Method and device for selective user plane security in wireless communication system

A security processing method performed by a receiver in a communication network, the method comprising:

• receiving one or more data packets from a transmitter through a lower layer, wherein each of the data packets includes a packet data convergence protocol (PDCP) header and header information including an internet protocol (IP) header, wherein the PDCP header includes information related to an encrypted portion of the header information and an encryption length of the encrypted portion;
• determining, based on a data radio bearer (DRB) configuration of each of the one or more data packets, a security mode that is enabled for a corresponding data packet of the one or more data packets;
• determining whether selective encryption is enabled in the corresponding data packet of the one or more data packets based on the determined security mode and, parsing the information related to the encrypted portion of the header information and the encryption length of the encrypted portion from the PDCP header;
• and
• decrypting the IP header of data packets for which it is determined that the selective encryption is enabled.

A transmission device in a wireless communication system, the transmission device comprising:

• a transceiver;
• and
• at least one processor configured to:
• control the transceiver to receive, at a packet data convergence protocol (PDCP) layer from an upper layer, one or more data packets each including header information and application data, wherein the header information includes a plurality of headers;
• parse the header information of the one or more data packets;
• determine, based on the parsing of the header information, a length of each of the plurality of headers within the corresponding header information and whether a security header is present or absent in the one or more corresponding data packets;
• identifying, based on the determination, corresponding header information of the one or more packets in which the security header is present;
• encrypt, based on the determined header lengths, only each of the plurality of headers of the identified corresponding header information in which the security header is present;
• and
• control the transceiver to transmit the one or more data packets to a lower layer after adding information regarding each of the encrypted headers along with their encryption length into a PDCP header.

A reception device in a wireless communication system, the reception device comprising:

• a transceiver;
• and
• at least one processor configured to:
• control the transceiver to receive one or more data packets from a transmission device through a lower layer, wherein each of the data packets includes a packet data convergence protocol (PDCP) header and header information including an internet protocol (IP) header, wherein the PDCP header includes information related to an encrypted portion of the header information and an encryption length of the encrypted portion;
• determine, based on a data radio bearers (DRB) configuration of each of the one or more data packets, a security mode that is enabled for a corresponding data packet of the one or more data packets;
• determine whether selective encryption is enabled in the corresponding data packet of the one or more data packets based on the determined security mode and parsing of the information related to the encrypted portion of the header information and the encryption length of the encrypted portion from the PDCP header;
• and
• decrypt the IP header of data packets for which it is determined that the selective encryption is enabled.