19) The PCF of claim 19, wherein the PCC rule includes the user plane security policy to be applied to the specific service data flow, and the user plane security policy is provided from an operator server.