US 12,075,250 B1
Techniques to enable secure data communication between a first network and a second network that comprise at least in part a different communication environment
Stefanus Roemer, Hennef (DE); Manuel Biewald, Neustadt am Kulm (DE); Sven Lachmund, Munich (DE); and Juergen Baumann, Bonn (DE)
Assigned to DEUTSCHE TELEKOM AG, Bonn (DE)
Appl. No. 18/570,664
Filed by Deutsche Telekom AG, Bonn (DE)
PCT Filed Jun. 7, 2022, PCT No. PCT/EP2022/065341
§ 371(c)(1), (2) Date Dec. 15, 2023,
PCT Pub. No. WO2022/263222, PCT Pub. Date Dec. 22, 2022.
Claims priority of application No. 21180089 (EP), filed on Jun. 17, 2021.
Int. Cl. H04W 12/12 (2021.01); H04W 12/088 (2021.01); H04W 12/30 (2021.01); H04W 36/00 (2009.01); H04W 88/16 (2009.01)
CPC H04W 12/088 (2021.01) [H04W 12/30 (2021.01)] 15 Claims
OG exemplary drawing
 
1. A method to enable a-secure data communication between a first network of a first network provider and a second network of a second network provider,
wherein the first network comprises at least a first part that is a 5G communication environment, wherein the second network comprises at least a first part that is a communication environment preceding the 5G communication environment, and wherein an access link to the first part of the second network comprises a GPRS Tunneling Protocol (GTP)-firewall to protect the first part of the second network,
wherein the method comprises the following steps:
establishing a handover process from the 5G communication environment of the first network to the non-5G first part of the second network, in particular to a 4G communication environment of the second network;
directing control plane traffic of the data transmission from a security edge protection proxy (SEPP) of the first network to a SEPP of the second network, wherein the SEPP of the first network encrypts the data transmission and the SEPP of the second network decrypts the encrypted data transmission;
directing user plane traffic of the data transmission to the access link to the non-5G first part of the second network and through the GTP-firewall; and
providing the decrypted control plane traffic to the GTP-firewall, wherein the GTP-firewall performs security measures based on information extracted from the control plane traffic.