Method and apparatus for preventing network attacks in network slicing

Abstract

Methods and apparatus for preventing network attacks in network slices are disclosed. One method may include: obtaining security requirements of a network slice instance; determining, based on the security requirements of the network slice instance, a security policy to be applied to each of a plurality of constituent network slice subnet instances of the network slice instance; and providing each of the plurality of constituent network slice subnet instances with one or more security feature instances configured according to the determined security policies. This method can be performed at the network slice layer.

Description

Technical Field

[0001] Embodiments of the present disclosure generally relate to security technologies related to network slicing, and more particularly to methods and apparatus for preventing network attacks in network slicing. Background Art

[0002] One concept used in next generation (or 5G) mobile networks is the concept of network slicing. With network slicing, operators can deploy multiple network slice instances to deliver different features to different UE groups, for example, because they deliver different promised services, and / or because they may be dedicated to customers, enterprises or vertical industries. These UE groups can enjoy connectivity and data processing of the mobile network customized to their specific requirements (e.g., data speed, quality, latency, reliability, security, pricing model, etc.), complying with the service level agreement (SLA) agreed with their associated services, customers, enterprises or vertical industries. This means that the mobile network (e.g., AN (access network), CN (core network)) can be shared by multiple parties, such as multiple services, customers, enterprises or vertical industries.

[0003] The introduction of network slicing in such networks and systems brings new technical problems that require new solutions. Examples of such new technical problems are providing secure inter- and intra-network slice communications, and preventing attacks at the edge of a network slice. For example, for a mobile network operator (MNO) or an industry vertical, providing secure Internet access is a major requirement.

[0004] The present disclosure shows a solution for preventing network attacks in network slicing. Summary of the invention

[0005] This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

[0006] According to the first aspect of the present disclosure, a method is provided. The method includes obtaining the security requirements of a network slice instance; determining, based on the security requirements of the network slice instance, respective security policies of each of the multiple network slice subnet instances of the network slice instance to be applied; and making each of the multiple network slice subnet instances have one or more security function instances configured according to the respective determined security policies. The method can be performed in a network slice layer.

[0007] In an embodiment, the method may further include: decomposing the security requirements of the network slice instance into separate security requirements corresponding to each of the multiple network slice subnet instances. The respective security policies may be determined by deriving the respective security policies based on the separate security requirements corresponding to each of the multiple network slice subnet instances.

[0008] In an embodiment, the method may further include: receiving a request for allocating a network slice instance to a service; determining the security requirements of the service; and determining the security requirements of the network slice instance based on the security requirements of the service. The method may further include: selecting a network slice network resource module for the network slice instance based on the security requirements of the network slice instance. The network slice network resource module defines a plurality of constituent network slice subnets of the network slice instance. The method may further include: sending a corresponding request to allocate the plurality of constituent network slice subnet instances to the network slice instance. Each of the corresponding requests may contain the respective security policies of the constituent network slice subnet instances.

[0009] In an embodiment, the method may further include: receiving a report or alarm indicating a security event in one of the multiple network slice subnet instances; updating a security policy of at least one of the multiple network slice subnet instances based on the security event; and causing the at least one network slice subnet instance to be updated so that a new security function instance or a reconfigured existing security function instance is provided according to the updated security policy.

[0010] In an embodiment, the one or more security function instances may include security function instances to be deployed at the edge of each network slice subnet instance.

[0011] In an embodiment, the method may further include: sending a request to create a security network slice subnet instance at the edge of the network slice instance, wherein the request includes a security policy determined according to the security requirements of the network slice instance.

[0012] In an embodiment, the one or more security function instances may include a firewall.

[0013] According to a second aspect of the present disclosure, a method is provided. The method includes receiving a request to allocate a constituent network slice subnet instance to a network slice instance, wherein the request includes a security policy to be applied to the constituent network slice subnet instance; and causing the constituent network slice subnet instance to have one or more security function instances configured according to the security policy. The security policy is determined based on the security requirements of the network slice instance. The method can be performed in a network slice subnet layer.

[0014] In an embodiment, the method may further include: checking whether the security policy is consistent with or conflicts with the security policy of another network slice instance sharing the constituent network slice subnet instance. The method may further include checking whether the security policy is consistent with or conflicts with the security policy of another constituent network slice subnet instance applied to the same network slice instance.

[0015] In an embodiment, the method may further include: selecting a network slice subnet network resource module for the constituent network slice subnet instance based on the security policy. The network slice subnet network resource module defines one or more security functions.

[0016] In an embodiment, the method may further include: monitoring the security function instance during operation of the network slice instance; determining performance or capability changes of the security function instance; and scaling inward or outward the capabilities of the security function instance based on the performance or capability changes.

[0017] In an embodiment, the method may further include: collecting security-related data of the constituent network slice subnet instances during operation of the network slice instance; determining a security event based on analysis of the security-related data; and determining a new security policy from the security event so as to configure the security function instance according to the new security policy and / or create a new security function instance. The method may further include: sending a report or alarm indicating the security event to the network slice layer.

[0018] In an embodiment, the request may be a request to update the constituent network slice subnet instance. The response may include an updated security policy to be applied to the constituent network slice subnet instance.

[0019] In an embodiment, the one or more security function instances include security function instances to be deployed at the edge of each network slice subnet instance. The one or more security function instances may include a firewall.

[0020] According to the third aspect of the present disclosure, a device is provided. The device may include at least one processor, at least one memory including computer program code, and the memory and the computer program code are configured to work together with the at least one processor so that the device: obtains the security requirements of a network slice instance; based on the security requirements of the network slice instance, determines the respective security policies to be applied to each of the multiple network slice subnet instances of the network slice instance; and provides each of the multiple network slice subnet instances with one or more security function instances configured according to the respective determined security policies.

[0021] According to a fourth aspect of the present disclosure, a device is provided. The device may include at least one processor, at least one memory including computer program code, and the memory and the computer program code are configured to work together with the at least one processor so that the device: receives a request to allocate a constituent network slice subnet instance to a network slice instance, wherein the request contains a security policy to be applied to the constituent network slice subnet instance; and enables the constituent network slice subnet instance to be provided with one or more security function instances configured according to the security policy. The security policy is determined based on the security requirements of the network slice instance.

[0022] According to a fifth aspect of the present disclosure, a computer-readable storage medium is provided, on which instructions are stored. When the instructions are executed by at least one processor, the instructions cause the at least one processor to perform the method according to the first aspect and / or the second aspect.

[0023] According to a sixth aspect of the present disclosure, a computer program product comprising instructions is provided. When the instructions are executed by at least one processor, the instructions cause the at least one processor to perform the method according to the first aspect and / or the second aspect.

[0024] These and other objects, features and advantages of the present disclosure will become apparent from the following detailed description of illustrative embodiments thereof, which description should be read in conjunction with the accompanying Figure 1 Start reading. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Some example embodiments will now be described with reference to the accompanying drawings, in which:

[0026] Figure 1 An exemplary architecture for network slice management and orchestration in which embodiments of the present disclosure may be implemented is shown;

[0027] Figure 2An exemplary process of creating and configuring a security function instance for a network slice according to an embodiment of the present disclosure is shown;

[0028] Figure 3 An exemplary process of adjusting security function instances for a network slice according to an embodiment of the present disclosure is shown;

[0029] Figure 4 An exemplary system according to an embodiment of the present disclosure is shown, wherein a security function instance is configured at the edge of a corresponding network slice subnet instance;

[0030] Figure 5 An exemplary system according to an embodiment of the present disclosure is shown, wherein separate security function instances are configured at the edge of a network slice instance;

[0031] Figure 6 The capability of a security function instance according to an embodiment of the present disclosure to prevent network attacks at the edge of a network slice instance is shown;

[0032] Figure 7 is a flowchart depicting a method according to an embodiment of the present disclosure;

[0033] Figure 8 is a flowchart depicting a method according to an embodiment of the present disclosure; and

[0034] Fig. 9 is a simplified block diagram of an apparatus according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0035] Embodiments of the present disclosure are described in detail with reference to the accompanying drawings. It should be understood that the discussion of these embodiments is only to enable those skilled in the art to better understand the present disclosure and therefore implement the present disclosure, rather than suggesting any limitation to the scope of the present disclosure. Mentioning features, advantages or similar language throughout this specification does not mean that all features and advantages that can be implemented by the present disclosure should be or exist in any single embodiment of the present disclosure. On the contrary, the language of mentioning features and advantages is understood to mean that specific features, advantages or characteristics related to the embodiment are included in at least one embodiment of the present disclosure. In addition, the described features, advantages and characteristics of the present disclosure can be combined in one or more embodiments in any suitable manner. Those skilled in the relevant art will recognize that the present disclosure can also be practiced in the absence of one or more of the specific features or advantages of a particular embodiment. In other cases, additional features and advantages can be recognized in certain embodiments, and these features and advantages may not be present in all embodiments of the present disclosure.

[0036] The present disclosure is directed to preventing network attacks in network slices by deploying and configuring security function instances in the constituent network slice subnet instances. Different UE groups of users from different vertical industries that share network resources via network slices will require different levels of security protection. The security policies / rules of the associated security functions, such as data filtering in a firewall (e.g., at the edge of the core network), can be different and can be changed dynamically. Therefore, it is recommended to dynamically configure security policies / rules for security functions in order to support automatic protection against network attacks.

[0037] Security functions deployed in the constituent NSSIs (network slice subnet instances) of a network slice instance, such as in a CNNSSI or even at a UPF (User Plane Function), should not be managed individually. Instead, the security functions in each NSSI should be aware of the security status of other NSSIs (e.g., AN NSSI, TN (Transport Network) NSSI) to avoid inconsistencies between different NSSIs. For example, data filtering policies / rules in a firewall deployed for an NSSI may be inconsistent or even conflicting with the policies / rules of other constituent NSSIs. In addition, the deployment and configuration of security functions in each NSSI should be aware of the security considerations in the service profile of the network slice.

[0038] Therefore, the present disclosure considers deploying and operating security functions (e.g., firewalls) from a holistic perspective, for example, a holistic perspective on edge protection, to prevent network attacks at the NSS domain of a network slice. For example, in this way, network attacks on the CN NSSI via interface N6 and network attacks on other NSSIs (e.g., AN NSSI, TN NSSI) can be effectively prevented jointly.

[0039] Figure 1An exemplary architecture for network slice management and orchestration is shown, in which embodiments of the present disclosure may be implemented. The architecture 100 for network slice management and orchestration includes a network slice management function (NSMF) 120 and a network slice subnet management function (NSSMF) 130. The NSMF 120 operates in the network slice (NS) layer, which is for functions and operations related to network slicing. The NSMF 120 is responsible for the management and orchestration of network slice instances (NSIs), deriving network slice subnet-related requirements from network slice-related requirements; and communicating with the NSSMF 130 and the communication service management function (not shown). For example, as indicated in 3GPP TS23.501, a network slice (NS) refers to a logical network that provides specific network capabilities and network characteristics to support various service properties of network slice customers. A network slice instance (NSI) is an instance of a network slice. A network slice instance includes a set of network function instances and the resources (e.g., computing, storage, and networking resources) required to form a deployed network slice.

[0040] The functionality of the NSMF 120 may be distributed into a plurality of functional entities, for example, including NS orchestration 124, NS resource modeling 125, NS instance inventory 126, NS management 121, NS data collection 122, and NS data analysis 123. The NS orchestration 124 may be configured to receive a request for network slice allocation resources having certain characteristics (e.g., a service profile including parameters such as network slice type (e.g., eMBB), priority, bandwidth, latency, throughput, maximum number of UEs, etc.) from the network slice consumption portal 110. The NS orchestration 124 may map the received request to an appropriate resource module (e.g., chained network slice subnet) and network slice subnet requirements (e.g., network slice profile, network slice subnet type (e.g., radio access network eMBB (enhanced mobile broadband), core network eMBB), priority, bandwidth, latency, throughput, maximum number of UEs), so as to meet the requirements of the requested network slice service. NS orchestration 124 may decide to allocate the request for the allocated resources for the network slice to an existing network slice instance or whether to create a new network slice instance by checking the active network slice instances from the NS instance inventory 126. If there is no active network slice instance for the requested network slice service, then NS orchestration 124 knows the linked network slice subnets (e.g., NSS_a and NSS_b) and then sends the request for the allocated resources for the network slice subnets separately to the corresponding NSS orchestrations (e.g., NSS_a and NSS_b). NS coordination 124 may receive a confirmation response for the allocation of the network slice subnet instance from the corresponding NSS orchestration (e.g., NSS orchestration 134 of NSS_a) and confirm the allocation of the network slice instance to the network slice consumption portal 110.

[0041] NS resource modeling 125 can be configured to store a network slice resource model that describes static parameters and functional components of a network slice, including service profiles, network slice types (e.g., eMBB), additional system features (e.g., multicast, edge computing), and priorities. NS instance inventory 126 is configured to store information about available network slice instances.

[0042] NS management 121 may be configured to support the following operations of network slice instances: activation, supervision, performance reporting (e.g., for KPI monitoring), resource capacity planning, and modification. NS data collection 122 may be configured to collect network data (e.g., data related to services, network slices, network slice subnets, and / or network functions) to support improving network performance and efficiency to adapt to and support the diversity of services and requirements. NS data analysis 123 may be configured to perform analysis using the collected network data to assist and supplement management services for optimal network performance and service assurance.

[0043] The NSSMF 130 operates in the network slice subnet (NSS) layer, which is for functions and operations related to the network slice subnet. The NSSMF 130 is responsible for the management and coordination of the NSSI and communicates with the NSMF 120. For example, as indicated in 3GPP TS28.530, a network slice subnet (NSS) is a representation of the management aspects of a set of management functions and required resources (such as computing, storage, and networking resources). A network slice subnet instance (NSSI) refers to an instance of a network slice subnet. A network slice may consist of several network slice subnets. Such network slice subnets may also be referred to as constituent network slice subnets of a network slice. A network slice subnet is created on a network slice subnet domain, such as an access network, a transport network, and a core network, and such a network slice subnet consists of connected subnets. A domain is a group of networks and network functions that are managed as units with common rules and procedures. NSI typically covers multiple technical domains, which may include terminals, access network (AN), transmission network (TN) and core network (CN), as well as the data center (DC) domain that hosts third-party applications from vertical industries.

[0044] The functionality of the NSSMF 130 may be distributed into a plurality of functional entities, which may include, for example, NSS orchestration 134, NSS resource modeling 135, NSS instance inventory 136, NSS management 131, NSS data collection 132, and NSS data analysis 133. The NSS orchestration 134 may be configured to receive a request for allocation of resources for a network slice subnet and map the received request to an appropriate resource module of the "NSS resource module" (e.g., a chained lower-layer network slice subnet, a list of managed network functions and their configuration parameters, network services in the case of virtualization, etc.). The NSS orchestration 134 may be further configured to decide whether to allocate the request for allocation of resources for a network slice subnet to an existing network slice subnet instance, or whether to create a new network slice subnet instance, by checking the active network slice subnet instances from the NSS instance inventory 136. If there is no active network slice subnet instance, the NSS orchestration 134 sends a request for allocation resources for the network service to a related functional entity (not shown), such as NFV-MANO (Network Function Virtualization Management and Orchestration), in preparation for virtualized resources to be provided. Thus, the NSS orchestration 134 may receive a confirmation response of the network service instance allocation, for example from the NFV-MANO, and confirm that the network slice subnet instance is allocated to the NSMF 120.

[0045] The NSS resource modeling 135 may be configured to store a network slice subnet resource model, which describes static parameters and functional components of the network slice subnet, including a network slice subnet profile, a network slice subnet type (e.g., radio network eMBB, core network eMBB), additional system features (e.g., multicast, edge computing), priority, QoS attributes (e.g., bandwidth, latency, number of subscribers), etc. The NSS instance inventory 136 may be configured to store information about available network slice subnet instances.

[0046] NSS management 131 may be configured to support the following operations of network slice subnet instances: activation, supervision, performance reporting (e.g., for KPI monitoring), resource capacity planning, and modification. NSS data collection 132 may be configured to collect network data (e.g., data related to network slices, network slice subnets, network services, and / or network functions) to support improved network performance and efficiency to accommodate and support the diversity of services and requirements. NSS data analysis 133 may be configured to utilize the collected network data to perform analysis in order to assist and supplement management services for optimal network performance and service assurance.

[0047] The present disclosure proposes to enhance security orchestration (including policy enforcement) in the network slice layer to support security protection related policies, such as traffic filtering policies at the edge of the network slice subnet domain. The present disclosure further introduces a security controller in the network slice subnet layer for collaborative prevention of network attacks in multiple NSS domains. Figure 2 An exemplary process 200 for creating and configuring a security function instance for a network slice according to an embodiment of the present disclosure is shown. Process 200 is performed during a phase of preparing and creating an end-to-end NSI for a service. As shown in operation 210, security requirements for the service may be determined. These security requirements may be defined as part of a service level specification, which includes a set of service level requirements associated with a service level agreement to be satisfied by a network slice instance. In an example, a service profile for a service includes various requirements for the service, such as requirements for data speed, quality, latency, security, etc., which are indicated by corresponding attributes. The security requirements for the service may be determined from the attributes of security, for example, an attribute parameter may be set to indicate that security protection is required at the edge of the network slice. Alternatively or in addition, the security requirements for the service may be determined based on a security baseline for the service type, such as IoT, healthcare, gaming, etc. For example, the security baseline may be a default security control defined based on network threats and corresponding security policies. As an alternative, a consumer of the network slice may set security requirements in the service profile.

[0048] At least from the security requirements of the service, the security requirements of the NSI can be derived, as shown in 220. For example, a service profile including requirements for data speed, quality, latency, security, etc., can be converted into a slice profile (e.g., data speed, quality, latency, security protection requirements, etc.) by a management function entity (e.g., NSMF) in the network slice layer, together with corresponding attributes. Therefore, a security requirement with security attributes in the service profile (e.g., security protection at the edge of the network slice) can be converted into a security requirement of a network slice instance with security protection requirement attributes, such as a firewall.

[0049] At operation 230, appropriate network slice resource modules are selected to prepare for the creation of an NSI that meets the exported security requirements. The resource modules include multiple NSSs, such as an AN (access network) NSS, a TN (transport network) NSS, a CN (core network) NSS, or other NSSs for specific functions or services, such as a network protection-specific NSS, an NSS for VoIP (Voice over Internet Protocol) or an IMS (IP Multimedia Subsystem). In this regard, information from the service profile can be used to determine the topology of the NSSI and the NSI to be created, which information may include security requirements for the NSI and other types of requirements for the NSI. In the example, the selection of the network slice resource module can be further based on the security baseline of the service and the network topology.

[0050] At operation 240, based on the security requirements of the NSI, a security policy of each of the multiple constituent NSSIs of the NSI is determined. In this regard, the security requirements of the NSI may be decomposed into resource requirements of the multiple constituent NSSIs so as to derive the security policy of each constituent NSSI. The security policy of each constituent NSSI may be reflected in the NSS service / slice profile. The security policy of each constituent NSSI (e.g., a general data filtering rule) is derived from an aspect of the entire NSI. Therefore, those security policies of each constituent NSSI may be interrelated to deploy and configure security functions in each NSS domain, and further cooperate and collaborate to support the security requirements of the entire NSI. In addition, the security policies of the constituent NSSIs supporting one NSI are determined to ensure that they are consistent and complete. For example, there is no need to repeatedly prevent / block the same network attack in each NSS domain (e.g., AN NSS, CN NSS, TN NSS). It is sufficient to deploy security functions for one network attack in one appropriate NSS domain. In this way, network attacks can be prevented or blocked with high performance, and the overhead on the NSS domain can be reduced.

[0051] There are examples to explain how to derive security policies for each constituent NSSI in the slice layer. Based on a service profile with security attributes indicating security protection at the edge of the network slice, the management function entity in the network slice layer can convert the service profile into a slice profile (e.g., data speed, quality, latency, security protection requirements, etc.) with attributes of security protection requirements (e.g., firewall). The management function entity can then select a network slice resource model, for example, which includes AN NSS, TN NSS, and CN NSS, and thus prepare to create an NSI. For example, the derived security policy for each constituent NSSI can be a corresponding traffic filtering function deployed at the edge of the corresponding NSS domain, as shown below.

[0052] The management function entity can define data filtering policies to prevent DDoS attacks from IoT devices for the ANSS domain;

[0053] The management function entity can define data filtering policies to protect the CN NSS domain from attacks from the Internet; and

[0054] The management functional entity can define data filtering policies to direct traffic for the TN NSS domain.

[0055] Then, the management function entity may request the corresponding NSSMF to separately create the constituent NSSIs, as shown at 250. For example, the NSMF may send a request to each NSSMF of each NSS domain of the constituent NSSI to allocate network resources to create an NSSI that supports the corresponding security policy. The request may include NSS-related requirements, which include the corresponding security policy.

[0056] For each constituent NSSI, the NSSMF in the corresponding NSS domain may select an appropriate NSS network resource model based on NSS-related requirements including the corresponding security policy, as shown at 260. The NSSI may then be created to support the corresponding security policy, as shown at 270. The NSSI may include one or more security function instances (e.g., firewalls) or security NSSIs (e.g., firewall NSSIs), which are configured according to the security policy to protect the corresponding NSS domain. In some embodiments, the NSSI or security function is shared by multiple network slice instances, or the security function is associated with other constituent NSSIs of the same network slice instance. In this case, it is important to check whether the security function has a negative impact on other related network slices or related NSSIs.

[0057] In some embodiments, based on NSS-related requirements including corresponding security policies, the NSSMF may determine to reuse an existing NSSI. The NSSMF may then trigger an update or modification of the existing NSSI to satisfy the NSS-related requirements including the corresponding security policies. The configuration of the corresponding security function instance may be updated according to the security policy. When updating or modifying an existing NSSI, it is important to check whether the security policy has a negative impact on the existing NSSI serving other network slices or services.

[0058] In some embodiments, security function instances include firewalls deployed at the edge of the NSS domain. Through the firewalls in each constituent NSSI, network attacks can be successfully prevented / blocked at the edge of all NSS domains. Therefore, network attacks can be prevented / blocked at the edge of the network slice domain of the NSI.

[0059] In some embodiments, a separate security NSSI may be created and deployed at the edge of an NSI or its constituent NSSIs to support the security requirements of the NSI. For example, the security requirements of the NSI may all be translated into the requirements of the security NSSI. The security NSSI may detect and prevent / block network attacks on the entire NSI. The details of this scenario will be referred to later. Figure 5 and Figure 6 describe.

[0060] Reference now Figure 3 , which shows an exemplary process for adjusting security function instances for network slice instances. During the end-to-end NSI operation stage, security policies / rules are enforced by security function instances in each NSS domain. For example, a firewall can enforce corresponding security policies / rules at the edge of each NSS domain. As shown in 310, the security function instances in a constituent NSSI of a network slice can be monitored by a management function entity in the NSS layer (e.g., a security controller or a corresponding NSSMF).

[0061] In some embodiments, the management function entity may detect performance and / or capability changes of security function instances, as shown at 320. When performance and / or capability changes are detected, the management function entity may cause the security function to be scaled out / in according to the performance or capability changes of the NSSI, as shown at 330. For example, when the data rate suddenly increases, it may be detected that the capacity of the firewall at the edge of the NSS domain is insufficient. The management function entity may cause the NSSMF in the NSS domain to reallocate network resources and deploy additional firewalls at the edge of the NSS domain.

[0062] In some embodiments, the management function entity may detect new security events based on security data analysis during the operation of the NSI as shown in 340, and respond to the new security events dynamically and automatically at 350. More specifically, in the example, in response to the detection of new security events, the configuration of existing security functions may be updated to handle new security events, as shown in 351. For example, when a new network attack is detected, the NSSMF may check its security policy and find that the security policy of the security function (e.g., a firewall) cannot prevent the detected new network attack. Then, the NSSMF may configure the deployed security functions with the new security policy. Afterwards, the security function may execute the latest configured policy to prevent new network attacks.

[0063] In another example, in response to detection of a new security event, the NSSMF may be triggered to deploy a new security function (e.g., a firewall) to handle the new security event, as shown at 352. For example, if a new network attack is detected, and if the existing firewall cannot prevent the new network attack, a new enhanced firewall may be deployed.

[0064] In another example, in response to the detection of a new security event, the management function entity in the NSS layer may send an alarm or report to the NS layer, or escalate the new security event to the NS layer, as shown in 353, for example, when it cannot handle the new security event. In response, the management function entity in the NS layer may trigger an update of the constituent NSSI of the NSI, as shown in 360. In this regard, the security policies for the constituent NSSIs may be adjusted to collaboratively handle new security events. For example, the security policies of the NSSI that reports the new network attack and / or other associated NSSIs of the NSI may be updated. In the example, an existing NSSI may be updated or a new NSSI may be created to prevent / block new network attacks. The update of the constituent NSSI of the NSI may be performed with reference to operations 240-270.

[0065] Reference now Figure 4 , which shows an exemplary system 400 according to an embodiment of the present disclosure, wherein security function instances are configured at the edge of the NSSI. The process for creating and configuring security function instances at the edge of the NSS domain to prevent network attacks can be described as follows.

[0066] In the first stage, the NSMF 420 receives a request from the network slice consumption portal 410 to create a network slice instance for a service. For example, the service may be an IoT service, a game, healthcare, etc. The request may include a service profile that specifies the requirements of the service (such as data speed, quality, latency, security, etc.) and corresponding attributes. In particular, the service profile includes security requirements for the service and corresponding security attributes. In the example, the security attributes indicate that security protection is required at the edge of the network slice. In some embodiments, the security requirements may be raised by a consumer of the network slice. For example, the security requirements may be determined by negotiation between the consumer and the provider / operator of the network slice. In some embodiments, the security requirements may be obtained by the NSMF 420 from a security baseline (e.g., security controls defined based on network threats and corresponding security policies) of the service type (e.g., IoT, healthcare, gaming) requesting the service.

[0067] The service profile (e.g., data speed, quality, latency, security, etc.) may be transferred to the slice profile (e.g., data speed, quality, latency, security requirements, etc.). In some embodiments, a management function entity, such as security orchestration (SecO) 421, may be arranged in the network slice layer to transfer the service-level security requirements defined in the service profile to the slice-level security requirements, and then maintain the service profile as the slice-level security requirements in the slice profile of the end-to-end NSI. Figure 4 As shown, SecO 421 may be separately deployed outside NSMF 420. However, it should be understood that SecO 421 is a logical function and may be deployed as a single component inside NSMF 420, or distributed in one or more existing components in NSMF 420. In the example, NSMF 420 calls SecO 421 to convert the security attributes of the service profile (e.g., security protection at the edge of the network slice) into the security requirements of the slice profile (e.g., firewall).

[0068] Next, in the second phase, based on the network slice network resource model (e.g., AN NSS, TN NSS, and CN NSS) and the slice profile (e.g., data speed, quality, latency, security requirements, etc.), NSMF 420 sends requests to the corresponding NSSMFs (e.g., AN NSSMF 432, TN NSSMF 433, and CN NSSMF 434) for AN NSS, TN NSS, and CN NSS separately to create corresponding NSSIs (e.g., AN NSSI 442, TN NSSI 443, and CN NSSI 444) that have protection at the edge of their respective NSS domains (AN NSS domain, TN NSS domain, and CN NSS domain) to prevent network attacks. The request may contain security policies for the corresponding NSSs, which are derived from the security requirements defined in the slice profile. For example, SecO 421 may define a data filtering policy for the corresponding NSSI at the edge of the corresponding NSS domain as follows:

[0069] AN NSS domain: DDoS (distributed denial of service) protection, carrier-grade NAT (network address translation), QoS (quality of service) policy enforcement, L7 inspection, traffic steering, etc.

[0070] TN NSS domain: traffic steering, QoS policy enforcement, etc.; and

[0071] CN NSS domain: traffic steering, application layer gateway, carrier-grade NAT, DDoS protection, L7 inspection, QoS policy enforcement, etc.

[0072] In some embodiments, security functions can be deployed through a dedicated security (e.g., firewall) NSS. A dedicated security NSSI can be created to prevent network attacks at the edge of the network slice instance.

[0073] In the third stage, in each NSS domain, the corresponding NSSMF may create an NSSI based on the NSS network resource model and security policy in the received request, where security functions (e.g., firewalls) are deployed at the edge of the NSSI domain. In some embodiments, a management function entity (such as a security controller (SecC)) may be implemented in the network slice subnet layer to manage or configure security functions in each NSS domain. Figure 4 As shown, SecC 431 (such as a firewall manager) can be deployed as a separate functional entity outside each NSS domain and can control security functions in multiple NSS domains. It should be noted that SecC 431 is a logical function that can be deployed as an independent functional entity at the NSS layer, or separately deployed at each NSS domain, or deployed as part of each NSSMF.

[0074] In an example, AN NSSMF 432, with the assistance of firewall manager 431, may create AN NSSI 442, where security functions (e.g., firewall 451 and firewall 452) are deployed at the edge of the domain of AN NSSI 442. Firewall manager 431 may be triggered to configure firewall policies for firewall 451 and firewall 452 according to the security policy defined for AN NSSI 442. For example, firewall 451 may be configured to enforce DDoS protection, carrier-grade NAT, QoS policy enforcement, and traffic steering; and firewall 452 may be configured to perform carrier-grade NAT.

[0075] With the assistance of firewall manager 431, TN NSSMF 433 may create TN NSSI 443, where security functions (e.g., firewall 453 and firewall 454) are deployed and configured at the edge of the TN NSS domain in the same manner. For example, firewall 453 and firewall 454 may be configured to perform traffic steering and QoS policy enforcement according to the security policy defined for TN NSSI 443. Similarly, CN NSSMF 434 may create CN NSSI 444, where security functions (e.g., firewall 455 and firewall 456) are deployed and configured at the edge of the CN NSS domain. According to the security policy defined for CN NSSI 444, firewall 455 may be configured to perform carrier-grade NAT, and firewall 456 may be configured to perform, for example, traffic steering, application layer gateway, carrier-grade NAT, DDoS protection, L7 inspection, QoS policy enforcement, IPS, and AV.

[0076] When the NSSMF creates a constituent NSSI for a network slice in which a security function (e.g., a firewall at the edge of the NSSI domain) is deployed, the firewall manager 431 may check to confirm that it does not cause any negative impact on other related network slices or other related NSSIs. In this regard, the firewall manager 431 may maintain a security policy (e.g., a firewall policy) for each network slice instance and check whether the security policy of the constituent NSSI (e.g., a data filtering policy / rule applied to the firewall) is consistent with or conflicts with the security policy (e.g., data filtering policy / rule) applied to other network slice instances (e.g., for other network slice services) that share the NSSI. Alternatively or additionally, the firewall manager 431 may check whether the security policy of the constituent NSSI is consistent with or conflicts with the security policy of other constituent NSSIs applied to the same network slice instance. For example, if the data filtering policy / rule of one NSSI is inconsistent or conflicts with the policy / rule of other related NSIs and / or other related NSSIs, the firewall manager 431 may deploy a physical security function (e.g., a firewall) or a virtualized security function (e.g., a virtual firewall) specifically for the newly created NSSI. In this way, negative impact on other network slice instances or other NSSIs can be avoided.

[0077] The requested NSI 430 can then be created with the capability to prevent network attacks against inter-NS (network slice) communications and intra-NS communications, as well as effectively prevent network attacks at the edge of the network slice (e.g., interface N6 between the CN NSS domain and the Internet 460).

[0078] like Figure 4, security policies may be enforced by six firewalls running at the edge of the domains of AN NSSI 442, TN NSSI 443, and CN NSSI 444 to prevent network attacks during operation of the end-to-end NSI 430. In order to monitor the security status of the NSI 430, security data may be collected and analyzed. Based on the security data analysis, some new network attacks may be detected, for example, by using normal techniques. The details of detecting new network attacks based on security data analysis are not the focus of this disclosure.

[0079] When a new network attack is detected at the edge of an NSS domain, the NSSMF of the NSS domain can be notified to take some actions to prevent the new network attack. Figure 4 When a new attack is detected in the data flow between CN NSSI 444 and Internet 460, CN NSSMF 434 will be notified to take some actions as follows.

[0080] In some embodiments, firewall manager 431 or the logical firewall management function of the CN NSS may examine the firewall policy applied to firewall 456 and find that the firewall policy cannot prevent the detected new network attack. Firewall manager 431 or the logical firewall management function of the CN NSS may then reconfigure firewall 456 with new or additional firewall policies. Thereafter, firewall 456 enforces the latest configured policy to prevent the new network attack.

[0081] In some embodiments, the firewall manager 431 or the logical firewall management function of the CN NSS may check the firewall policy applied to the firewall 456 and find that the existing firewall policy cannot prevent the detected new network attack. Then, the firewall manager 431 or the logical firewall manager function of the CN NSS may trigger the deployment of a new firewall to mitigate the risk. In some cases, the firewall manager 431 or the logical firewall management function of the CN NSS does not know how to prevent the new network attack. At this time, the firewall manager 431 or the logical function firewall manager of the CN NSS may send an alarm to SecO 421. SecO 421 may know how to prevent the new network attack, and then trigger NSMF 420 to reallocate network resources and update the security policy of the associated NSSI to cooperate with the firewall 456. For example, the associated NSSI may be TN NSSI443 or a dedicated security NSSI. This means that the constituent NSSIs of NSI 430 will be updated. Otherwise, if SecO 421 may not know how to prevent the new network attack, SecO 421 may send an alarm to a higher-level administrator. This means that NSMF420 will update NSI 430.

[0082] In some embodiments, firewall manager 431 or the logical firewall management function of CN NSS may find that the existing firewall policy in firewall 456 is sufficient to prevent network attacks at the edge of the CN NSSI domain. However, at the edge of the CN NSSI domain, the data rate suddenly increases, and the capacity of firewall 456 is insufficient for data filtering. At this time, firewall manager 431 or the logical firewall management function of CN NSS can trigger CN NSSMF 434 to deploy additional firewalls at the edge of the CN NSSI domain and cooperate with firewall 456 for data filtering. This means that CN NSSI 444 is updated.

[0083] Reference now Figure 5 , which shows an exemplary system according to an embodiment of the present disclosure, in which separate security function instances are configured at the edge of a network slice instance. In some cases, it can be assumed that the communication between the various domains that make up the NSSI of the NSI is secure. Therefore, separate security function instances can be deployed only at the edge of the NSI.

[0084] For example, an enterprise may request a separate NSI 530 for its corporate services. NSI 530 may be composed of AN NSSI 542, TN NSSI 543, and CN NSSI 544. It should be noted that NSI 530 may be composed of other NSSI combinations. For example, NSI 530 may be composed of TN NSSI and CN TSSI. In the example, it may be assumed that the communication between the AN NSS domain and the TN NSS domain, and the communication between the TN NSS domain and the CN NSS domain are secure. Therefore, there is no need to deploy security functions at the edge between AN NSSI 542 and TN NSSI 543, and at the edge between TN NSSI 543 and CN NSSI 544. It may also be assumed that the base station is deployed in an office park and that the radio access is secure. Therefore, there is no need to deploy security functions at the edge of AN NSSI 542 between ANNSSI 542 and the UE. However, when users of NSI 530 access Internet 560 or the network for services 570 and 580, the communication between the CN NSSI domain and Internet 560 or the network for services 570 and 580 is not secure. Therefore, it is very important to prevent network attacks at this edge of NSI 530.

[0085] like Figure 5As shown, a separate security NSSI 545 can be created and deployed at the edge of the NSI 530 to automatically prevent network attacks from different services and different network layers. During the preparation and creation of the SEC NSSI 545, the NSMF 520 can request the SEC NSSMF 535 to allocate the SEC NSSI 545 to protect the Internet / service interface of the NSI 530 according to the security requirements included in the service / slice profile. The SEC NSSMF 535 can create or reuse the SEC NSSI 545 to meet the security requirements of the NSI 530 received from the NSMF 520. In the example, the SEC NSSMF 535 can decompose the security requirements into security functions and policies for each security function. The security functions can then be deployed and configured according to the corresponding policies. For example, a firewall manager or a logical firewall management function can be deployed in the SEC NSSMF 535 to decompose the requirements into firewalls and firewall policies, and then deploy the firewalls and configure the corresponding policies on the firewalls. SEC NSSI 545 may be allocated prior to allocation of AN NSSI 542 , TN NSSI 543 , and CN NSSI 544 .

[0086] During runtime, security function instances in SEC NSSI 545 can perform ingress / egress data based on corresponding security policies and report security status and related security events. SEC NSSMF 535 can be triggered to update or extend security functions, such as based on changes in security requirements, network capabilities, or security posture.

[0087] SEC NSS can have the ability to prevent network attacks from different services and different network layers, such as Figure 6 As shown. For example, the firewall manager of the SEC NSSMF 535 may deploy and configure security functions "security gateway" and "firewall" for service A, deploy and configure another security function "firewall" for service B, and deploy and configure a security function "WAF (network application firewall)" for service C (e.g., Internet service). The SEC NSSI 545 may filter data of different services or network layers through corresponding security functions by identifying data based on corresponding identifiers (e.g., service identifier, user identifier, network slice identifier, and / or network slice subnet identifier, etc.).

[0088] Reference now Figure 7 , which shows a flow chart of a method according to an embodiment of the present disclosure. The method may be performed at a network slice layer, for example by Figure 4 and Figure 5SecO 421, NSMF420, SecO 521, and NSMF 520 are executed as shown.

[0089] As shown in box 710, the process 700 continues to obtain the security requirements of the network slice instance. At box 720, the process 700 continues to determine the respective security policies to be applied to each of the multiple component network slice subnet instances of the network slice instance based on the security requirements of the network slice instance. The security requirements of the network slice instance can be decomposed into separate security requirements corresponding to each of the multiple component network slice subnet instances. Thus, the respective security policies can be derived based on the separate security requirements corresponding to each of the multiple component network slice subnet instances. At box 730, the process 700 continues so that each of the multiple component network slice subnet instances has one or more security function instances configured according to the respective determined security policies. Therefore, the security policy of each component network slice subnet instance can be deployed from a holistic perspective, that is, from a holistic perspective with respect to the protection of the network slice instance.

[0090] In some embodiments, process 700 is performed during the creation of a network slice instance. Process 700 may further include: receiving a request to allocate a network slice instance for a service; determining the security requirements of the service; and determining the security requirements of the network slice instance based on the security requirements of the service. A network slice network resource module may be selected for the network slice instance based on the security requirements of the network slice instance. Based on the selected network slice network resource module, a new network slice instance is created or an existing network slice instance is reused. The network slice network resource module defines multiple constituent network slice subnets of the network slice instance. Based on the selected network slice network resource module, a new network slice instance may be created, or an existing network slice instance may be reused for the service.

[0091] Process 700 may further include sending a corresponding request to allocate multiple constituent network slice subnet instances to the network slice instance. Each of the corresponding requests may include a respective security policy of the corresponding constituent network slice subnet instance. In an example, for example, a request may be sent to a corresponding NSSMF to create or reuse at least one network slice subnet instance from the multiple constituent network slice subnet instances. The request may include a respective security policy determined for the at least one network slice subnet instance.

[0092] In some embodiments, process 700 may be performed during operation of a network slice instance. In an example, process 700 may further include: updating security requirements of the network slice instance and further updating the network slice instance. A request may then be sent to update at least one network slice subnet instance of a plurality of constituent network slice subnet instances. The request includes a security policy determined for at least one network slice subnet instance.

[0093] In another example, process 700 may further include: receiving a report or alarm indicating a security event in one of a plurality of constituent network slice subnet instances; and updating the security requirements of the network slice instance based on the security event. The security policy of at least one of the plurality of constituent network slice subnet instances may be updated based on the security event. Then, process 700 may enable one or more security function instances configured according to the updated security policy to update at least one network slice subnet instance. A request to update at least one network slice subnet instance may be sent, for example, to a corresponding NSSMF of at least one network slice subnet instance. The request may include a security policy determined for at least one network slice subnet instance. The network slice subnet instance to be updated may be different from the network slice subnet instance reporting the security event.

[0094] In some embodiments, security function instances may be deployed at the edge of each network slice subnet instance. In some embodiments, a secure network slice subnet instance is deployed at the edge of a network slice instance to support the security requirements of the network slice instance. Process 700 may further include sending a request to create a security network slice subnet instance. The request may include a security policy to be applied to the secure network slice subnet instance. The security policy is determined based on the security requirements of the network slice instance.

[0095] Figure 8 is a flow chart depicting a method according to an embodiment of the present disclosure. The method may be performed at a network slice subnet layer, for example, by Figure 4 , Figure 5 and Figure 6 SecC 431, 531 and Firewall Manager execution shown.

[0096] As shown in block 810, process 800 continues to receive a request to allocate a constituent network slice subnet instance to a network slice instance. The request includes a security policy to be applied to the constituent network slice subnet instance. At block 820, process 800 continues to cause the constituent network slice subnet instance to have one or more security function instances configured according to the security policy. The security policy is determined based on the security requirements of the network slice instance.

[0097] The process 800 may further include checking whether the security policy is consistent with or conflicts with the security policy of another network slice instance that shares the constituent network slice subnet instance, as shown in block 830. Alternatively or additionally, the process 800 may further include checking whether the security policy is consistent with or conflicts with the security policy of another constituent network slice subnet instance applied to the same network slice instance. If the security policy is consistent with the security policy of another network slice instance or another constituent network slice subnet instance, it may be determined that the security function instance may be deployed.

[0098] In some embodiments, process 800 may further include: selecting a network slice subnet network resource module for a constituent network slice subnet instance based on a security policy. The network slice subnet network resource module defines one or more security functions. The request may be a request to create a new network slice subnet instance, or a request to reuse an existing network slice subnet instance. In this example, process 800 may further include causing a new network slice subnet instance to be created or an existing network slice subnet instance to be reused based on the selected NSS network resource module.

[0099] In some embodiments, process 800 may further include: monitoring the security function instance during operation of the network slice instance; determining performance or capability changes of the security function instance; and scaling out or inward the capabilities of the security function instance based on the performance or capability changes.

[0100] In some embodiments, process 800 may further include: collecting security-related data of constituent network slice subnet instances during operation of the network slice instance; and determining a security event based on an analysis of the security-related data. A new security policy may be determined based on the security event to configure a security function instance and / or a new security function instance. In some embodiments, a report or alarm indicating a security event may be sent to the network slice layer, for example, to trigger an update of one or more constituent network slice instances of the network slice instance.

[0101] Fig. 9 1 shows a simplified block diagram of an apparatus according to an embodiment of the present disclosure. Fig. 9 As shown, the apparatus 900 includes a processor 904, a memory 905, and a transceiver 901 that is operatively connected to the processor 904. The transceiver 901 includes at least one transmitter 902 and at least one receiver 903. Fig. 9 Only one processor is shown in FIG. 1 , but the processor 904 may include multiple processors or a multi-core processor. In addition, the processor 904 may also include a cache to facilitate processing operations. Figure 2 , Figure 3 , Figure 7 and 8 For the sake of brevity, descriptions of some identical or similar parts are omitted here.

[0102] Computer executable instructions may be loaded into the memory 905 and, when executed by the processor 904 , cause the apparatus 900 to implement the above-described methods.

[0103] In addition, one aspect of the present disclosure can utilize software running on a computing device. Such an embodiment can employ, for example, a processor, a memory, and an input / output interface formed, for example, by a display and a keyboard. The term "processor" as used herein is intended to include any processing device, such as, for example, a processing device including a CPU (central processing unit) and / or other forms of processing circuit systems. In addition, the term "processor" may refer to more than one separate processor. The term "memory" is intended to include a memory associated with a processor or CPU, such as, for example, a random access memory (RAM), a read-only memory (ROM), a fixed memory device (e.g., a hard disk drive), a removable memory device (e.g., a floppy disk), a flash memory, etc. The processor, the memory, and the input / output interface (such as a display and a keyboard) can be interconnected, for example, via a bus that is part of a data processing unit. Appropriate interconnections, for example, via a bus, can also be provided to a network interface (such as a network card, which can be configured to interface with a computer network), and to a media interface (such as a floppy disk or CD-ROM drive, which can be configured to interface with a media).

[0104] Therefore, computer software including instructions or codes for executing the methods of the present disclosure as described herein may be stored in an associated storage device (e.g., ROM, fixed or removable memory), and when ready to be used, partially or completely loaded (e.g., into RAM) and executed by the CPU. Such software may include, but is not limited to, firmware, resident software, microcode, etc.

[0105] As previously mentioned, aspects of the present disclosure may take the form of a computer program product embodied in a computer-readable medium on which a computer-readable program code is embodied. Moreover, any combination of computer-readable media may be utilized. A computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared or semiconductor system, device or apparatus, or any suitable combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include the following: an electrical connection with one or more wires, a portable computer floppy disk, a hard disk, a RAM, a ROM, an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the context of this document, a computer-readable storage medium may be any tangible medium that may contain or store a program for use by or in connection with an instruction execution system, device or equipment.

[0106] Computer program code for performing operations of various aspects of the present invention may be written in any combination of at least one programming language, including object-oriented programming languages, such as Java, Smalltalk, C++, etc., and traditional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server.

[0107] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functions and operations of possible implementations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram may represent a module, component, fragment or part of a code, which includes at least one executable instruction for implementing (multiple) specified logical functions. It should also be noted that in some alternative implementations, the functions indicated in the box may not occur in the order indicated in the accompanying drawings. For example, depending on the functions involved, two boxes shown in succession may actually be executed substantially simultaneously, or boxes may sometimes be executed in reverse order. It should also be noted that each box of the block diagram and / or flowchart and the combination of boxes in the block diagram and / or flowchart can be implemented by a system based on special purpose hardware that performs a specified function or action or performs a combination of hardware and computer instructions for a specific purpose.

[0108] In any case, it should be understood that the components described in the present disclosure may be implemented in various forms of hardware, software, or a combination thereof, for example, (multiple) application specific integrated circuits (ASICs), functional circuit systems, appropriately programmed general-purpose digital computers with associated memory, etc. Given the teachings of the present disclosure provided herein, a person of ordinary skill in the relevant art will be able to envision other implementations of the components of the present disclosure.

[0109] The terms used herein are only used for the purpose of describing particular embodiments and are not intended to limit the present disclosure. As used herein, the singular forms "a, an" and "the" are intended to also include plural forms unless the context clearly indicates otherwise. It will be further understood that the terms "comprises", "includes" and / or "comprising", when used in this specification, specify the presence of stated features, integers, steps, operations, elements and / or parts, but do not exclude the presence or addition of another feature, integer, step, operation, element, part and / or its group. The term "based on" should be understood as "based at least in part". The terms "one embodiment" and "embodiment" should be understood as "at least one embodiment". The term "another embodiment" should be understood as "at least one other embodiment". Other explicit and implicit definitions may be included below.

[0110] The description of the various embodiments is presented for purposes of illustration, but is not intended to be exhaustive or limited to the embodiments disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments.

Claims

1. A method for preventing network attacks in a network slice, comprising: receiving a request for allocating a network slice instance for a service; determining the security requirements of the service; Determining the security requirements of the network slice instance according to the security requirements of the service; Based on the security requirement of the network slice instance, select a network slice network resource module for the network slice instance, wherein the network slice network resource module defines a plurality of constituent network slice subnets of the network slice instance; as well as Based on the security requirements of the network slice instance, determine respective security policies to be applied to each of a plurality of constituent network slice subnet instances of the network slice instance, wherein the security requirements of the network slice instance are decomposed into resource requirements of a plurality of constituent network slice subnet instances to derive the security policy of each constituent network slice subnet instance, so that each of the plurality of constituent network slice subnet instances is provided with one or more security function instances configured according to the respective determined security policies; Wherein, for each of the constituent network slice subnet instances, an appropriate network slice subnet network resource module is selected based on the network slice subnet related requirements including the corresponding security policy to create a network slice subnet instance, wherein the network slice subnet network resource module defines one or more security functions; The method further comprises: receiving a report or an alert indicating a security event in one of the plurality of component network slice subnet instances; Updating the security policy of at least one network slice subnet instance among the multiple constituent network slice subnet instances based on the security event; and Causes the at least one network slice subnet instance to be updated so that a new security function instance or a reconfigured existing security function instance is provided according to the updated security policy.

2. The method according to claim 1, further comprising: decomposing the security requirements of the network slice instance into separate security requirements corresponding to each of the plurality of constituent network slice subnet instances, Determining the various security policies includes: deriving the various security policies based on separate security requirements corresponding to each of the multiple component network slice subnet instances.

3. The method according to claim 1 or 2, further comprising: Send corresponding requests to allocate the multiple constituent network slice subnet instances to the network slice instance, wherein each of the corresponding requests includes the respective security policies of the corresponding constituent network slice subnet instance.

4. The method according to any one of claims 1 to 3, wherein: The one or more security function instances include security function instances to be deployed at the edge of each network slice subnet instance.

5. The method according to claim 1, further comprising: Sending a request to create a security network slice subnet instance at the edge of the network slice instance, wherein the request includes a security policy determined based on the security requirements of the network slice instance.

6. The method according to any one of claims 1 to 5, wherein: Examples of the one or more security functions include a firewall.

7. The method according to any one of claims 1 to 6, wherein: The method is performed in the network slice layer.

8. A method for preventing network attacks in a network slice, comprising: Receiving a request to allocate a constituent network slice subnet instance to a network slice instance, wherein the request includes a security policy to be applied to the constituent network slice subnet instance; as well as The constituent network slice subnet instance is provided with one or more security function instances configured according to the security policy, The security policy is determined based on the security requirements of the network slice instance, the security requirements of the network slice instance are determined according to the security requirements of the service for which the network slice instance is created, and the security policy is derived based on the security requirements of the network slice instance being decomposed into resource requirements of multiple constituent network slice subnet instances; wherein, based on the security policy, a network slice subnet network resource module is selected for the constituent network slice subnet instance, and the network slice subnet network resource module defines one or more security functions; The method further comprises: collecting security-related data of the constituent network slice subnet instances during operation of the network slice instance; determining a safety event based on an analysis of the safety-related data; determining a new security policy from the security event so as to configure the security function instance and / or create one or more new security function instances according to the new security policy; monitoring the security function instance during operation of the network slice instance; determining a change in performance or capability of the security function instance; and the ability to scale in or out said security function instances according to said performance or capability changes; The one or more security functions include security function instances to be deployed at the edge of each network slice subnet instance, and the one or more security function instances include a firewall.

9. The method according to claim 8, further comprising: Check whether the security policy is consistent with or conflicts with the security policy of another network slice instance that shares the constituent network slice subnet instance.

10. The method according to claim 8 or 9, further comprising: Check whether the security policy is consistent with or conflicts with the security policy of another constituent network slice subnet instance applied to the same network slice instance.

11. The method according to claim 8, further comprising: Send a report or alert indicating the security event to the network slice layer.

12. The method according to claim 8, wherein: The request is a request to update the constituent network slice subnet instance, wherein the response includes an updated security policy to be applied to the constituent network slice subnet instance.

13. The method according to any one of claims 8 to 12, wherein: Examples of the one or more security functions include a firewall.

14. The method according to any one of claims 8 to 13, wherein: The method is performed in the network slice subnet layer.

15. An apparatus for preventing network attacks in a network slice, comprising: at least one processor; at least one memory including computer program code, the memory and the computer program code being configured to work with the at least one processor such that the apparatus: receiving a request for allocating a network slice instance for a service; determining the security requirements of the service; Determining the security requirements of the network slice instance according to the security requirements of the service; Based on the security requirement of the network slice instance, select a network slice network resource module for the network slice instance, wherein the network slice network resource module defines a plurality of constituent network slice subnets of the network slice instance; as well as Based on the security requirements of the network slice instance, determine respective security policies to be applied to each of a plurality of constituent network slice subnet instances of the network slice instance, wherein the security requirements of the network slice instance are decomposed into resource requirements of a plurality of constituent network slice subnet instances to derive the security policy of each constituent network slice subnet instance, so that each of the plurality of constituent network slice subnet instances is provided with one or more security function instances configured according to the respective determined security policies; Wherein, for each of the constituent network slice subnet instances, an appropriate network slice subnet network resource module is selected based on the network slice subnet related requirements including the corresponding security policy to create a network slice subnet instance, wherein the network slice subnet network resource module defines one or more security functions, Further, the device receiving a report or an alert indicating a security event in one of the plurality of component network slice subnet instances; Updating the security policy of at least one network slice subnet instance among the multiple constituent network slice subnet instances based on the security event; and Causes the at least one network slice subnet instance to be updated so that a new security function instance or a reconfigured existing security function instance is provided according to the updated security policy.

16. The device according to claim 15, wherein: The memory and the computer program code are configured to, together with the processor, further cause the apparatus to: decomposing the security requirements of the network slice instance into separate security requirements corresponding to each of the plurality of constituent network slice subnet instances, Wherein the respective security policies are determined by deriving the respective security policies based on the separate security requirements corresponding to each of the multiple component network slice subnet instances.

17. The device according to claim 15 or 16, wherein: The memory and the computer program code are configured to, together with the processor, further cause the apparatus to: Send corresponding requests to allocate the multiple constituent network slice subnet instances to the network slice instance, wherein each of the corresponding requests includes the respective security policies of the corresponding constituent network slice subnet instance.

18. The device according to any one of claims 15 to 17, wherein: The one or more security function instances include security function instances to be deployed at the edge of each network slice subnet instance.

19. The device according to claim 18, wherein: The memory and the computer program code are configured to, together with the processor, further cause the apparatus to: Sending a request to create a security network slice subnet instance at the edge of the network slice instance, wherein the request includes a security policy determined based on the security requirements of the network slice instance.

20. The device according to any one of claims 15 to 19, wherein: Examples of such security features include firewalls.

21. An apparatus for preventing network attacks in a network slice, comprising: at least one processor; at least one memory including computer program code, the memory and the computer program code being configured to work with the at least one processor such that the apparatus: Receiving a request to allocate a constituent network slice subnet instance to a network slice instance, wherein the request includes a security policy to be applied to the constituent network slice subnet instance; as well as The constituent network slice subnet instance is provided with one or more security function instances configured according to the security policy, The security policy is determined based on the security requirements of the network slice instance, the security requirements of the network slice instance are determined according to the security requirements of the service for which the network slice instance is created, and the security policy is derived based on the security requirements of the network slice instance being decomposed into resource requirements of multiple constituent network slice subnet instances; causing the device to select a network slice subnet network resource module for the constituent network slice subnet instance based on the security policy, the network slice subnet network resource module defining one or more security functions; Further, the device collecting security-related data of the constituent network slice subnet instances during operation of the network slice instance; determining a safety event based on an analysis of the safety-related data; determining a new security policy from the security event so as to configure the security function instance and / or create one or more new security function instances according to the new security policy; monitoring the security function instance during operation of the network slice instance; determining a change in performance or capability of the security function instance; and the ability to scale in or out said security function instances according to said performance or capability changes; The one or more security functions include security function instances to be deployed at the edge of each network slice subnet instance, and the one or more security function instances include a firewall.

22. The device according to claim 21, wherein The memory and the computer program code are configured to, together with the processor, further cause the apparatus to: Check whether the security policy is consistent with or conflicts with the security policy of another network slice instance that shares the constituent network slice subnet instance.

23. The device according to claim 21 or 22, wherein: The memory and the computer program code are configured to, together with the processor, further cause the apparatus to: Check whether the security policy is consistent with or conflicts with the security policy of another constituent network slice subnet instance applied to the same network slice instance.

24. The device according to claim 21, wherein The memory and the computer program code are configured to, together with the processor, further cause the apparatus to: Send a report or alert indicating the security event to the network slice layer.

25. A computer-readable storage medium having instructions stored thereon, which, when executed by at least one processor, cause the at least one processor to perform the method according to any one of claims 1 to 14.

26. A computer program product comprising instructions which, when executed by at least one processor, cause the at least one processor to perform the method according to any one of claims 1 to 14.

Images