Enhancements for security updates in communication networks

Abstract

According to an example aspect of the invention, a method is provided, comprising sending, by a firewall device, a request to a security service provider to update a firewall policy of the firewall device for a location center, wherein the request includes at least one characteristic of the firewall device, the at least one characteristic of the firewall device also including load data of the firewall device, receiving, by the firewall device, an updated firewall policy for the location center from the security service provider, wherein the updated firewall policy includes load data required for the updated firewall policy, and adjusting operation of the firewall device based on the updated firewall policy by reserving resources for the update at the firewall device according to the required load data.

Description

Technical Field

[0001] Various example embodiments relate generally to communication networks, such as core networks of cellular communication systems, and more particularly to enhancing security updates in such networks. Background Art

[0002] Regular updating of communication devices is required in various communication networks. However, the security of the update process needs to be ensured to avoid losses and damages due to attacks. For example, IoT devices, such as smart meters, may need to be updated more frequently than some other computers, but the same security should be ensured. Security is particularly important for mission-critical IoT devices that provide critical services, because if such devices are attacked, significant losses and damages may occur. Appropriate security patching in a limited resource environment requires an efficient attack prevention strategy to reduce / prevent damage in an insecure IoT network of devices. Therefore, there is a need to provide improved methods, devices and computer programs for enhancing security updates in communication networks. Summary of the invention

[0003] According to some aspects, the subject matter of the independent claims is provided. Some example embodiments are defined in the dependent claims.

[0004] The scope of protection sought by various exemplary embodiments of the invention is set out by the independent claims. Exemplary embodiments and features described in this specification that do not fall within the scope of the independent claims, if any, should be interpreted as useful examples for understanding the various exemplary embodiments of the invention.

[0005] According to a first aspect of the present invention, a method is provided, comprising sending, by a firewall device, a request to update a firewall policy of the firewall device for a location center to a security service provider, wherein the request includes at least one characteristic of the firewall device, the at least one characteristic of the firewall device also includes load data of the firewall device, receiving, by the firewall device, an updated firewall policy for the location center from the security service provider, wherein the updated firewall policy includes load data required for the updated firewall policy, and adjusting the operation of the firewall device based on the updated firewall policy by reserving resources for the update at the firewall device according to the required load data.

[0006] Example embodiments of the first aspect may include at least one feature from the following bulleted list or any combination of the following features:

[0007] Receive an update regarding at least one IoT device, determine whether the update is from a location center based on the updated firewall policy, and decide whether to forward the update to the at least one IoT device depending on the determination;

[0008] After determining that the update is from the location center, forward the update to at least one IoT device;

[0009] After determining that the update is not from the location center, stopping updates with respect to at least one IoT device;

[0010] a characteristic of at least one firewall device including an indication of at least one of: a number of processes running at the firewall, a number of threads of a process running at the firewall device, a mode of device operation of the firewall device, at least one transport protocol supported by the firewall device, at least one application layer protocol supported by the firewall device, at least one Internet Protocol (IP) version supported by the firewall device, a response timer for the firewall device, a number of connections at the firewall device, and a connection mode of the firewall device;

[0011] wherein the updated firewall policy includes a time interval;

[0012] Determining that an update for at least one IoT device is valid when the update is received during a time interval;

[0013] • The updated firewall policy includes an indication of the input ports of the firewall device.

[0014] • Determining that at least one update for the IoT device is valid when the update is received at the input port.

[0015] • The updated firewall policy includes an indication of the source port of the location center.

[0016] • Determine that an update is valid when it is received from a source port.

[0017] According to a second aspect of the present invention, a method is provided, comprising receiving a request for updating a firewall policy for the firewall device and a location center from a firewall device through a security service provider, wherein the request includes at least one characteristic of the firewall device, and the at least one characteristic of the firewall device also includes load data of the firewall device; based on the at least one characteristic of the firewall device, updating the firewall policy for the location center of the firewall device through the security service provider, and sending the updated firewall policy to the firewall device through the security service provider, wherein the updated firewall policy includes the load data required by the updated firewall policy.

[0018] Example embodiments of the second aspect may include at least one feature from the following bulleted list or any combination of the following features:

[0019] The characteristic of at least one firewall device includes an indication of at least one of: a number of processes running at the firewall, a number of threads of a process running at the firewall device, a mode of device operation of the firewall device, at least one transport protocol supported by the firewall device, at least one application layer protocol supported by the firewall device, at least one Internet Protocol (IP) version supported by the firewall device, a response timer for the firewall device, a number of connections at the firewall device, and a connection mode of the firewall device.

[0020] • Updated firewall policies include time intervals.

[0021] • The updated firewall policy includes an indication of the input ports of the firewall device.

[0022] The updated firewall policy includes an indication of the input port of the firewall device.

[0023] • The updated firewall policy includes an indication of the source port of the location center.

[0024] Send updated firewall policies to the location center.

[0025] According to a third aspect of the present invention, a method is provided, comprising one or more processors, and a memory storing instructions, which, when executed by the one or more processors, causes a device to perform a first method. The at least one memory and the computer program code can be configured to, together with at least one processor core, cause the device to at least execute, through a firewall device, a request to update a firewall policy of the firewall device for a location center to a security service provider, wherein the request includes at least one characteristic of the firewall device, and at least one characteristic of the firewall device also includes load data of the firewall device, receiving an updated firewall policy for the location center from the security service provider through the firewall device, wherein the updated firewall policy includes the load data required by the updated firewall policy; and adjusting the operation of the firewall device based on the updated firewall policy by reserving resources for updating at the firewall device according to the required load data.

[0026] According to a fourth aspect of the present invention, there is provided an apparatus, comprising one or more processors, and a memory storing instructions, which, when executed by the one or more processors, causes the apparatus to perform a second method. The at least one memory and the computer program code may also be configured to, together with at least one processor core, cause the apparatus to at least perform, through a security service provider, receiving a request to update a firewall policy for the firewall apparatus and a location center from a firewall apparatus, wherein the request includes at least one characteristic of the firewall apparatus, and the at least one characteristic of the firewall apparatus also includes load data of the firewall apparatus; based on the at least one characteristic of the firewall apparatus, updating the firewall policy for the location center of the firewall apparatus through the security service provider, and sending the updated firewall policy to the firewall apparatus through the security service provider, wherein the updated firewall policy includes the load data required by the updated firewall policy.

[0027] According to a fifth aspect of the present invention, there is provided an apparatus, comprising a component for performing a first method. The apparatus may include a component for sending, through a firewall apparatus, a request to update a firewall policy for a location center of the firewall apparatus to a security service provider, wherein the request includes at least one characteristic of the firewall apparatus, and the at least one characteristic of the firewall apparatus further includes load data of the firewall apparatus, a component for receiving, through the firewall apparatus, an updated firewall policy for the location center from the security service provider, wherein the updated firewall policy includes load data required by the updated firewall policy, and a component for adjusting the operation of the firewall apparatus based on the updated firewall policy by reserving resources for the update at the firewall apparatus according to the required load data.

[0028] According to a sixth aspect of the present invention, there is provided an apparatus, comprising a component for executing the second method. The apparatus may include a component for receiving a request for updating a firewall policy for the firewall apparatus and a location center from a firewall apparatus through a security service provider, wherein the request includes at least one characteristic of the firewall apparatus, and the at least one characteristic of the firewall apparatus also includes load data of the firewall apparatus, a component for updating the firewall policy for the location center of the firewall apparatus through the security service provider based on the at least one characteristic of the firewall apparatus, and a component for sending the updated firewall policy to the firewall apparatus through the security service provider, wherein the updated firewall policy includes the load data required by the updated firewall policy.

[0029] According to the seventh aspect of the present invention, there is provided a non-transitory computer-readable medium having a set of computer-readable instructions stored thereon, which, when executed by at least one processor, causes the device to at least perform the method of the first aspect. According to the eighth aspect of the present invention, there is provided a non-transitory computer-readable medium having a set of computer-readable instructions stored thereon, which, when executed by at least one processor, causes the device to at least perform the method of the second aspect.

[0030] According to a ninth aspect of the present invention, there is provided a computer program configured to execute the method of the first aspect. According to a tenth aspect of the present invention, there is provided a computer program configured to execute the method of the second aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 An exemplary system according to at least some example embodiments is shown;

[0032] Figure 2 A first signaling diagram is shown according to at least some example embodiments;

[0033] Figure 3 showing a second signaling diagram according to at least some example embodiments;

[0034] Figure 4 illustrates a first workflow according to at least some example embodiments;

[0035] Figure 5 illustrates a second workflow according to at least some example embodiments;

[0036] Figure 6 An example apparatus capable of supporting at least some example embodiments is shown;

[0037] Figure 7 A flow chart illustrating a first method according to at least some example embodiments;

[0038] Figure 8 showing a flow chart of a second method according to at least some example embodiments; DETAILED DESCRIPTION

[0039] Security updates in a communication network can be enhanced by the processes described herein, for example, for wireless devices, such as Internet of Things (IoT) devices. Security updates can be provided by utilizing at least load data of a firewall device at a security service provider to update a firewall policy of the firewall device to generate an updated firewall policy executable by the firewall device. The updated firewall policy can include information about the load data required for the firewall policy, and thus can ensure that the firewall device reserves sufficient resources for processing the update, thereby avoiding unnecessary transmissions for resource-limited devices (such as IoT devices).

[0040] Figure 1 Exemplary systems are shown in accordance with at least some example embodiments of the present invention. Figure 1 The exemplary system includes a mobile network 100, at least one location center 110 and a radio access network, RAN, 120. The mobile network 100 may also include another RAN and a core network. The at least one location center 110 may also be referred to as an authenticated location center, such as a location center of a cellular communication system. Figure 1 The exemplary system also includes a malicious device 130, such as a botnet attack / intrusion unit, and a firewall device 140. The firewall device 140 may include components for performing firewall actions. For example, the firewall device 140 may be configured to perform such actions. For example, the firewall device 140 may refer to a device that provides a policy-oriented firewall service (SOFS).

[0041] Figure 1 The exemplary system also includes at least one wireless device 150. The at least one wireless device 150 may include, for example, a smartphone, a cellular phone, a machine-to-machine, M2M, node, machine type communication, MTC, node, IoT node, a car telemetry unit, a laptop, a tablet computer, or indeed another suitable wireless terminal. In some embodiments, the at least one wireless device 150 may refer to a single IoT device. Alternatively, the at least one wireless device 150 may refer to a group of IoT devices, which form a group defined, for example, by the Third Generation Partnership Project, 3GPP. In this case, the devices of the group may have the same external group identifier, for example, as defined in 3GPP standard specification TS 23.682. Embodiments of the present invention may be particularly useful in the case of IoT devices, because IoT devices may be deceived by monitors and the number of IoT devices is typically high.

[0042] exist Figure 1 In an example system, at least one wireless terminal 150 can communicate wirelessly with a cell of the RAN 120. The air interface between the RAN 120 and the at least one wireless device 150 can be configured according to a radio technology (RAT), wherein both the RAN 120 and the at least one wireless device 150 are configured to support the RAT. Examples of cellular RATs include Long Term Evolution (LTE) New Radio (NR), which may also be referred to as fifth generation, 5G, radio access technology, and Multefire. For example, in the context of LTE, the BS 120 may be referred to as an eNB, while in the context of NR, the BS 120 may be referred to as a gNB. In any case, embodiments of the present invention are not limited to any particular wireless technology. Instead, embodiments may be utilized in any communication system where security updates of wireless devices are required. According to embodiments of the present invention, updates also cover upgrades.

[0043] The SOFS may be embedded in a network function NF or deployed as a separate unit, which may be a front end for at least one nominated wireless device 150, such as an IoT device, a group of IoT devices, or an IoT device farm / cluster. In the case of 3GPP, a service-based architecture (SBA) of a 5G core network, the NF may include at least some access and mobility functions (AMF), session management functions (SMF), network slice selection functions (NSSF), network exposure functions (NEF), NRF, unified data management (UDM), user data repository (UDR), unstructured data storage function (UDSF), authentication server function (AUSF), policy control function (PCF), application function (AF), operation administration and maintenance (OAM), and network data analysis function (NWDAF).

[0044] In some embodiments, SOFS can be authenticated using a mobile network or a satellite network. SOFS can obtain an initial seed during the authentication and / or registration process. The initial seed can be access network related data of the upgrade / update endpoint, and SOFS can further connect or accept connection to the upgrade / update endpoint based on various policies and protocols. SOFS can run as embedded hardware and / or software in the operator's cloud infrastructure network or in the device. At least one wireless device 150 can instruct the network to deliver all updates / upgrades via SOFS.

[0045] Reference again Figure 1 , the malicious device 130 may attempt to update at least one wireless device 150, for example, by performing a botnet attack. However, the firewall device 140, i.e., SOFS, may be located between the malicious device 130 and the at least one wireless device 150. Therefore, the firewall device 140 may detect the attack and terminate the update by executing the access control policy. The execution of the access control policy may include, for example, alerting the user / network, dynamic blacklisting, and learning botnet attack behaviors via anonymous device simulation, etc. On the other hand, if the update is determined by the firewall device 140 to be valid, i.e., legitimate, the firewall device 140 may forward the update to the at least one wireless device 150.

[0046] Efficient security operations are very important, especially for IoT devices. Regular software / security updates may be required, but since IoT devices have limited resources, such processes should not waste resources. For example, in the case of mission-critical IoT devices, attacks may cause significant losses and damage. Therefore, efficient security processes for preventing attacks are needed to prevent, or at least mitigate, the damage. Therefore, embodiments of the present invention generally provide protection for IoT devices, such as against botnets and ransomware attacks. Some embodiments specifically provide protection for mission-critical IoT devices.

[0047] Figure 2 A first signaling example is illustrated according to at least some example embodiments. Figure 1 , on the vertical axis, from left to right, a location center 110, a RAN 120, and a core network function 125 are arranged ( Figure 1 RAN 120 may also be referred to as an access network function. RAN 120 may be a mobility management entity (MME), or AMF, and core network function 125 may be a home subscriber server (HSS), or UDM. Time moves from top to bottom.

[0048] In some embodiments, the location center 110 that forwards the trusted updates may be authenticated, authorized, and registered, for example, using 3GPP mechanisms. In addition, the location center 110 may also send the location information statically or dynamically in a registration response to the RAN 120. For example, the representation of SOFS data (e.g., including location information) may be implemented by reusing optional vendor-specific AVPs defined by 3GPP, or represented as repository data with a special service indication by using a 3GPP application server.

[0049] At step 210, the location center 110 may send an authentication request to the RAN 102. The authentication request may include an identity of the location center 110, which is to be used to identify that the authentication request is for authenticating the location center 110. At step 215, the RAN 120 may forward the authentication request to the core network function 125. The core network function 125 may authenticate the location center 125 after receiving the authentication request and generate an authentication vector. At step 220, the core network function may send an authentication response to the RAN 120, which includes the authentication vector generated for the location center 110. At step 225, the RAN 120 may verify the location center 110 via mutual authentication (e.g., using a 3GPP authentication method) and send an authentication response to the location center 110 to indicate that the authentication was successful. In some embodiments, the location center 110 may be similar to a user equipment.

[0050] At step 230, upon successful authentication, the location center 110 may send a registration request to the RAN 120. At step 235, the RAN 120 may send a registration request to the core network function 125. The core network function 125, upon receiving the registration request and having an authorized firewall device 140 (i.e., SOFS), may perform registration of the location center 110. Then, at step 240, the core network function 125 may send a registration response to the RAN 120, the response including SOFS data, such as location data, any data related to events in the RAN 120 and / or any parameters of the RAN 120, and the address of the firewall device 140. For example, the SOFS data may include an initial seed. After receiving the SOFS data and the address of the firewall device 140, the RAN 120 may send a registration response to the location center 110 at step 245 to indicate that the registration was successful.

[0051] At step 250, the RAN 120 may send a notification to the firewall device 140. The notification may be sent to the address of the firewall device 140. In some embodiments, the notification may be an implicit notification. The notification may include the SOFS data and the identifier of the location center 110. That is, the RAN 120 may obtain the address of the firewall device 140 authorized by the core network function 125, and feed the firewall device 140 with the parameters related to the location center 110. The firewall device 140 may store the received parameters related to the location center 110 for applying the update-related firewall policy associated with the location center 110.

[0052] Figure 3 A second signaling example is illustrated according to at least some example embodiments. Figure 1 , on the vertical axis, from left to right, the location center 110, the security service provider (SSP), 135 ( Figure 1 1 and 2 (not shown) and device 140, namely SOFS. Time advances from top to bottom.

[0053] SSP 135 may determine and send firewall policies to be executed by firewall device 140 (i.e., SOFS). For example, SSP 135 may be in the trust domain of the operator. SSP 135 may construct firewall policies for firewall device 140. For example, SSP 135 may have a rule-based machine learning method for constructing data and rule sets for firewall policies based on network parameters related to device characteristics of location center 110 and / or firewall device 140.

[0054] At step 310, the firewall device 140 may send a device characteristic request DCR to the SSP 135, the DCR including at least one characteristic of the firewall device 140. In some embodiments, the DCR may also be referred to as a request to update the firewall policy of the location center 110 of the firewall device 140. At step 320, the SSP 135 may confirm the DCR by sending a device characteristic acknowledgment (DCA) to the firewall device 140. That is, the device characteristics may be propagated from the SOFS to the SSP 135 using the DCR / DCA command.

[0055] DCR may include at least one of the following equipment characteristics of firewall device 140, for example, depending on performance, robustness, security, and quality:

[0056] Load data (central processing unit, CPU, memory and / or disk) of the firewall appliance 140. In the case of IoT devices, load data is particularly important because it ensures that the firewall appliance 140 can reserve sufficient resources for handling updates, thereby avoiding unnecessary transmissions for resource-limited IoT devices. In some embodiments, fewer resources and a single stream instead of multiple streams may be required for smaller updates. In general, the load data of the firewall appliance 140 may refer to the resources of the firewall appliance 140, such as computing resources, memory resources, and / or disk space;

[0057] • The number of processes running at firewall device 140. Similar to above, this information can be used to enable the reservation of sufficient resources at firewall device 140.

[0058] The number of processes in a particular key process, i.e., the selected process running at the device 140;

[0059] The device operation mode of the firewall device 140 (virtualized, non-virtualized, containerized, single-core mode);

[0060] · The transmission protocols supported by the firewall device 140;

[0061] Application layer protocols supported by firewall device 140;

[0062] The IP version (V4 or V6) supported by the firewall device 140;

[0063] Response timer, i.e., the time interval during which updates on at least one wireless device can be received and checked for validity. Such information is particularly important for mission-critical IoT devices, as it provides enhanced security (the time interval must be known to know the updates) and avoids unnecessary transmissions for resource-limited mission-critical IoT devices (which can only be updated during the response time);

[0064] The number of connections to the firewall device 140;

[0065] Firewall device 140 connections (client, server, relay, redirect, proxy,

[0066] Agent) method.

[0067] At step 330, firewall device 140 may receive a policy update request (SUR) from SSP 135, the SUR including an updated firewall policy for location center 110. The SUR may refer to Figure 2 In general, the SUR may include a set of rules for verifying a trusted location center, i.e., location center 110. In some embodiments, the updated firewall policy may also include payload data of firewall device 140 required for updating the firewall policy of location center 110. In step 340, the firewall device may acknowledge the SUR by sending a policy update acknowledgment (SUA) to SSP 135. That is, the SUR / SUA command pair may be used to propagate device characteristics from SSP 135 to SOFS.

[0068] The updated firewall policy may include a rule set (e.g., knowledge-based) for establishing a predictive model at the firewall device (i.e., SOFS). For example, the updated firewall policy may include one or more of the following:

[0069] Mapping an identifier of the location center 110 (such as the location center Cell-ID) to a specific device characteristic of the firewall device 140, such as an input port of the firewall device 140 at which software / hardware updates and / or upgrades arrive;

[0070] When the location center 110 is allowed to send updates / upgrades, the identifier of the location center 110 is mapped to a specific scheduled time or time interval;

[0071] · Mapping of the source port of the location center 110 and the input port of the firewall device 140;

[0072] The identity of the algorithm may be shared between the SSP 135 and the firewall device 140;

[0073] Certain events from the application server facilitate the conditions for building the rule set. For example, specific repository data with certain supplementary services can be created to help build the rule set. Subscription to the PDN or registration status change of the location center 110 can also be enabled. In addition, other events can also be considered, such as monitoring events, communication events, etc.;

[0074] Mobility factors to the location center 110 via applications on the location center 110. In some embodiments, in addition to existing static locations, the location center 110 can use cloud computing features such as migration to randomly move to new areas to induce mobility or add additional metadata to the location data of the location center 110;

[0075] Map the internal state of the location center.

[0076] For example, SSP 135 may formulate at least one of the following rules and add corresponding directive(s) to the updated firewall policy:

[0077] • Rule 1: "Location Centre LC1 cell-ID=CI-1." That is, SSP 135 may include the identification of location center 110 into the indication of the updated firewall policy.

[0078] ·Rule 2: "SOFS load data = {load-level = 5}". That is, SSP 135 may include an indication of the load level required for the updated firewall policy. Firewall device 140 may adjust its operation according to the required load by reserving resources, such as CPU, memory, and disk resources at firewall device 140. Therefore, it can be ensured that firewall device 140 reserves sufficient resources for processing updates, thereby avoiding unnecessary transmissions of IoT devices with limited resources. SSP 135 may check that the load data required for the updated firewall policy does not exceed the load data of firewall device 140, indicated by firewall device 140 in the DCR. In general, the load data required for the updated firewall policy may be referred to as required resources, such as computing resources, memory resources, and / or disk space;

[0079] • Rule 3: "Source port of SOFS = HASH(CI-1)" That is, the SSP 135 may include instructions regarding the source port of the location center 110 into the updated firewall policy, thereby providing enhanced security.

[0080] • Rule 3: "Transport Protocol = SCTP." That is, SSP 135 may include an indication of the transport protocol to use for the updated firewall policy.

[0081] • Rule 4: "Enable multi-homing and flows." That is, SSP 135 may include an indication as to whether multi-homing and flows are enabled for the updated firewall policy.

[0082] • Rule 5: "IP used = IPV6." That is, SSP 135 may include an indication of the IP version used by the updated firewall policy.

[0083] Rule 6: "Schedule at T1". That is, SSP 135 may include an indication of a time interval when updates may be considered valid for the updated firewall policy. This is particularly important for mission-critical IoT devices, as security is increased (the time interval must be known in order for the update to pass), while avoiding unnecessary transmissions for mission-critical IoT devices with limited resources (updates may only be possible within the response time). SSP 135 may check that the time interval required for the updated firewall policy is within the response timer of firewall device 140, as indicated by firewall device 140 in the DCR;

[0084] Rule 7: "Algorithm Id = Id2". In some embodiments, the destination port, i.e., the input port of the firewall device 140, may be indicated by the algorithm. For example, consider that the algorithm Id = Id2 may be mapped to an algorithm with a mathematical model M. Then the destination port may be Dp = M (R1..Rn-1). In general, any indication of the input port of the firewall device 140 may be used.

[0085] At step 350, the location center 110 may receive an update schedule request (USR) from the SSP 135, the USR containing an update schedule for the location center 110. At step 360, the location center 110 may acknowledge the USR by sending an update schedule acknowledgement (USA) to the SSP 135. That is, the USR / USA command pair may be used to update the schedule for software updates / upgrades from the SSP 135 to the SOFS location center 110.

[0086] The location information may include, for example, a location number, a service area identifier, a cell global identifier, a location area identity, geographic information, geodetic information, serving node details, a tracking area identity, a visited PLMN identity, a RAT type, the age of the location information as defined in Section 7.6.6 of 3GPP standard specification TS 29.328, etc.

[0087] In some embodiments, the firewall device, i.e., SOFS, can confirm the SSP 135 on the rule set using a unique reference identity mapped to the encoding scheme used to represent the rules. The SSP 135 can trigger the location center 110 to schedule software / hardware updates and / or upgrades using the exact rules agreed upon with the SOFS.

[0088] Figure 4A first workflow according to at least some example embodiments is illustrated. The first workflow illustrates an exemplary workflow of firewall device 140. At step 410, processing of a SUR may begin at firewall device 140. Firewall device 140 may receive a SUR including an updated firewall policy, the SUR including at least one characteristic of firewall device 140, and the at least one characteristic of firewall device 140 also including at least load data of firewall device 140.

[0089] In some embodiments, the updated firewall policy may also include a time interval during which the location center 110 is allowed to send updates regarding the at least one wireless device 150. Alternatively or additionally, the updated firewall policy may include an indication of an input port of the firewall device 140, i.e., an updated destination port regarding the at least one wireless device 150. In some embodiments, the updated firewall policy may include an indication of a source port of the location center 110.

[0090] In step 420, firewall device 140 may adjust the operation of firewall device 140 according to the updated firewall policy, for example, by configuring a receiver of firewall device 140 according to the updated firewall policy. For example, the operation of firewall device 140 may be adjusted according to the load data required by the updated firewall policy. For example, the load data may require 3vCPU, 8GB RAM, and 1GB disk. In this case, SSP 135 may check that the load data required by the updated firewall policy is less than the load data of firewall device 140 before updating the firewall policy to ensure that firewall device 140 can execute the updated firewall policy. Therefore, firewall device 140 may reserve resources for the update at firewall device 140 according to the required load data. In addition, the operation of firewall device 140 may be adjusted according to the time interval so that the receiver of firewall device 140 is ready to receive, for example, approximately 1 second before the start of the time interval.

[0091] At step 430, firewall device 140 may adjust its operation by opening an SCTP transport connection (e.g., using a specified IPv6 address) with the indicated source port of location center 110 and preparing the receiver to receive. The input port of firewall device 140 may similarly be prepared at step 440 and processing of the SUR may be completed at step 450.

[0092] Figure 5A second workflow according to at least some example embodiments is illustrated. The second workflow illustrates an exemplary workflow of location center 110. At step 510, processing of the USR may begin at location center 110. At step 520, location center 110 may adjust its operation according to the updated firewall policy, for example, by configuring a transmitter of location center 110 according to the updated firewall policy. Location center 110 may adjust its operation, for example, by extracting a time interval and a source port from the USR.

[0093] At step 530, the location center 110 may adjust its operation and prepare the receiver to receive by opening an SCTP transport connection (e.g., with an indicated IPv6 address) to the input / destination port indicated by the firewall device 140. The location center 110 may then send updates about the at least one wireless device 150 at step 540 within the time interval and processing of the SUR may be completed at step 550.

[0094] Figure 6 An example apparatus capable of supporting at least some example embodiments is illustrated. Shown is a device 600, which may include, for example, an SSP 135 or a firewall device 140, or a device controlling the functions thereof. Included in the device 600 is a processor 610, which may include, for example, a single-core or multi-core processor, wherein a single-core processor includes one processing core and a multi-core processor includes more than one processing core. The processor 610 may generally include a control device. The processor 610 may include more than one processor. The processor 610 may be a control device. The processor 610 may include at least one application specific integrated circuit (ASIC). The processor 610 may include at least one field programmable gate array, FPGA. For example, the processor 610 may include an Intel Xeon processor. The processor 610 may be a means for performing method steps in the device 600, such as determining, causing transmission, and causing reception. The processor 610 may be configured to perform actions at least in part by computer instructions.

[0095] The processor may include, or be constituted of, a circuit system or circuit systems that are configured to perform the stages of the method according to the example embodiments described herein. As used in this application, the term "circuitry" may refer to one or more or all of the following: (a) hardware circuit implementations only, such as implementations in analog and / or digital circuits only, and (b) combinations of hardware circuits and software, such as, as applicable: (i) a combination of analog and / or digital hardware circuits with software / firmware, and (ii) any portion of a hardware processor with software (including a digital signal processor), software and memory working together to enable the device (such as a network function) to perform various functions and (c) hardware circuits and / or processors, such as microprocessors or portions of microprocessors that require software (such as firmware) for operation, but the software may not be present when not required for operation.

[0096] This definition of circuitry applies to all uses of this term in this application, including in any claims. As a further example, as used in this application, the term circuitry also covers only an implementation of a hardware circuit or processor (or multiple processors), or portions of a hardware circuit or processor and its (or their) accompanying software and / or firmware. The term circuitry also includes, by way of example and if applicable to a particular claim element, a baseband integrated circuit or processor integrated circuit for use in a mobile device or similar integrated circuit in a server, cellular network device, or other computing or network device.

[0097] Device 600 may include memory 620. Memory 620 may include random access memory and / or permanent memory. Memory 620 may include at least one RAM chip. For example, memory 620 may include solid-state, magnetic, optical and / or holographic memory. Memory 620 may be at least partially accessible by processor 610. Memory 620 may be at least partially included in processor 610. Memory 620 may be used to store information. Memory 620 may include computer instructions that processor 610 is configured to execute. When computer instructions configured to cause processor 610 to perform certain operations are stored in memory 620, and device 600 as a whole is configured to run under the direction of processor 610, using computer instructions from memory 620, processor 610 and / or at least one of its processing cores may be considered to be configured to perform certain actions described. Memory 620 may be at least partially included in processor 610. Memory 620 may be at least partially external to device 600, but accessible to device 600.

[0098] Device 600 may include a transmitter 630. Device 600 may include a receiver 640. Transmitter 630 and receiver 640 may be configured to transmit and receive information, respectively, according to at least one cellular standard, such as a standard defined by 3GPP. Transmitter 630 may include more than one transmitter. Receiver 640 may include more than one receiver. Transmitter 630 and / or receiver 640 may be configured to operate according to an appropriate communication standard.

[0099] Device 600 may include a user interface, UI, 650. UI 650 may include at least one of a display, a keyboard, a touch screen, a vibrator arranged to signal a user by vibrating device 600, a speaker, and a microphone. A user may operate device 600 through UI 650, for example, to configure device 600 and / or the functions it performs.

[0100] The processor 610 may be equipped with a transmitter arranged to output information from the processor 610 to other devices included in the device 600 via electrical leads inside the device 600. Such a transmitter may include a serial bus transmitter, which is arranged to, for example, output information to the memory 620 via at least one electrical lead for storage therein. As an alternative to a serial bus, the transmitter may include a parallel bus transmitter. Similarly, the processor 610 may include a receiver, which is arranged to receive information from other devices included in the device 600 via electrical leads inside the device 600 in the processor 610. Such a receiver may include a serial bus receiver, which is arranged to receive information for processing in the processor 610, for example, via at least one electrical lead from the receiver 640. As an alternative to a serial bus, the receiver may include a parallel bus receiver.

[0101] The device 600 may include Figure 6 In some example embodiments, the device 600 lacks at least one of the devices described above. For example, the device 600 may not have the UI 650.

[0102] The processor 610, the memory 620, the transmitter 630, the receiver 640 and / or the UI 650 may be interconnected in a variety of different ways via electrical leads within the device 600. For example, each of the above devices may be individually connected to a bus master within the device 600 to allow the devices to exchange information. However, the skilled person will appreciate that this is only an example and that various ways of connecting at least two of the above devices may be selected without departing from the scope of the present invention, depending on the embodiment.

[0103] Figure 7is a flow chart of a first method according to at least some example embodiments. The stages of the illustrated first method may be performed by firewall appliance 140, or possibly when installed therein, by a control device configured to control the functionality thereof.

[0104] In step 710, the first method may include sending, by the firewall device, a request to update a firewall policy of the firewall device for the location center to a security service provider, wherein the request includes at least one characteristic of the firewall device, and the at least one characteristic of the firewall device also includes load data of the firewall device. The first method may also include, in step 720, receiving, by the firewall device, an updated firewall policy for the location center from the security service provider, wherein the updated firewall policy includes load data required for the updated firewall policy. Finally, in step 730, the first method may include adjusting the operation of the firewall device based on the updated firewall policy by reserving resources for the update on the firewall device according to the required load data.

[0105] Figure 8 is a flow chart of a second method according to at least some example embodiments. The stages of the second method shown may be performed by SSP 135, or possibly when installed therein, by a control device configured to control the functions thereof.

[0106] The second method may include, at step 810, receiving, by a security service provider, a request to update a firewall policy for the firewall device and the location center from the firewall device, wherein the request includes at least one characteristic of the firewall device, and the at least one characteristic of the firewall device also includes load data of the firewall device. The second method may also include, at step 820, updating, by the security service provider, the firewall policy for the location center of the firewall device based on the at least one characteristic of the firewall device. Finally, the second method may include, at step 830, sending, by the security service provider, an updated firewall policy to the firewall device, wherein the updated firewall policy includes load data required by the updated firewall policy.

[0107] It should be understood that the embodiments of the present disclosure are not limited to the specific structures, processing steps or materials disclosed herein, but are extended to equivalents understood by ordinary technicians in the relevant field. It should also be understood that the terminology used herein is only used to describe specific example embodiments and is not intended to be limiting.

[0108] References to an exemplary embodiment or exemplary embodiments throughout the specification mean that a particular feature, structure, or characteristic described in connection with the exemplary embodiment is included in at least one exemplary embodiment. Thus, the phrases "in an exemplary embodiment" or "in an exemplary embodiment" appearing in various places throughout the specification do not necessarily all refer to the same exemplary embodiment. When a value is referenced using terms such as, for example, "approximately" or "substantially," the exact value is also disclosed.

[0109] As used herein, for convenience, multiple items, structural units, constituent units and / or materials may be present in a common list. However, these lists should be interpreted as each component of the list being individually identified as a separate and unique component. Therefore, in the absence of contrary indications, any individual component on such a list should not be interpreted as being in fact equivalent to any other member on the same list based solely on their performance in a common group. In addition, various exemplary embodiments and examples, as well as replacements of various components thereof, may also be cited herein. It is understood that such exemplary embodiments, examples and replacements should not be interpreted as de facto equivalents of each other, but should be regarded as independent and autonomous representations.

[0110] In an example embodiment, an apparatus such as, for example, SSP 135 or firewall apparatus 140, or a device controlling the functions thereof, may include components for implementing the above-described example embodiments and any combination thereof.

[0111] In an exemplary embodiment, a computer program may be configured to cause a method according to the above exemplary embodiments and any combination thereof. In an exemplary exemplary embodiment, a computer program product implemented on a non-transitory computer readable medium may be configured to control a processor to perform a process including the above exemplary embodiments and any combination thereof.

[0112] In an example embodiment, an apparatus, such as, for example, SSP 135 or firewall apparatus 140, or a device control function thereof, may include at least one processor, and at least one memory including computer program code, wherein the at least one memory and the computer program code are configured to, together with the at least one processor, cause the apparatus to perform at least the above-described example embodiments and any combination thereof.

[0113] In addition, the described features, structures, or characteristics may be combined in any suitable manner in one or more example embodiments. In the foregoing description, a large number of specific details, such as examples of length, width, shape, etc., are provided to provide a comprehensive understanding of the example embodiments of the present invention. However, those skilled in the relevant art will recognize that the present invention may be practiced without one or more of the specific details, or using other methods, components, materials, etc. In other cases, well-known structures, materials, or operations are not shown or described in detail to avoid obscuring certain aspects of the present invention.

[0114] Although the foregoing examples illustrate the principles of the exemplary embodiments in one or more specific applications, it will be apparent to those skilled in the art that numerous modifications may be made in the details of form, use, and implementation without exercising creativity and without departing from the principles and concepts of the invention. Therefore, the invention is not intended to be limited except as set forth in the following claims.

[0115] The verbs "comprise" and "inlude" are used in this document as open limitations, neither excluding nor requiring the presence of unrecited features. The features recited in the dependent claims are mutually freely combinable unless explicitly stated otherwise. Furthermore, it should be understood that the use of "a" or "an" throughout this document, i.e. the singular, does not exclude the plural.

[0116] Industrial Applicability

[0117] At least some example embodiments find industrial application at least in 5G networks, where enhanced and updated security is needed, and possibly in other wireless communication networks in the future as well.

[0118] List of abbreviations

[0119] 3GPP Third Generation Partnership Project

[0120] AMF Access and Mobility Function

[0121] AUSF authentication server function

[0122] CPU Central Processing Unit

[0123] DCA Device Characterization Confirmation

[0124] DCR Device Characteristic Request

[0125] HSS Home Subscriber Server

[0126] IoT

[0127] LTE Long Term Evolution

[0128] M2M Machine to Machine

[0129] MME Mobility Management Entity

[0130] MTC Machine Type Communication

[0131] NEF Network Exposure Function

[0132] NR New Radio

[0133] NSSF network slice selection function

[0134] NWDAF network data analysis function

[0135] OAM Operations Administration and Maintenance

[0136] RAN Radio Access Network

[0137] RAT Radio Technology

[0138] SBA Service-Based Architecture

[0139] SMF session management functions

[0140] SOFS Policy Oriented Firewall Service

[0141] SSP Security Service Provider

[0142] SUA Policy Update Confirmation

[0143] SUR Policy Update Request

[0144] UDSF unstructured data storage function

[0145] UDM Unified Data Management

[0146] UDR User Data Repository

[0147] USA Updated Scheduling Confirmation

[0148] USR Update Schedule Request

[0149] Reference Signal List

[0150] 100 Mobile Network 110 Location Center 120 RAN 125 Core network functions 130 Malicious Devices 135 SSP 140 Firewall device 210-255 Figure 2 Process steps 310-360 Figure 3 Process steps 410-450 Figure 4 Steps of the workflow 510-550 Figure 5 Steps of the workflow 600-650 Figure 6 The structure of the device 710-730 Figure 7 The first stage of the method 810-830 Figure 8 The first stage of the method

Claims

1. A communication method, comprising: - sending, by the firewall device, to the security service provider, a request to update the firewall policy of the firewall device for the location center, wherein the request comprises at least one characteristic of the firewall device, the at least one characteristic of the firewall device further comprising load data of the firewall device, and the location center is used to send the location information in a registration response to the radio access network RAN; - receiving, by the firewall device, an updated firewall policy for the location center from the security service provider, wherein the updated firewall policy includes load data required by the updated firewall policy; as well as - adjusting the operation of the firewall device based on the updated firewall policy by reserving resources for updating at the firewall device according to the required load data.

2. The method according to claim 1, further comprising: - receiving updates about at least one IoT device; -determining whether the update is from the location center based on the updated firewall policy; as well as - deciding whether to forward the update to the at least one IoT device depending on the determination.

3. The method according to claim 2, further comprising: -After determining that the update comes from the location center, forwarding the update to the at least one IoT device.

4. The method according to claim 2, further comprising: -After determining that the update is not from the location center, stopping the update with respect to the at least one IoT device.

5. The method of claim 1 , wherein the at least one characteristic of the firewall device comprises an indication of at least one of: a number of processes running at the firewall, a number of threads of a process running at the firewall device, a mode of device operation of the firewall device, at least one transport protocol supported by the firewall device, at least one application layer protocol supported by the firewall device, at least one Internet Protocol (IP) version supported by the firewall device, a response timer of the firewall device, a number of connections at the firewall device, and a connection mode of the firewall device. The method of claim 1 , wherein the updated firewall policy includes a time interval.

7. The method according to claim 6, further comprising: - When the update is received during the time interval, determining that an update for at least one IoT device is valid.

8. The method of any one of claims 1 to 7, wherein the updated firewall policy comprises an indication of at least one of: an input port of the firewall device and a source port of the location center.

9. The method according to claim 8, further comprising: - When the update is received at the input port, determining that an update for at least one IoT device is valid.

10. The method according to claim 9, further comprising: - When the update is received from the source port, determining that the update is valid.

11. A communication method, comprising: - receiving, by a security service provider, from a firewall device a request to update a firewall policy for the firewall device and a location center, wherein the request comprises at least one characteristic of the firewall device, the at least one characteristic of the firewall device further comprising load data of the firewall device, and the location center is configured to send location information in a registration response to a radio access network RAN; -updating, by the security service provider, the firewall policy of the firewall device for the location center based on the at least one characteristic of the firewall device; as well as - sending the updated firewall policy to the firewall device through the security service provider, wherein the updated firewall policy includes the load data required by the updated firewall policy.

12. The method of claim 11, wherein the at least one characteristic of the firewall device comprises an indication of at least one of: a number of processes running at the firewall, a number of threads of a process running at the firewall device, a mode of device operation of the firewall device, at least one transport protocol supported by the firewall device, at least one application layer protocol supported by the firewall device, at least one Internet Protocol (IP) version supported by the firewall device, a response timer of the firewall device, a number of connections at the firewall device, and a connection mode of the firewall device.

13. The method of claim 11, wherein the updated firewall policy includes a time interval.

14. The method of claim 11, wherein the updated firewall policy includes an indication of an input port of the firewall device.

15. The method of claim 11, wherein the updated firewall policy includes an indication of a source port of the location center.

16. The method according to any one of claims 11 to 15, further comprising: -Sending the updated firewall policy to the location center.

17. An apparatus for communication, comprising at least one processing core and at least one memory, the at least one memory comprising computer program code, the at least one memory and the computer program code being configured to, together with the at least one processing core, cause the apparatus to at least perform: - sending, by the firewall device, to the security service provider, a request to update the firewall policy of the firewall device for the location center, wherein the request comprises at least one characteristic of the firewall device, the at least one characteristic of the firewall device further comprising load data of the firewall device, and the location center is used to send the location information in a registration response to the radio access network RAN; - receiving, by the firewall device, an updated firewall policy for the location center from the security service provider, wherein the updated firewall policy includes load data required by the updated firewall policy; and - adjusting the operation of the firewall device based on the updated firewall policy by reserving resources for updating at the firewall device according to the required load data.

18. The apparatus of claim 17, wherein the at least one memory and the computer program code are further configured to, with the at least one processing core, cause the apparatus to at least perform the method of claim 1.

19. An apparatus for communication, comprising at least one processing core and at least one memory, the at least one memory comprising computer program code, the at least one memory and the computer program code being configured to, together with the at least one processing core, cause the apparatus to at least perform: - receiving, by a security service provider, from a firewall device a request to update a firewall policy for the firewall device and a location center, wherein the request comprises at least one characteristic of the firewall device, the at least one characteristic of the firewall device further comprising load data of the firewall device, and the location center is configured to send location information in a registration response to a radio access network RAN; -updating, by the security service provider, the firewall policy of the firewall device for the location center based on the at least one characteristic of the firewall device; and - sending the updated firewall policy to the firewall device through the security service provider, wherein the updated firewall policy includes the load data required by the updated firewall policy.

20. The apparatus of claim 19, wherein the at least one memory and the computer program code are further configured to, with the at least one processing core, cause the apparatus to at least perform the method of claim 11.

Images