Secure management of trusted network functions

Abstract

Aspects of the present disclosure relate to a network repository function (NRF) that receives a first signaling from an NF as a network function (NF) request, the NF request including an NF type, an NF identifier (ID), and NF security state information. The NRF verifies the NF security status based on the NF ID and the NF security status information. The NRF sends a second signaling as an NF response, wherein the NF response includes a security verification of the NF request.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to U.S. Provisional Application Serial No. 63 / 353,203, filed on June 17, 2022, entitled “Security Management of Trusted Network Functions,” the disclosure of which is incorporated herein by reference in its entirety. Technical Field

[0003] The present disclosure relates to wireless communications, and more particularly to access control and security policy management of network functions. Background Art

[0004] A wireless communication system may include one or more network communication devices, such as a base station, which may also be referred to as an eNodeB (eNB), a next generation NodeB (gNB) or other suitable terms. Each network communication device, such as a base station, may support wireless communication for one or more user communication devices, which may also be referred to as a user equipment (UE) or other suitable terms. A wireless communication system may support wireless communication with one or more user communication devices by utilizing resources of the wireless communication system, such as time resources (e.g., symbols, time slots, subframes, frames, etc.) or frequency resources (e.g., subcarriers, carriers). In addition, a wireless communication system may support wireless communication across various wireless access technologies, including third generation (3G) radio access technology, fourth generation (4G) radio access technology, fifth generation (5G) radio access technology, and other suitable radio access technologies above 5G (e.g., sixth generation (6G)).

[0005] Various network functions (NFs) in the network infrastructure (such as the access network and core network of the wireless communication system) have defined external interfaces and functional behaviors. In fact, the network function can be implemented by or as a network node, or as a network device. NFs communicate with each other after mutual authentication and authorization, and the network functions in the 5G system are implicitly trusted. NFs can be NF service consumers and / or NF service producers (or NF providers). Typically, NF service consumers use services provided by another NF, while NF service producers provide services that can be consumed by another NF. In the network infrastructure, NFs can act as both NF service consumers and NF service producers for different services. Summary of the invention

[0006] The present disclosure relates to methods, devices and systems for supporting secure management of trusted network functions. By utilizing the described technology, aspects of access control and security policy management for trusted network service operations are implemented. The described technology enables a network repository function (NRF) to allow only trusted NFs to register, provision services and consume services in a network. In implementation, trust data and security state information associated with NFs can be used to enforce access control policies during various network security operations associated with scenarios, such as for NF service discovery, service registration, authentication, authorization and service requests. Given a zero-trust policy for NFs in a network infrastructure, such as in an access network and a core network of a wireless communication system, aspects of secure management of trusted network functions are provided for NF authentication and authorization, such as during NF discovery, NF registration (e.g., for NF service producer registration) and access token requests (e.g., for authorizing NF service access to allow NF service consumers to access services from NF service producers). NRF can implement explicit trust technology to enforce NF access control and security policies to identify and only allow trusted NFs to perform NF discovery, NF registration or obtain access tokens.

[0007] Some implementations of the methods and apparatus described herein may further include an NRF receiving a first signaling from the NF as an NF request, wherein the NF request includes at least an NF type, an NF identifier (ID), and NF security status information. The NRF verifies the NF security status based on the NF ID and the NF security status information, and sends a second signaling as an NF response, wherein the NF response includes security verification of the NF request.

[0008] In some implementations of the methods and devices described herein, the NRF enforces an access control security policy for services associated with the NF. The NRF generates an access control security policy for services associated with the NF based on one or more of an established policy, NF profile information, NF security status information, or (multiple) allowed trust levels for services associated with the NF. The NRF enforces the access control security policy based on an allowed trust range value for NF service consumers to consume services associated with the NF, and the NRF sends a third signaling to the NF service producer as an allowed trust range value to allow NF service consumers with allowed trust range values ​​to consume services associated with the NF. The NF response includes one or more allowed trust levels for services associated with the NF. The NRF assigns one or more allowed trust levels to services associated with the NF based on the established policy, NF trust information, and NF security data. The NRF verifies the NF security status information by verifying an authentication code of the NF security status information using a public key or a shared key. The NRF verifies the NF security status information by matching the NF ID or NF instance ID corresponding to the stored NF security status information associated with the NF. The NRF stores an NF profile of the NF, where the NF profile includes at least an NF ID, stored NF security status information associated with the NF, and trust evaluation information associated with the NF.

[0009] In some implementations of the methods and apparatus described herein, the NF request is received from the NF as a NF registration request, and the NF response is sent to the NF as a NF registration response. Alternatively, the NF request is received from the NF as a NF registration update request, and the NF response is sent to the NF as a NF registration update response. Alternatively, the NF request is received from the NF as a NF discovery request, and the NF response is sent to the NF as a NF discovery response.

[0010] Some implementations of the methods and apparatus described herein may further include the NRF receiving a first signaling from the NF as a NF request, the NF request including the NF type, the NF ID, and the NF security status information. The NRF verifies the NF security status based on the NF ID and the NF security status information. The NRF sends a second signaling as a NF response, the NF response including the security verification of the NF request.

[0011] In some implementations of the methods and apparatus described herein, the NRF enforces an access control security policy for services associated with the NF. The NRF generates an access control security policy for services associated with the NF based on at least one or more of an established policy, NF profile information, NF security state information, or (multiple) allowed trust levels for services associated with the NF. The NRF enforces the access control security policy based on an allowed trust range value for NF service consumers to consume services associated with the NF, and the NRF sends a third signaling to the NF service producer as an allowed trust range value to allow NF service consumers with allowed trust range values ​​to consume services associated with the NF. The NRF verifies the NF security state information by verifying an authentication code of the NF security state information using a public key or a shared key. The NRF verifies the NF security state information by matching an NF ID or NF instance ID corresponding to the stored NF security state information associated with the NF. The NRF stores an NF profile of the NF, the NF profile comprising at least the NF ID, the stored NF security state information associated with the NF, and the trust assessment information associated with the NF.

[0012] Some implementations of the methods and apparatus described herein may further include an NRF receiving a first signaling as an access token request from a NF service consumer, the access token request including at least NF profile information and NF security status information. The NRF authorizes the NF service consumer based on the NF profile information and the NF security status information. The NRF sends a second signaling as an access token response to the NF service consumer, wherein the access token response includes the access token.

[0013] In some implementations of the methods and devices described herein, the NRF generates an access token that allows the NF service consumer to access services associated with the NF service producer. The NRF authorizes the NF service consumer based on the access control security policy and / or based on the trust assessment data stored by the device. In order to authorize the NF service consumer, the NRF sends a NF trust request to the trust assessment service, wherein the NF trust request includes at least the NF ID of the NF service consumer and the NF security status information. Then, the NRF receives a NF trust response from the trust assessment service, wherein the NF trust response includes the trust verification of the NF service consumer. The access token includes the NF trust information associated with the NF service consumer. The NF profile information and the NF security status information are digitally signed by the NF service consumer using the private key or shared key of the NF service consumer.

[0014] Some implementations of the methods and apparatus described herein may further include the NRF receiving a first signaling as an access token request from the NF service consumer, the access token request including at least NF profile information and NF security status information. The NRF authorizes the NF service consumer based on the NF profile information and the NF security status information. The NRF sends a second signaling as an access token response to the NF service consumer, the access token response including the access token.

[0015] In some implementations of the methods and apparatus described herein, the NRF generates an access token that allows the NF service consumer to access services associated with the NF service producer. The NF service consumer is authorized based on an access control security policy or based on stored trust assessment data. The NRF authorizes the NF service consumer by sending a NF trust request to a trust assessment service, the NF trust request including at least the NF ID of the NF service consumer and NF security status information, and the NRF receives a NF trust response from the trust assessment service, the NF trust response including a trust verification of the NF service consumer. The access token includes NF trust information associated with the NF service consumer.

[0016] Some implementations of the methods and apparatus described herein may also include the NF service producer receiving a first signaling as a NF service request from the NF service consumer, the NF service request including a NF ID of the NF service consumer and an access token with NF trust information. The NF service producer verifies the NF trust information associated with the NF ID of the requesting service that allows the NF service request. The NF service producer sends a second signaling as a NF service response to the NF service consumer.

[0017] In some implementations of the methods and apparatus described herein, an NF service producer performs a requested service for an NF service consumer. The NF service producer verifies the NF service request based on an access control security policy. The NF service producer authorizes the NF service request based on trust assessment data stored by the apparatus. The NF service producer verifies the NF service request by further sending an NF trust request to a trust assessment service, wherein the NF trust request includes an NF ID of the NF service consumer and NF trust information, and receives an NF trust response from the trust assessment service, wherein the NF trust response includes trust verification of the NF service request.

[0018] Some implementations of the methods and apparatus described herein may also include the NF service producer receiving a first signaling as a NF service request from the NF service consumer, the NF service request including at least a NF ID of the NF service consumer and an access token with NF trust information. The NF service producer verifies the NF trust information associated with the NF ID of the requesting service that allows the NF service request. The NF service producer sends a second signaling as a NF service response to the NF service consumer.

[0019] In some implementations of the methods and apparatus described herein, an NF service producer performs a requested service for an NF service consumer. The NF service producer verifies the NF service request based at least in part on an access control security policy. The NF service producer authorizes the NF service request based at least in part on trust assessment data stored by the apparatus. The NF service producer verifies the NF trust information by sending a NF trust request to a trust assessment service, wherein the NF trust request includes at least an NFID of the NF service consumer and the NF trust information. The NF service producer receives a NF trust response from the trust assessment service, wherein the NF trust response includes a trust verification of the NF service request. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 An example of a wireless communication system supporting secure management of trusted network functions according to aspects of the present disclosure is shown.

[0021] Figures 2 to 6 An example of a signaling diagram supporting secure management of a trusted network function according to aspects of the present disclosure is shown.

[0022] Figure 7 and 8 An example of a block diagram of a device supporting secure management of trusted network functions according to aspects of the present disclosure is shown.

[0023] Figures 9 to 14 A flow chart of a method for supporting secure management of trusted network functions according to aspects of the present disclosure is shown. DETAILED DESCRIPTION

[0024] Various NFs in the network infrastructure (such as NFs in the access network and core network of the wireless communication system) have defined external interfaces and functional behaviors. NFs communicate with each other after mutual authentication and authorization, and the network functions in the 5G system are implicitly trusted (i.e., NFs are trusted without performing real-time or continuous trust evaluations). Therefore, if any NF is attacked or has been damaged or hijacked, there is a potential risk that the damaged NF will still be malicious and unidentified even after successful mutual authentication and authorization. This brings security management issues to trusted network service operations. If a damaged NF (or a threatened NF) operates as an NF service producer, this may affect other communication NFs (such as NF service consumers) because the lateral movement of the attack that allows damage causes network service failures. In addition, if a damaged NF (or a threatened NF) is allowed to provide services to UEs and other NFs within the network, this may cause damage problems in the network, such as data theft, service failure, denial of service, resource hijacking, and other failure problems.

[0025] The traditional NRF performs NF authentication through direct communication or indirect communication (e.g., via a Service Communication Proxy (SCP)), such as during NF discovery, NF registration (e.g., for NF service producer registration), and access token request (e.g., for authorizing NF service access to allow NF service consumers to access services from NF service producers). However, the traditional NRF does not maintain or verify any trust information or security status information related to the NF, so the NRF does not enforce any dynamic access control or security policy to identify and only allow trusted NFs to perform NF discovery, NF registration, or obtain access tokens. In addition, the NRF does not have the function of identifying compromised NFs and rejecting requests related to NF discovery, NF registration, and access token request.

[0026] Aspects of the present disclosure are directed to the secure management of trusted network functions and enable the ability of NRF to only allow trusted NFs to register, provision services, and consume services in the network. In implementations, trust data and security status information associated with NFs can be used to enforce access control policies during various network operations, such as for NF service discovery, service registration, authentication, authorization, and service requests. Trust data can include trust assessment information, such as analysis information related to the security status of network functions, behavioral attributes and analysis, service operations, and / or environmental attributes of network functions, as well as any other information related to the security of network operations. Trust assessment information associated with any network function, application function, or device may be analytical information related to security status (e.g., observable status such as installed software version, network, network function location, time and / or date of request, certificate status (e.g., expiration, renewal, revocation, etc.), lack of configured credential rotation (e.g., if credential refresh is not performed within a certain life time of the NF, then the trust level may be affected), previously observed behavior, installed credentials, telemetry data, data about what is happening inside the network function that may affect business goals and service experience, network function, network status, device status, interface status, running applications, open port information, closed port information, access or configuration violation information, expected configuration information, behavior (e.g., behavior attributes may include automatic subject analysis, device analysis, and measured deviations from observed usage patterns, etc.), service operation (e.g., may include any deviations from regular and specified service operations), environmental attributes of the network function (e.g., may include factors such as requester network location, time, any reported active attacks, etc.), and / or any information related to the security of the network function or operation.

[0027] The techniques described herein for secure management of trusted network functions provide for NF authentication and authorization, such as during NF discovery, NF registration (e.g., for NF service producer registration), and access token request (e.g., for authorizing NF service access to allow NF service consumers to access services from NF service producers). The NRF may implement explicit trust techniques to enforce NF access control and security policies to identify and allow only trusted NFs to perform NF discovery, NF registration, or obtain access tokens.

[0028] Aspects of the disclosure are described in the context of a wireless communication system.Aspects of the disclosure are further illustrated and described with reference to device diagrams and flow charts.

[0029] Figure 1 An example of a wireless communication system 100 that supports secure management of trusted network functions according to aspects of the present disclosure is shown. The wireless communication system 100 may include one or more network entities 102, one or more UEs 104, a core network 106, and a packet data network 108. The wireless communication system 100 may support various radio access technologies. In some implementations, the wireless communication system 100 may be a 4G network, such as an LTE network or an LTE-Advanced (LTE-A) network. In some other implementations, the wireless communication system 100 may be a 5G network, such as an NR network. In other implementations, the wireless communication system 100 may be a combination of a 4G network and a 5G network, or other suitable radio access technologies, including the Institute of Electrical and Electronics Engineers (IEEE) 802.11 (WiFi), IEEE 802.16 (WiMAX), IEEE 802.20. The wireless communication system 100 may support radio access technologies above 5G. In addition, the wireless communication system 100 may support technologies such as time division multiple access (TDMA), frequency division multiple access (FDMA), or code division multiple access (CDMA).

[0030] One or more network entities 102 may be dispersed throughout a geographic area to form a wireless communication system 100. One or more network entities 102 described herein may be or include or may be referred to as a network node, a base station, a network element, a radio access network (RAN), a base transceiver station, an access point, a NodeB, an eNodeB (eNB), a next generation NodeB (gNB), or other suitable terms. The network entity 102 and the UE 104 may communicate via a communication link 110, which may be a wireless or wired connection. For example, the network entity 102 and the UE 104 may perform wireless communication (e.g., receive signaling, send signaling) over a Uu interface.

[0031] The network entity 102 may provide a geographic coverage area 112 within which the network entity 102 may support services (e.g., voice, video, packet data, messaging, broadcast, etc.) for one or more UEs 104. For example, the network entity 102 and the UE 104 may support wireless communications of signals associated with services (e.g., voice, video, packet data, messaging, broadcast, etc.) according to one or more radio access technologies. In some implementations, the network entity 102 may be mobile, such as a satellite associated with a non-terrestrial network. In some implementations, different geographic coverage areas 112 associated with the same or different radio access technologies may overlap, but different geographic coverage areas 112 may be associated with different network entities 102. The information and signals described herein may be represented using any of a variety of different techniques and methods. For example, data, instructions, commands, information, signals, bits, symbols, and chips that may be referenced throughout the description may be represented by voltage, current, electromagnetic waves, magnetic fields or particles, optical fields or particles, or any combination thereof.

[0032] One or more UEs 104 may be dispersed throughout the geographic area of ​​the wireless communication system 100. UE 104 may include or may be referred to as a mobile device, a wireless device, a remote device, a remote unit, a handheld device, or a subscriber device, or some other suitable term. In some implementations, UE 104 may be referred to as a unit, a station, a terminal, or a client, as well as other examples. Additionally or alternatively, UE 104 may be referred to as an Internet of Things (IoT) device, an Internet of Everything (IoE) device, or a Machine Type Communication (MTC) device, as well as other examples. In some implementations, UE 104 may be stationary in the wireless communication system 100. In some other implementations, UE 104 may move in the wireless communication system 100.

[0033] One or more UEs 104 may be devices of different forms or with different capabilities. Some examples of UEs 104 are Figure 1 As shown in Figure 1 As shown, UE 104 may be able to communicate with various types of devices, such as network entity 102, other UE 104, or network equipment (e.g., core network 106, packet data network 108, relay device, integrated access and backhaul (IAB) node, or another network device). Additionally or alternatively, UE 104 may support communication with other network entities 102 or UE 104, which may act as relays in wireless communication system 100.

[0034] The UE 104 may also support direct wireless communication with other UEs 104 via a communication link 114. For example, the UE 104 may support direct wireless communication with another UE 104 via a device-to-device (D2D) communication link. In some implementations, such as vehicle-to-vehicle (V2V) deployments, vehicle-to-everything (V2X) deployments, or cellular-V2X deployments, the communication link 114 may be referred to as a side link. For example, the UE 104 may support direct wireless communication with another UE 104 via a PC5 interface.

[0035] The network entity 102 may support communication with the core network 106 or with another network entity 102, or both. For example, the network entity 102 may interface with the core network 106 via one or more backhaul links 116 (e.g., via S1, N2, or another network interface). The network entities 102 may communicate with each other via the backhaul links 116 (e.g., via X2, Xn, or another network interface). In some implementations, the network entities 102 may communicate with each other directly (e.g., between the network entities 102). In some other implementations, the network entities 102 may communicate with each other or indirectly (e.g., via the core network 106). In some implementations, one or more network entities 102 may include subcomponents, such as an access network entity, which may be an example of an access node controller (ANC). The ANC may communicate with one or more UEs 104 via one or more other access network transmission entities, which may be referred to as radio heads, smart radio heads, or transmission-reception points (TRPs).

[0036] In some implementations, the network entity 102 may be configured in a decomposed architecture that may be configured to utilize a protocol stack physically or logically distributed between two or more network entities 102, such as an integrated access backhaul (IAB) network, an open RAN (O-RAN) (e.g., a network configuration sponsored by the O-RAN Alliance), or a virtualized RAN (vRAN) (e.g., a cloud RAN (C RAN)). For example, the network entity 102 may include one or more of a central unit (CU), a distributed unit (DU), a radio unit (RU), a RAN intelligent controller (RIC) (e.g., a near real-time RIC (Near-RT RIC), a non-real-time RIC (Non-RT RIC)), a service management and orchestration (SMO) system, or any combination thereof.

[0037] The RU may also be referred to as a radio head, a smart radio head, a remote radio head (RRH), a remote radio unit (RRU), or a transmission reception point (TRP). One or more components of the network entity 102 in the decomposed RAN architecture may be co-located, or one or more components of the network entity 102 may be located in a distributed location (e.g., a separate physical location). In some implementations, one or more network entities 102 of the decomposed RAN architecture may be implemented as a virtual unit (e.g., a virtual CU (VCU), a virtual DU (VDU), a virtual RU (VRU)).

[0038] The functional division between CU, DU and RU can be flexible and can support different functions depending on which functions (e.g., network layer functions, protocol layer functions, baseband functions, radio frequency functions and any combination thereof) are executed at CU, DU or RU. For example, the functional division of the protocol stack can be adopted between CU and DU, so that the CU can support one or more layers of the protocol stack, and the DU can support one or more different layers of the protocol stack. In some implementations, the CU can host upper protocol layer (e.g., Layer 3 (L3), Layer 2 (L2)) functions and signaling (e.g., Radio Resource Control (RRC), Service Data Adaptation Protocol (SDAP), Packet Data Convergence Protocol (PDCP)). The CU can be connected to one or more DUs or RUs, and one or more DUs or RUs can host lower protocol layers, such as Layer 1 (L1) (e.g., physical (PHY) layer) or L2 (e.g., radio link control (RLC) layer, media access control (MAC) layer) functions and signaling, and each can be at least partially controlled by the CU.

[0039] Additionally or alternatively, a functional split of the protocol stack may be employed between the DU and the RU such that the DU may support one or more layers of the protocol stack and the RU may support one or more different layers of the protocol stack. The DU may support one or more different cells (e.g., via one or more RUs). In some implementations, the functional split between the CU and the DU or between the DU and the RU may be within the protocol layer (e.g., some functions for a protocol layer may be performed by one of the CU, DU, or RU, while other functions of the protocol layer are performed by a different one of the CU, DU, or RU).

[0040] The CU may be further functionally divided into CU control plane (CU-CP) and CU user plane (CU-UP) functions. The CU may be connected to one or more DUs via a mid-range communication link (e.g., F1, F1c, F1u), and the DU may be connected to one or more RUs via a front-haul communication link (e.g., an open front-haul (FH) interface). In some implementations, the mid-range communication link or the front-haul communication link may be implemented based on an interface (e.g., a channel) between protocol stack layers supported by the various network entities 102 communicating via such a communication link.

[0041] The core network 106 may support user authentication, access authorization, tracking, connectivity, and other access, routing, or mobility functions. The core network 106 may be an evolved packet core (EPC) or a 5G core (5GC), which may include control plane entities that manage access and mobility (e.g., mobility management entity (MME), access and mobility management function (AMF)) and user plane entities that route packets or interconnect with external networks (e.g., serving gateway (S-GW), packet data network (PDN) gateway (P-GW), or user plane function (UPF)). In some implementations, the control plane entity may manage non-access stratum (NAS) functions, such as mobility, authentication, and bearer management (e.g., data bearer, signal bearer, etc.) for one or more UEs 104 served by one or more network entities 102 associated with the core network 106.

[0042] The core network 106 may communicate with the packet data network 108 via one or more backhaul links 116 (e.g., via S1, N2, or another network interface). The packet data network 108 may include an application server 118. In some implementations, one or more UEs 104 may communicate with the application server 118. The UE 104 may establish a session (e.g., a protocol data unit (PDU) session, etc.) with the core network 106 via the network entity 102. The core network 106 may route traffic (e.g., control information, data, etc.) between the UE 104 and the application server 118 using the established session (e.g., the established PDU session). The PDU session may be an example of a logical connection between the UE 104 and the core network 106 (e.g., one or more network functions of the core network 106).

[0043] In the wireless communication system 100, the network entity 102 and the UE 104 may use the resources of the wireless communication system 100, such as time resources (e.g., symbols, time slots, subframes, frames, etc.) or frequency resources (e.g., subcarriers, carriers) to perform various operations (e.g., wireless communication). In some implementations, the network entity 102 and the UE 104 may support different resource structures. For example, the network entity 102 and the UE 104 may support different frame structures. In some implementations, such as in 4G, the network entity 102 and the UE 104 may support a single frame structure. In some other implementations, such as in 5G and other suitable radio access technologies, the network entity 102 and the UE 104 may support various frame structures (e.g., multiple frame structures). The network entity 102 and the UE 104 may support various frame structures based on one or more numerical rules.

[0044] One or more configuration parameters may be supported in the wireless communication system 100, and the configuration parameters may include a subcarrier spacing and a cyclic prefix. A first configuration parameter (e.g., μ=0) may be associated with a first subcarrier spacing (e.g., 15kHz) and a normal cyclic prefix. A first configuration parameter (e.g., μ=0) associated with a first subcarrier spacing (e.g., 15kHz) may utilize one slot per subframe. A second configuration parameter (e.g., μ=1) may be associated with a second subcarrier spacing (e.g., 30kHz) and a normal cyclic prefix. A third configuration parameter (e.g., μ=2) may be associated with a third subcarrier spacing (e.g., 60kHz) and a normal cyclic prefix or an extended cyclic prefix. A fourth configuration parameter (e.g., μ=3) may be associated with a fourth subcarrier spacing (e.g., 120kHz) and a normal cyclic prefix. A fifth configuration parameter (e.g., μ=4) may be associated with a fifth subcarrier spacing (e.g., 240kHz) and a normal cyclic prefix.

[0045] The time intervals of resources (e.g., communication resources) can be organized according to frames (also referred to as radio frames). Each frame can have a duration, for example, a duration of 10 milliseconds (ms). In some implementations, each frame can include multiple subframes. For example, each frame can include 10 subframes, and each subframe can have a duration, for example, a duration of 1 ms. In some implementations, each frame can have the same duration. In some implementations, each subframe of a frame can have the same duration.

[0046] Additionally or alternatively, the time intervals of resources (e.g., communication resources) can be organized according to time slots. For example, a subframe may include a certain number (e.g., quantity) of time slots. Each time slot may include a certain number (e.g., quantity) of symbols (e.g., orthogonal frequency division multiplexing (OFDM) symbols). In some implementations, the number (e.g., quantity) of time slots used for a subframe may depend on a configuration parameter. For a normal cyclic prefix, a time slot may include 14 symbols. For an extended cyclic prefix (e.g., for a 60kHz subcarrier spacing), a time slot may include 12 symbols. The relationship between the number of symbols per time slot, the number of time slots per subframe, and the number of time slots per frame of a normal cyclic prefix and an extended cyclic prefix may depend on a configuration parameter. It should be understood that references to a first configuration parameter (e.g., μ=0) associated with a first subcarrier spacing (e.g., 15kHz) may be used interchangeably between subframes and time slots.

[0047] In the wireless communication system 100, the electromagnetic (EM) spectrum can be divided into various categories, frequency bands, channels, etc. based on frequency or wavelength. By way of example, the wireless communication system 100 can support one or more operating frequency bands, such as the frequency range designations FR1 (410 MHz–7.125 GHz), FR2 (24.25 GHz–52.6 GHz), FR3 (7.125 GHz–24.25 GHz), FR4 (52.6 GHz–114.25 GHz), FR4a or FR4-1 (52.6 GHz–71 GHz), and FR5 (114.25 GHz–300 GHz). In some implementations, the network entity 102 and the UE 104 can perform wireless communications on the one or more operating frequency bands. In some implementations, FR1 can be used by the network entity 102 and the UE 104 and other devices or apparatuses for cellular communication services (e.g., control information, data). In some implementations, FR2 can be used by the network entity 102 and the UE 104 and other devices or apparatuses for short-range, high data rate capabilities.

[0048] FR1 may be associated with one or more configuration parameters (e.g., at least three configuration parameters). For example, FR1 may be associated with: a first configuration parameter (e.g., μ=0), the first configuration parameter including a 15kHz subcarrier spacing; a second configuration parameter (e.g., μ=1), the second configuration parameter including a 30kHz subcarrier spacing; a third configuration parameter (e.g., μ=2), the third configuration parameter including a 60kHz subcarrier spacing. FR2 may be associated with one or more configuration parameters (e.g., at least 2 configuration parameters). For example, FR2 may be associated with a third configuration parameter (e.g., μ=2), the third configuration parameter including a 60kHz subcarrier spacing; a fourth configuration parameter (e.g., μ=3), the fourth configuration parameter including a 120kHz subcarrier spacing.

[0049] Depending on the implementation, one or more network entities may be operable to implement various aspects of the security management of the trusted network functions described herein. In one or more implementations, the NRF 120 only allows trusted NFs (e.g., network functions in the core network 106 and / or the packet data network 108) to register, supply services, and consume services in the network. In an implementation, trust data and security status information associated with the NF service producer 122 or the NF service consumer 124 may be used to enforce access control policies during various network operations (such as for NF service discovery, service registration, authentication, authorization, and service requests). For example, the NF service producer 122 or the NF service consumer 124 transmits (e.g., sends) a NF request 126 (e.g., a NF registration request, a NF registration update request, or a NF discovery request) to the NRF. The NRF 120 receives the NF request 126 and determines (at 128) the NF trust information and manages the access security policy for the NF service producer 122 or the NF service consumer 124. The NRF 120 generates a NF response 130 (eg, a NF registration response, a NF registration update response, or a NF discovery response) and transmits (eg, sends) the NF response to the requesting NF service producer 122 or the NF service consumer 124.

[0050] Conventional NRF performs NF authentication using direct communication or indirect communication (e.g., via SCP), such as during NF discovery, NF registration (e.g., for NF service producer registration), and access token request (e.g., for authorizing NF service access to allow NF service consumers to access services from NF service producers). NRF supports functions including service discovery functions. For example, NRF receives NF discovery requests from NF instances or SCPs and provides information of discovered NF instances (or instances to be discovered) to NF instances or SCPs. NRF supports proxy call session control function (P-CSCF) discovery, which is a special case of application function (AF) discovery by session management function (SMF). NRF maintains NF profiles of available NF instances and their supported services. NRF also maintains SCP profiles of available SCP instances and supports SCP discovery by SCP instances. NRF notifies subscribed NF service consumers or SCPs of newly registered, updated, and deregistered NF and SCP instances and their potential NF services. NRF also maintains the health status of NFs and SCPs.

[0051] However, the traditional NRF does not maintain or verify any trust information or security status information related to the NF, so the NRF does not enforce any dynamic access control or security policy to identify and only allow trusted NFs to perform NF discovery, NF registration, or obtain access tokens. In addition, the NRF does not have the function of identifying compromised NFs and rejecting requests related to NF discovery, NF registration, and access token requests. Some security functions are supported in the current system architecture for secure communication between different NFs (for both direct and indirect communication). Security functions include authentication and authorization between network functions and NRF; authentication and authorization between network functions; authentication based on client credential assertion; and authorization of NF service access. However, none of these security features supports real-time trust evaluation, nor does it support dynamic or continuous trust evaluation of network functions in 5G systems. If any NF in the core network is threatened or attacked, the lack of dynamic trust evaluation will allow the affected NF to remain unidentified in the network, which may cause service failure, data loss and theft, and / or lateral movement of attacks. It is worth noting that current security policy enforcement based on dynamic or continuous trust evaluation is not currently supported by 5G systems.

[0052] Aspects of the present disclosure are directed to the secure management of trusted network functions and enable NRF to allow only trusted NFs to register, provision services, and consume services in the network. In implementation, trust data and security state information associated with the NF can be used to enforce access control policies during various network operations (such as for NF service discovery, service registration, authentication, authorization, and service requests). Trust data may include trust assessment information, such as security state-related analysis information (e.g., observable states such as installed software versions, configuration information, network function location, time and date of request, previously observed behavior, and installed credentials); behavior and analysis (e.g., behavior attributes may include automated subject analysis, device analysis, and measured deviations from observed usage patterns, etc.); service operations (e.g., any deviations in regular and specified service operations); and / or environmental attributes of the network function (e.g., factors such as requester network location, time, any reported active attacks, etc.), as well as any other information related to the security of network operations.

[0053] In a first implementation related to security management of trusted network functions, the NRF supports NF service registration with fine-grained service access control security policies. The NRF can manage the NF security status of NF service producers registered with the NRF. The NF security status can include any of observable status, network system security posture, configuration, installed software version, allowed open ports, running applications, open connections, etc. In addition, the NRF can apply security policies based on available trust data and / or trust assessment information to only allow trusted NF service producers to register with the NRF, and enforce access control to only allow trusted NF service consumers to consume registered NF producer services.

[0054] Figure 2 An example of a signaling diagram 200 for supporting secure management of a trusted network function according to aspects of the present disclosure is shown, and NF registration with a fine-grained service access control security policy is shown. The NF service producer 122 (e.g., NF instance) sends a NF registration request message to the NRF 120 (in step 1) to notify the NRF of its NF profile when the NF service producer (e.g., NF service consumer of the NRF service) first becomes operational. The NF registration request message may include NF type, NF identification information (such as NF ID), NF security state, and NF profile configuration data, which may include additional scope information indicating resources and actions (service operations) allowed on these resources for the NF service consumer. These resources may be each NF type of the NF service consumer, or each NF instance ID of the NF service consumer. The NF registration request message may also include a signed NF security state and the required trust scope for (multiple) services. The required trust scope information indicates the trust level (s) for the NF type and NF service consumer to be eligible to consume the services supplied by the registered NF service provider.

[0055] The NF service producer may use its private key or shared key to sign the NF security status information or the NF profile containing the NF security status information to be sent to the NRF. The NF profile of the NF service producer and the NF security status may be configured by the Operation, Administration and Maintenance (OAM) system. As an alternative, the NF registration request message (at step 1) may include a NF profile instead of the NF security status, where the NF security status may be part of the NF profile information maintained in the NRF, and in this case, the signed NF profile may be sent. As another alternative, the NF registration request message (at step 1) may include a message authentication code / digest of the NF security status information, or a NF profile containing the NF security status information, and the shared key is used to generate the relevant MAC / digest.

[0056] If a signed NF security state or a signed NF profile containing the NF security state is received, the NRF (at step 2) may verify the signature using the public key of the NF service producer or using a shared key. The NRF stores the NF profile, NF security state, acceptable and / or required trust scope for (multiple) services, and marks the NF service producer as available. Based on the NF profile information, NF security state, required trust scope for (multiple) services, and trust assessment information or security monitoring information (if any, available for specific NF types, NF service consumers and / or producers), the NRF sets access security policies to be enforced for various NF types, NF service producers (which can provide services), and NF service consumers (which can request to consume the registered NF services of the NF service producer). The access security policy may include a list of NF IDs, NF instance IDs, NF types, corresponding trust information sets (e.g., (multiple) trust scope values), security monitoring data (e.g., the security status of the NF), a service provision restriction list (e.g., if the NF is a service producer) or a service consumption restriction list (e.g., if the NF is a service consumer), and a resource access restriction list (e.g., general NF, NF service, network data, and UE data access restriction lists).

[0057] The NRF may also consider various aspects to set an acceptable trust scope for the service, such as operator local policies, trust scope required for the service, trust assessment information, security monitoring data (if available) and trust assessment information for NF service producers, and security monitoring data (if available) for NF service consumers. The access security policy may also be referred to as an access control policy or a security policy. In addition, the trust scope required for the service may alternatively be referred to as a preferred trust scope for service consumption. The acceptable trust scope for the service may alternatively be referred to as an authorized or allowed trust scope for service consumption. The trust scope required for the service and the acceptable or allowed trust scope for the service may include a list of trust scope values ​​(e.g., as confidence values), such as any critical, very low, low, medium, high, very high, etc., to indicate the category of NF trust level and security level (e.g., NF service consumer) that can consume the (multiple) services of the NF service producer. Alternatively, the NF security status of the NF may be part of its NF public certification and / or certificate.

[0058] Figure 3 An example of a signaling diagram 300 for supporting secure management of a trusted network function according to aspects of the present disclosure is shown. The signaling diagram 300 further illustrates aspects of the signaling diagram 200, wherein reference is made to Figure 2 Step 2 shown and described is Figure 3Alternatively, if the NRF does not have trust assessment data and security monitoring data available for the NF Service Producer, the NRF may perform steps 2b and 2c to obtain trust assessment data specific to the NF Service Producer instance.

[0059] The NRF sends a NF trust data request to the NF 302 (at step 2b), such as to the Network Data Analysis Function (NWDAF), the Trust Evaluation Service and Enablement Service Function (TESF), or any other NF implementing NF trust evaluation, trust identification, security monitoring functions or services. The NF trust data request may include the NF service producer ID, such as the NF instance ID or client ID, and (if available) the NF security status information of the NF service producer.

[0060] The NF 302 (e.g., NWDAF, TESF, or any NF) that implements NF trust evaluation, trust identification, and / or security monitoring functions or services obtains (extracts) the latest trust evaluation information and / or trust data specific to the instance ID of the NF producer (or performs a trust evaluation process on the NF instance ID received in step 2b), and provides the trust information (e.g., the evaluated (multiple) trust scope values) to the NRF in a NF trust data response message (at step 2c). If the NF receives NF security status information from the NF service producer (at step 2b), the NF (e.g., NWDAF, TESF, or any NF) may verify the received NF security status information with the locally managed NF security status information corresponding to the NF service producer ID, and if the match is successful, the verification of the NF security status is considered successful. The NF trust data response message may also include the NF service producer ID and / or instance ID associated with the trust information and the verified NF service producer's security status information, as well as a success indication.

[0061] If the NRF successfully stores the NF profile, NF security status, trust assessment data specific to the NF Service Producer, and an acceptable trust scope for the service information to be consumed by other NF Service Consumers, the NRF confirms that the NF Service Registration has been accepted (at step 3) by sending an NF Registration Response with a success indication and an acceptable (or allowed) trust scope for the service information (e.g., if the NRF determines an acceptable trust scope for the service information). Figure 2 and 3). Alternatively, if the signature or MAC verification related to the NF security state or NF profile fails, or if the NF service producer trust assessment information is lower than the (multiple) acceptable trust value information or thresholds configured locally to allow NF registration, the NRF does not store any information received in step 1, and the NRF may send an NF Registration Response with an error code and a trust verification failure indication at step 3.

[0062] The NF service producer may receive a success indication (at step 4), and if it also receives (multiple) acceptable (or allowed) trust scopes for (multiple) service information, the NF service producer may store (multiple) acceptable trust scopes for (multiple) service information, which are used to correspondingly restrict the NF service consumer when the service is requested from the NF service consumer. The NF service producer and NF service consumer as described in the present implementation may cover all network functions, application functions, or any logical functions that may be implemented in a wireless communication system (e.g., 5GS).

[0063] In terms of security management of trusted network functions, Figure 2 and Figure 3 The steps described in may be applicable to the network service registration process. The NF service producer 122 (e.g., NF instance) sends (at step 1) a NF registration update request message to the NRF 120 to notify the NRF of its updated NF profile or updated NF security status information. The NF registration update request message may include NF type, NF ID, updated NF security status, and NF profile configuration data, which may include additional scope information indicating resources and actions (service operations) allowed on these resources for NF service consumers. These resources may be each NF type of the NF service consumer, or each NF instance ID of the NF service consumer. The NF registration update request message may also include a signed updated NF security status and the trust scope required for the service, where the acceptable trust scope information will indicate the NF types that are eligible to be consumers of the services supplied by the registered NF service producer and the trust level required for the NF service consumer.

[0064] The NF service producer may use its private key or shared key to sign the NF security status information or the NF profile containing the NF security status information to be sent to the NRF. As an alternative, the NF registration update request message (at step 1) may include the NF profile instead of the NF security status, where the NF security status may be part of the NF profile information maintained in the NRF, and in this case, the signed NF profile may be sent. As another alternative, the NF registration update request message (at step 1) may include a message authentication code / digest of the NF security status information or the NF profile containing the NF security status information, and the shared key is used to generate the relevant MAC / digest.

[0065] If a signed, updated NF security state or a signed, updated NF profile containing the NF security state is received (at step 2), the NRF may verify the signature using the public key of the NF Service Producer or using a shared key. The NRF verifies whether the updated NF security state has any security violations. This security violation check may be performed by the NRF based on the operator's local configuration, which lists the necessary NF security states to be supported or configured in the NF Service Producer. If there are no security violations, the NRF stores the updated NF profile, the updated NF security state, the acceptable and / or required trust scope for the service, and marks the NF Service Consumer as available.

[0066] If the NRF successfully stores the NF profile, NF security status, and also determines the acceptable and / or required trust scope for the service information, the NRF confirms that the NF service registration has been accepted by sending an NF Register Update Response with a success indication and the acceptable trust scope for the service information(s) (at step 3). Alternatively, if the signature or MAC verification related to the NF security status or NF profile fails, the NRF does not store any information received in step 1, and the NRF may send an NF Register Response with a failure indication (at step 3). The NF Service Producer may receive the success indication (at step 4), and if it also receives the acceptable trust scope(s) for the service information(s), the NF Service Producer may update and store the acceptable trust scope(s) for the service information(s), which are used to correspondingly restrict the NF Service Consumer when the service is requested.

[0067] It is worth noting that Figure 2 and Figure 3 The aspects described in the above may be applicable to NF service consumers. For example, NF service consumers may be based on Figure 2 and Figure 3Signaling (message flow) performs registration and / or registration update, and in this case, the description can be applied to the situation where the NF service consumer sends a NF registration request (at step 1), receives a NF registration response (at step 3), and stores (multiple) acceptable trust scopes for the NF service consumer (e.g., performing step 4), where the term NF service producer is replaced with NF service consumer in the relevant process.

[0068] also, Figure 2 and Figure 3 The aspects described in the above may be applicable to NF service discovery. For a NF service consumer initiating the NF discovery process, the signaling (message flow) will include a NF discovery request (at step 1), an authorization NF service discovery (at step 2), and a NF discovery response (at step 3). The NF service consumer sends a NF discovery request (at step 1) with NF security state information, a MAC / signature of the NF security state information, and a preferred or required trust scope for (multiple) services. For example, the required trust scope information will indicate the trust level for NF types and NF service producers that are eligible to discover and supply (multiple) services to the NF service consumer.

[0069] The NRF verifies (at step 2) the NF security state and associated MAC / signature specific to the NF Service Consumer, as similarly described for NF Registration. Additionally, based on local policy, the NRF may obtain the NF security state and associated MAC / signature associated with the NF Service Consumer. Figure 3 The trust data described in steps 2b and 2c of the description, and checks whether the NF Service Consumer is authorized to discover the requested NF Service Producer. Authorization for NF Service Discovery may be provided based on any one or more verifications, including if trust assessment information or data available in the NRF or obtained from the TESF, NWDAF or any NF indicates that the (multiple) trust scope values ​​specific to the NF Service Consumer are acceptable for discovering any NF Service Producer based on the access control policy and local policy available in the NRF; if security monitoring data indicates that the security posture of the NF Service Consumer is valid; and / or if the security status verification of the NF Service Consumer succeeds.

[0070] If the trust-related verification of the NF service consumer succeeds at step 2, the NRF sends (at step 3) an NF discovery response with the discovered NF instance information. If the trust-related verification of the NF service consumer does not succeed at step 2, the NRF sends an NF discovery response with an error code and a trust verification failure indication.

[0071] Figure 4An example of a signaling diagram 400 for supporting security management of a trusted network function according to aspects of the present disclosure is shown. In a second implementation, when a NF service consumer requests an access token to consume any (or specific) NF service producer service(s), access control based on NF service consumer trust information may be enforced by the NRF. The NRF 120 authorizes and provides the NF service consumer 124 with an access token only after successfully verifying the trust level and security status of the NF service consumer. The NF service consumer may have registered with the NRF using a NF registration procedure, such as referenced in Figure 2 and 3 described.

[0072] The NF Service Consumer may request an access token from the NRF (at step 1) (e.g., using an Nnrf_AccessToken_Get request operation). The message may include NF Service Consumer identification information (such as NF Instance ID), requested scope (which may include (multiple) expected NF Service Names), NF Types of the expected NF Service Producer and NF Service Consumer, Slice information of the NF Service Producer (such as a list of Network Slice Selection Assistance Information (NSSAI) or Network Slice Instance (NSI) ID, NF Set ID), S-NSSAI list of the NF Service Consumer, NF Instance ID of the requested NF Service Producer (if available), NF Security Status (as a separate information unit or as part of NF Profile Information), and signed NF Security Status.

[0073] The NRF may verify (at step 2) whether the input parameters (e.g., NF type) in the access token request match the corresponding parameters in the public key certificate of the NF service consumer or the NF profile of the NF service consumer. The NRF checks whether the NF security status information received in step 1 (as a separate information unit or as part of the NF profile) matches the NF security status information of the NF service consumer stored in the NF profile, in the public key certificate, or locally available as part of the security monitoring data. If the signed NF security status information is received, the NRF verifies the signature using the public key of the NF service consumer or using a shared key. Based on the trust assessment information (e.g., (multiple) trust scope values) specific to the NF service consumer (if available) and the access security policy, the NRF checks whether the NF service consumer is authorized to access the (multiple) requested services. If the NF service consumer is authorized, the NRF may generate an access token including appropriate declarations. The NRF may digitally sign the generated access token based on a shared key or a private key. If the NF service consumer is not authorized, the NRF may not issue an access token to the NF service consumer.

[0074] As an alternative (at step 2), if the NRF 120 determines that the trust assessment information, security monitoring data, or security status information related to the NF service consumer is not available locally at the NRF, the NRF may perform steps 3a and 3b to obtain the trust data and security status information specific to the NF service consumer. In this implementation, based on the locally configured access security policy, the NRF determines whether the NF service consumer 124 and its evaluated trust information (e.g., trust scope value) are authorized to consume (multiple) requested services. The access security policy information available at the NRF specifies whether (multiple) specific trust scope levels are authorized to consume any NF producer service. For example, if the NF service consumer is assessed to have a trust scope value associated with medium, high, or very high, it may be authorized to consume NF producer services. However, if the NF service consumer is assessed to have a trust scope value associated with critical, very low, or low, it cannot be authorized to consume NF producer services (and the NF service consumer cannot consume NF producer services).

[0075] The access security policy may include a list of NF IDs, NF instance IDs, NF types, corresponding trust information sets (e.g., (multiple) trust scope values), security monitoring data (e.g., security status of NFs), service provision restriction lists (e.g., if the NF is a service producer) or service consumption restriction lists (e.g., if the NF is a service consumer), and resource access restriction lists (e.g., general NF, NF service, network data, and UE data access restriction lists). The NRF sends (at step 3a) a NF trust data request to the NF 402 (e.g., NWDAF, TESF, or any NF) that implements NF trust assessment, trust identification, and security monitoring functions or services. The NF trust data request may include a NF service consumer ID, such as a NF instance ID or client ID, and (if available) NF security status information of the NF service consumer as received from the NF service consumer.

[0076] The NF 402 (e.g., NWDAF, TESF, or any NF) that implements NF trust evaluation, trust identification, and security monitoring functions or services obtains (at step 3b) the latest trust evaluation information and / or trust data specific to the instance ID of the NF service consumer, and provides the trust information (e.g., (multiple) evaluated trust range values) to the NRF in the NF trust data response message. If the NF 402 receives any NF security status information of the NF service consumer in step 3a, the NF (e.g., NWDAF, TESF, or any NF) may verify the received NF security status information with the locally managed NF security status information corresponding to the NF service consumer ID, and if the match is successful, the verification of the NF security status is considered successful. The NF trust data response message may also include the NF service consumer ID, the instance ID associated with the trust information, and the verified security status information of the NF service consumer, as well as a success indication.

[0077] Figure 5 An example of a signaling diagram 500 is shown to support security management of a trusted network function according to aspects of the present disclosure. The signaling diagram 500 further illustrates aspects of the signaling diagram 400. If the NRF determines (at step 4) that the NF security state verification is successful and the trust information indicates an acceptable or allowed trust scope for the provisioned service, the NRF determines to generate an access token and provide it to the NF service consumer along with the trust information. If the trust data verification / evaluation and authorization are successful, the NRF may send (in a response message (e.g., Nnrf_AccessToken_Get operation) to the NF service consumer. Figure 4 , step 4; Figure 5 , at step 5) access token (e.g., with trust information specific claims), otherwise it may reply with a suitable error response. Alternatively, if the evaluated trust data or information (e.g., (multiple) evaluated trust range values) indicates any critical, very low or low trust value, the NRF determines not to provide any access token and sends an access token response with an error code specific to trust failure.

[0078] The claims in the token may include the NF Instance ID of the NRF (issuer), the NF Instance ID of the NF Service Consumer (subject), the NF Type of the NF Service Producer (audience), the expected service name(s), the evaluated trust scope value(s), the NF security status as a separate information element or as part of any scope information, the expiration time, and optional additional scope information such as allowed resources and allowed operations (e.g., service operations on resources). The claims may include a list of NSSAI or NSI IDs for the expected NF Service Producer instance. The claims may include the NF Set ID of the expected NF Service Producer instance. In one or more implementations, the SCP may include a NF Set ID for the expected NF Service Producer instance. Figure 4 and Figure 5 The NF service consumer 124 and the NRF 120 signaling (message flow) are implemented in between for alternative indirect communication. Access control based on trust data can be considered as risk-based access control (if applicable). The NF service consumer can digitally sign the NF configuration file based on a shared key or a private key.

[0079] Figure 6 An example of a signaling diagram 600 for supporting secure management of trusted network functions according to aspects of the present disclosure is shown. In this example, access based on trust data is controlled by the NF service producer 122 for (multiple) network service access. In an implementation, when a NF service consumer requests (multiple) any NF service producer service, the trust information of the NF service consumer 124 can be considered and verified to enforce access control by the NF service producer 122. In one or more implementations, SCP can be implemented between the NF service consumer 124 and the NF service producer 122 signaling (message flow) for alternative indirect communication.

[0080] As a prerequisite, the NF service consumer possesses a valid access token before requesting service access from the NF service producer. As an option, the NF service consumer may obtain NF service producer-specific trust evaluation data (by performing steps 3a and 3b using the NF service producer identification information) before requesting services from any NF service producer, and if the returned trust level(s) of the NF service producer conforms to the local configuration of the NF service consumer, the NF service consumer may determine to request services from a trusted NF service producer (e.g., a NF service producer verified by the trust data). The NF service consumer requests services from the NF service producer (at step 1) using an NF service request including an access token having the trust information as an additional statement.

[0081] The NF service producer can verify the token (at step 2). The NF service producer ensures the integrity of the token by verifying the signature using the public key of the NRF or checking the MAC value using a shared key. If the integrity check is successful, the NF service producer can verify the claims in the token as follows: It checks whether the audience claim in the access token matches its own identity or the type of the NF service producer. If there is an NSSAI list or NSI ID list, the NF service producer can check whether it serves the corresponding slice(s). If there is an NF set ID, the NF service producer can check whether the NF set ID in the claim matches its own NF set ID. If there is a scope, it checks whether the scope matches the requested service operation. If the access token contains additional scope information (e.g., allowed resources and allowed actions on resources (service operations)), it checks whether the additional scope matches the requested service operation. It checks whether the access token has not expired by verifying the expiration time in the access token against the current date and time. If the client credential assertion (CCA) is present in the service request, it can verify whether the CCA and the subject claim in the access token (e.g., the NF instance ID of the NF service consumer) match the subject claim in the CCA.

[0082] In addition, if trust information exists, the NF service producer can determine whether the trust information (e.g., (multiple) evaluated trust scope values ​​of the NF service consumer) matches the (multiple) allowed trust scope values ​​locally available or configured to supply the requested NF producer service or access security policy. If the trust information matches successfully, the verification (e.g., trust information) is deemed successful. In addition, if the trust information received in step 1 also includes the NF security status of the NF service consumer, and if the NF service producer does not have information to verify the NF security status, the NF service producer verifies the NF security status by performing steps 3a and 3b. The access security policy may include a list of NF IDs, NF instance IDs, (multiple) NF types, corresponding trust information sets (e.g., (multiple) trust scope values), security monitoring data (e.g., security status of the NF), a service provision restriction list (e.g., if the NF is a service producer) or a service consumption restriction list (e.g., if the NF is a service consumer), and a resource access restriction list (e.g., general NF, NF service, network data, and UE data access restriction list).

[0083] The NF service producer (at step 3a) sends a NF trust data request to an NRF or NF 602 (e.g., NWDAF, TESF, or any NF) that implements NF trust evaluation, trust identification, and / or security monitoring functions or services. The NF trust data request may include an NF service consumer ID, such as an NF instance ID or client ID, and, if available, the NF security status information of the NF service consumer. If the NF is an NWDAF, TESF, or any NF that implements NF trust evaluation, trust identification, and / or security monitoring functions or services, the NRF or NF 602 (at step 3b) obtains the latest trust evaluation information or trust data specific to the instance ID of the NF service consumer and provides the trust information (e.g., (multiple) evaluated trust scope values) to the NF service producer in a NF trust data response message. If the NF receives the NF security status information of the NF service consumer in step 3a, the NF (e.g., NWDAF, TESF, or any NF) may verify the received NF security status information with the locally managed NF security status information corresponding to the NF service consumer ID, and if the match is successful, the verification of the NF security status is deemed successful. The NF trust data response message may also include the NF service consumer ID and / or instance ID associated with the trust information, and the verified security status information of the NF service consumer, and a success indication.

[0084] Alternatively, if the NF is an NRF, it obtains the NF security status of the NF service consumer corresponding to the NF service consumer identification information, and verifies whether the received NF security status matches the NF security status information for the NF service consumer stored locally. If the match is successful, the verification of the NF security status is considered successful. The NF trust data response message may also include the NF service consumer ID or instance ID related to the trust information and the security status information of the verified NF service consumer, as well as a success indication. Alternatively, if the verification in step 3b is unsuccessful, a trust failure indication is sent in the NF trust data response message. If the verification is successful, the NF service producer (at step 4) can perform the requested service and respond back to the NF service consumer. Otherwise, it may send an error response with a trust failure indication.

[0085] In terms of security management of trusted network functions, CCA is enhanced to support seriousness based on client trust information. CCA is a token signed by the NF service consumer. It enables the NF service consumer to authenticate to the receiving endpoint (NRF, NF service producer) by including the signed token in the service request. It includes the NF instance ID of the NF service consumer, which can be checked by the NF service producer for certificates. CCA includes a timestamp as the basis for limiting its life time. CCAs are expected to have a shorter lifespan than access tokens generated by NRF, so they can be used in deployments that require tokens with shorter usage times for NF-NF communication. When the usage time of CCA is too short, the NF service consumer is required to generate a new CCA for each new service request, which is a trade-off.

[0086] CCA may not be used in roaming situations because the NF service producer in the home public land mobile network (PLMN) may not be able to verify the signature of the NF service consumer in the visited PLMN unless a cross-authentication process is established between the two PLMNs. In this implementation, CCA is generally described for both NF-NRF communication and NF-NF communication. With reference to the client credential assertion, CCA can be a JavaScript Object Notation (JSON) Web Token and protected with a digital signature based on JSON Web Signature (JWS).

[0087] The CCA may include the NF instance ID of the NF service consumer (subject); timestamp and expiration time; NF security state information; NF trust-related information for the intended service (e.g., (multiple) trust scope values); and the NF type of the intended audience (e.g., NRF type and / or NF type of the NF service producer). The NF service consumer may digitally sign the generated CCA based on its private key. The signed CCA may include one of the following fields: an X.509 URL (x5u) for referencing a resource of an X.509 public key certificate or certificate chain used to sign the client authentication assertion, or an X.509 certificate chain (x5c) including an X.509 public key certificate or certificate chain used to sign the client authentication assertion.

[0088] Verification of the CCA can be performed by the receiving node (such as an NRF or an NF service producer) in various ways, such as verifying the signature of the JWS and / or verifying the timestamp and / or expiration time. If the receiving node is an NRF, the NRF verifies the timestamp and expiration time. If the receiving node is an NF service producer, the NF service producer verifies the expiration time, and it may verify the timestamp. It checks whether the audience statement in the CCA matches its own type. It verifies whether the NF instance ID of the NF in the CCA matches the NF instance ID in the public key certificate used to sign the CCA. If the receiving node is an NRF, it checks the NF security status of the NF service consumer specific to the NF instance ID, and if the receiving node is an NF service producer, it checks the NF security status of the NF service consumer specific to the NF instance ID, as follows.

[0089] The NRF / NF service producer sends a NF trust data request (in step A.) to a NF (e.g., NWDAF, TESF, or any NF) that implements NF trust evaluation, trust identification, and / or security monitoring functions or services. The NF trust data request may include a NF service consumer ID (such as, NF instance ID or client ID), and if available, may also include NF security status information of the NF service consumer. The NF (e.g., NWDAF, TESF, or any NF) that implements NF trust evaluation, trust identification, and / or security monitoring functions or services obtains (in step B.) the latest trust evaluation information and / or trust data specific to the instance ID of the NF service consumer, and provides the trust information (e.g., (multiple) evaluated trust range values) to the NRF in a NF trust data response message. If the NF receives any NF security status information of the NF service consumer in step 3a, the NF (e.g., NWDAF, TESF, or any NF) may verify the received NF security status information with the locally managed NF security status information corresponding to the NF service consumer ID, and if the match is successful, the verification of the NF security status is considered successful.

[0090] The NF trust data response message may also include the NF service consumer ID and / or instance ID associated with the trust information and the security status information of the verified NF service consumer, as well as a success indication. If the NF security status does not match the data available in the NF (e.g., NWDAF, TESF, or any NF), and / or if the trust assessment information is below any critical threshold, a trust failure indication is sent to the NRF / NF service producer that initiated step A above. It checks the NF trust-related information (e.g., (multiple) trust scope values) for the intended service based on the locally configured access security policy. The access security policy may include a list of NF IDs, NF instance IDs, (multiple) NF types, corresponding trust information sets (e.g., (multiple) trust scope values), a service provision restriction list (e.g., corresponding to NF service producers) or a service consumption restriction list (e.g., corresponding to NF service consumers), and a resource access restriction list.

[0091] As described herein, aspects of security management of trusted network functions apply to NF service producers, NF service producer registration update processes, and / or to NF service consumer registration processes and their related registration update processes. In implementation, an NF service producer (e.g., any NF) sends a request to the NRF with one or more of the NF type, NF ID, NF profile, NF security state information, signature of the NF security state information, message authentication code of the NF security state information, and / or trust scope information (multiple) required for the service. The NRF verifies the NF security state information; determines (multiple) acceptable or allowed trust scopes for the service and access security policy; and stores one or more of the NF security state information, NF profile, and (multiple) acceptable or allowed trust scopes for the service and access security policy. The NF service producer receives a response from the NRF, with the result being success and / or (multiple) acceptable trust scopes for the service.

[0092] The required trust scope information may contain one or more values ​​or information to indicate the trustworthiness of the network function service consumer that is authorized to request services (by the NRF), request and consume the provided services. The allowed or acceptable trust scope information may contain one or more values ​​or information to indicate the trustworthiness of the network function service consumer to request and consume the provided services from the NRF service producer. The NF service producer, upon receiving the allowed or acceptable trust scope information, stores the allowed or acceptable trust scope information for the service.

[0093] The NRF may verify the NF security status information based on one or more locally stored NF security status information associated with the NF instance ID, NF ID, or NF certificate by requesting the NF performing the trust assessment. The NRF may verify the NF security status information by checking whether the received NF security status information matches the NF security status information for the management of a specific NF identified by the NF type, NF ID, and / or NF instance ID. The NRF may verify the NF security status information and / or the trust level of the NF service producer by checking with the NF performing the trust assessment and security monitoring services. The NRF may verify the NF security status information by determining whether the received NF security status information matches the NF security status information required for a specific NF identified by the NF type, NF ID, or NF instance ID configured locally at the NRF. If the verification of the NF security status information fails, the NRF sends a response to the NF service producer with one or more of a failure indication, an error code, and / or a trust verification failure information. The access security policy may include a list of one or more of the following: NF ID, NF instance ID, (multiple) NF type, corresponding trust information set (e.g., (multiple) trust scope values), security monitoring data (e.g., the security status of the NF), a service provision restriction list (e.g., if the NF is a service producer) or a service consumption restriction list (e.g., if the NF is a service consumer), and / or a resource access restriction list (e.g., general NF, NF service, network data, and UE data access restriction lists).

[0094] Figure 7 An example of a block diagram 700 of a device 702 that supports secure management of trusted network functions according to aspects of the present disclosure is shown. The device 702 can be an example of a device that implements the NRF 120 described herein. The device 702 can support wireless communications with one or more network entities 102, UEs 104, or any combination thereof. The device 702 can include components for two-way communications, including components for sending and receiving communications, such as a processor 704, a memory 706, a transceiver 708, and an I / O controller 710. These components can be in electronic communication or otherwise coupled (e.g., operatively, communicatively, functionally, electronically, electrically) via one or more interfaces (e.g., a bus).

[0095] The processor 704, memory 706, transceiver 708, or various combinations thereof, or various components thereof may be examples of means for performing various aspects of the present disclosure described herein. For example, the processor 704, memory 706, transceiver 708, or various combinations or components thereof may support methods for performing one or more operations described herein.

[0096] In some implementations, the processor 704, memory 706, transceiver 708, or various combinations or components thereof may be implemented in hardware (e.g., in a communications management circuit system). The hardware may include a processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof, which is configured to or otherwise supports means for performing the functions described in the present disclosure. In some implementations, the processor 704 and the memory 706 coupled to the processor 704 may be configured to perform one or more functions described herein (e.g., execution of instructions stored in the memory 706 by the processor 704).

[0097] For example, the processor 704 may support wireless communication at the device 702 according to examples as disclosed herein. The processor 704 may be configured to or otherwise support components for: receiving a first signaling as an NF request from a NF, the NF request including at least an NF type, an NF ID, and NF security status information; verifying the NF security status based at least in part on the NF ID and the NF security status information; and sending a second signaling as an NF response, the NF response including security verification of the NF request.

[0098] In addition, the processor 704 may be configured to or otherwise support enforcing any one or combination of access control security policies for services associated with the NF. The method also includes generating access control security policies for services associated with the NF. The method also includes generating access control security policies based on at least one or more of established policies, NF profile information, NF security status information, or allowed trust levels for services associated with the NF. The method also includes enforcing access control security policies based at least in part on an allowed trust range value for NF service consumers to consume services associated with the NF; and sending a third signaling to the NF service producer as an allowed trust range value to allow NF service consumers with allowed trust range values ​​to consume services associated with the NF. The NF response includes one or more allowed trust levels for services associated with the NF. The method also includes allocating one or more allowed trust levels for services associated with the NF based at least in part on established policies, NF trust information, and NF security data. The NF request includes an NF profile, an authentication code, and an indication of the trust level for services associated with the NF. The NF security status information is part of the NF profile. The NF is a NF service producer, and the authentication code of the NF security state information is generated by the NF service producer using a private key or a shared key of the NF service producer. The NF is a NF service consumer, and the authentication code of the NF security state information is generated by the NF service consumer using a private key or a shared key of the NF service consumer. The method also includes verifying the NF security state information by verifying the authentication code of the NF security state information using a public key or a shared key. The method also includes verifying the NF security state information by matching the NF ID or NF instance ID corresponding to the stored NF security state information associated with the NF. The method also includes storing an NF profile of the NF, the NF profile at least including the NF ID, the stored NF security state information associated with the NF, and the trust evaluation information associated with the NF. The access control security policy for the service associated with the NF includes an allowed trust level for the service associated with the NF and at least one of a service provision restriction list, a service consumption restriction list, or a resource access restriction list. The NF request is received from the NF as an NF registration request; and the NF response is sent to the NF as an NF registration response. The NF request is received from the NF as an NF registration update request; and the NF response is sent to the NF as an NF registration update response. The NF Request is received from the NF as a NF Discovery Request; and the NF Response is sent to the NF as a NF Discovery Response.

[0099] Additionally or alternatively, according to the examples disclosed herein, the device 702 may include a processor; a transceiver coupled to the processor; and a memory coupled to the processor, the processor and the transceiver being configured to: receive a first signaling from the NF as an NF request, the NF request including at least an NF type, an NF ID, and NF security status information; verify the NF security status based at least in part on the NF ID and the NF security status information; and send a second signaling as an NF response, the NF response including security verification of the NF request.

[0100] In addition, the wireless communication at the device 702 may include any one or combination of processors configured to enforce access control security policies for services associated with the NF. The processor is configured to generate access control security policies for services associated with the NF. The processor is configured to generate access control security policies based on at least one or more of the established policies, NF profile information, NF security status information, or the allowed trust levels for services associated with the NF. The processor is configured to enforce access control security policies based at least in part on the allowed trust range values ​​for NF service consumers to consume services associated with the NF; and to send a third signaling to the NF service producer as an allowed trust range value to allow NF service consumers with allowed trust range values ​​to consume services associated with the NF. The NF response includes one or more allowed trust levels for services associated with the NF. The processor is configured to assign one or more allowed trust levels to services associated with the NF based at least in part on the established policies, NF trust information, and NF security data. The NF request includes an NF profile, an authentication code, and an indication of the trust level for services associated with the NF. The NF security status information is part of the NF profile. The NF is a NF service producer, and the authentication code of the NF security state information is generated by the NF service producer using a private key or a shared key of the NF service producer. The NF is a NF service consumer, and the authentication code of the NF security state information is generated by the NF service consumer using a private key or a shared key of the NF service consumer. The processor is configured to verify the NF security state information by verifying the authentication code of the NF security state information using a public key or a shared key. The processor is configured to verify the NF security state information by matching the NF ID or NF instance ID corresponding to the stored NF security state information associated with the NF. The processor is configured to store an NF profile of the NF, the NF profile comprising at least the NF ID, the stored NF security state information associated with the NF, and the trust evaluation information associated with the NF. The access control security policy for the service associated with the NF includes an allowed trust level for the service associated with the NF and at least one of a service provision restriction list, a service consumption restriction list, or a resource access restriction list. The NF request is received from the NF as a NF registration request; and the NF response is sent to the NF as a NF registration response. The NF request is received from the NF as a NF registration update request; and the NF response is sent to the NF as a NF registration update response. The NF Request is received from the NF as a NF Discovery Request; and the NF Response is sent to the NF as a NF Discovery Response.

[0101] For example, the processor 704 may support wireless communication at the device 702 according to the examples disclosed herein. The processor 704 may be configured to or otherwise support components for: receiving a first signaling as an access token request from a NF service consumer, the access token request including at least NF profile information and NF security state information; authorizing the NF service consumer based at least in part on the NF profile information and the NF security state information; and sending a second signaling as an access token response to the NF service consumer, the access token response including the access token.

[0102] In addition, the processor 704 may be configured to or otherwise support any one or combination of generating an access token that allows the NF service consumer to access services associated with the NF service producer. The NF service consumer is authorized at least in part based on the access control security policy. The NF service consumer is authorized at least in part based on the stored trust assessment data. Authorizing the NF service consumer also includes sending a NF trust request to a trust assessment service, the NF trust request including at least the NF ID and NF security status information of the NF service consumer; and receiving a NF trust response from the trust assessment service, the NF trust response including the trust verification of the NF service consumer. The access token includes NF trust information associated with the NF service consumer. The NF profile information and the NF security status information are digitally signed by the NF service consumer using a private key or a shared key of the NF service consumer.

[0103] Additionally or alternatively, according to the examples disclosed herein, device 702 may include a processor; a transceiver coupled to the processor; and a memory coupled to the processor, the processor and the transceiver being configured to: receive a first signaling as an access token request from a NF service consumer, the access token request including at least NF profile information and NF security status information; authorize the NF service consumer based at least in part on the NF profile information and the NF security status information; and send a second signaling as an access token response to the NF service consumer, the access token response including the access token.

[0104] In addition, the wireless communication at the device 702 may include any one or a combination of the following: the processor is configured to generate an access token that allows the NF service consumer to access services associated with the NF service producer. The processor is configured to authorize the NF service consumer based at least in part on the access control security policy. The processor is configured to authorize the NF service consumer based at least in part on the trust assessment data stored by the device. In order to authorize the NF service consumer, the processor is configured to send a NF trust request to the trust assessment service, the NF trust request including at least the NF ID and NF security status information of the NF service consumer; and receive a NF trust response from the trust assessment service, the NF trust response including the trust verification of the NF service consumer. The access token includes NF trust information associated with the NF service consumer. The NF profile information and the NF security status information are digitally signed by the NF service consumer using the private key or shared key of the NF service consumer.

[0105] The processor 704 may include an intelligent hardware device (e.g., a general purpose processor, a DSP, a CPU, a microcontroller, an ASIC, an FPGA, a programmable logic device, a discrete gate or transistor logic component, a discrete hardware component, or any combination thereof). In some implementations, the processor 704 may be configured to operate a memory array using a memory controller. In some other implementations, the memory controller may be integrated into the processor 704. The processor 704 may be configured to execute computer-readable instructions stored in a memory (e.g., memory 706) to cause the device 702 to perform various functions of the present disclosure.

[0106] The memory 706 may include random access memory (RAM) and read-only memory (ROM). The memory 706 may store computer-readable, computer-executable code, including instructions, that, when executed by the processor 704, cause the device 702 to perform various functions described herein. The code may be stored in a non-transitory computer-readable medium, such as a system memory or another type of memory. In some implementations, the code may not be directly executable by the processor 704, but may cause a computer (e.g., when compiled and executed) to perform the functions described herein. In some implementations, the memory 706 may include a basic I / O system (BIOS), which may control basic hardware or software operations, such as interaction with peripheral components or devices.

[0107] I / O controller 710 can manage input and output signals for device 702. I / O controller 710 can also manage peripheral devices that are not integrated into device 2402. In some implementations, I / O controller 710 can represent a physical connection or port to an external peripheral device. In some implementations, I / O controller 710 can utilize a processor such as a CPU, a CPU module, or a CPU core. , or other known operating systems. In some implementations, I / O controller 710 may be implemented as part of a processor, such as processor 704. In some implementations, a user may interact with device 702 via I / O controller 710 or via hardware components controlled by I / O controller 710.

[0108] In some implementations, the device 702 may include a single antenna 712. However, in some other implementations, the device 702 may have multiple antennas 712 (e.g., multiple antennas), including multiple antenna panels or antenna arrays, which may be able to send or receive multiple wireless transmissions concurrently. The transceiver 708 may communicate bidirectionally via one or more antennas 712, wired or wireless links as described herein. For example, the transceiver 708 may represent a wireless transceiver and may communicate bidirectionally with another wireless transceiver. The transceiver 708 may also include a modem for modulating packets to provide the modulated packets to one or more antennas 712 for transmission and demodulating packets received from one or more antennas 712.

[0109] Figure 8 An example of a block diagram 800 of a device 802 that supports secure management of trusted network functions according to aspects of the present disclosure is shown. The device 802 may be an example of a device that implements a NF service producer 122 and / or a NF service consumer 124 as described herein. The device 802 may support wireless communications with one or more network entities 102, UEs 104, or any combination thereof. The device 802 may include components for bidirectional communications, including components for sending and receiving communications, such as a processor 804, a memory 806, a transceiver 808, and an I / O controller 810. These components may be in electronic communication or otherwise coupled (e.g., operationally, communicatively, functionally, electronically, electrically) via one or more interfaces (e.g., a bus).

[0110] The processor 804, the memory 806, the transceiver 808, or various combinations thereof, or various components thereof may be examples of means for performing various aspects of the present disclosure described herein. For example, the processor 804, the memory 806, the transceiver 808, or various combinations or components thereof may support methods for performing one or more operations described herein.

[0111] In some implementations, the processor 804, memory 806, transceiver 808, or various combinations or components thereof may be implemented in hardware (e.g., in a communications management circuit system). The hardware may include a processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof, configured to or otherwise support components for performing the functions described in the present disclosure. In some implementations, the processor 804 and the memory 806 coupled to the processor 804 may be configured to perform one or more functions described herein (e.g., execution of instructions stored in the memory 806 by the processor 804).

[0112] For example, the processor 804 may support wireless communication at the device 802 according to the examples disclosed herein. The processor 804 may be configured to or otherwise support components for: receiving a first signaling as a NF service request from a NF service consumer, the NF service request including at least a NF ID of the NF service consumer and an access token with NF trust information; verifying the NF trust information associated with the NF ID of the requesting service that allows the NF service request; and sending a second signaling as a NF service response to the NF service consumer.

[0113] In addition, the processor 804 may be configured to or otherwise support performing any one or combination of the requested services for the NF service consumer. The method also includes verifying the NF service request based at least in part on the access control security policy. The method also includes authorizing the NF service request based at least in part on the trust assessment data stored by the device. Verifying the NF trust information also includes sending a NF trust request to a trust assessment service, the NF trust request including at least the NF ID of the NF service consumer and the NF trust information; and receiving a NF trust response from the trust assessment service, the NF trust response including the trust verification of the NF service request. The trust assessment service is at least one of an NRF, an NWDAF, or a TESF.

[0114] Additionally or alternatively, according to an example as disclosed herein, device 802 may include a processor; a transceiver coupled to the processor; and a memory coupled to the processor, the processor and the transceiver being configured to: receive a first signaling as an NF service request from an NF service consumer, the NF service request including at least an NF ID of the NF service consumer and an access token with NF trust information; verify the NF trust information associated with the NF ID of the requesting service that allows the NF service request; and send a second signaling as an NF service response to the NF service consumer.

[0115] In addition, the wireless communication at the device 802 may include any one or combination of processors configured to perform the requested service for the NF service consumer. The processor is configured to verify the NF service request based at least in part on the access control security policy. The processor is configured to authorize the NF service request based at least in part on the trust assessment data stored by the device. In order to verify the NF trust information, the processor is configured to send a NF trust request to the trust assessment service, the NF trust request including at least the NF ID and NF trust information of the NF service consumer; and receive a NF trust response from the trust assessment service, the NF trust response including the trust verification of the NF service request. The trust assessment service is at least one of NRF, NWDAF or TESF.

[0116] The processor 804 may include an intelligent hardware device (e.g., a general purpose processor, a DSP, a CPU, a microcontroller, an ASIC, an FPGA, a programmable logic device, a discrete gate or transistor logic component, a discrete hardware component, or any combination thereof). In some implementations, the processor 804 may be configured to operate a memory array using a memory controller. In some other implementations, the memory controller may be integrated into the processor 804. The processor 804 may be configured to execute computer-readable instructions stored in a memory (e.g., memory 806) to cause the device 802 to perform various functions of the present disclosure.

[0117] The memory 806 may include random access memory (RAM) and read-only memory (ROM). The memory 806 may store computer-readable, computer-executable code, including instructions, that, when executed by the processor 804, cause the device 802 to perform various functions described herein. The code may be stored in a non-transitory computer-readable medium, such as a system memory or another type of memory. In some implementations, the code may not be directly executable by the processor 804, but may cause a computer (e.g., when compiled and executed) to perform the functions described herein. In some implementations, the memory 806 may include a basic I / O system (BIOS), which may control basic hardware or software operations, such as interaction with peripheral components or devices.

[0118] The I / O controller 810 can manage input and output signals for the device 802. The I / O controller 810 can also manage peripheral devices that are not integrated into the device 2402. In some implementations, the I / O controller 810 can represent a physical connection or port to an external peripheral device. In some implementations, the I / O controller 810 can utilize a processor such as a Or other known operating systems. In some implementations, I / O controller 810 can be implemented as part of a processor (such as processor 804). In some implementations, a user can interact with device 802 via I / O controller 810 or via hardware components controlled by I / O controller 810.

[0119] In some implementations, the device 802 may include a single antenna 812. However, in some other implementations, the device 802 may have multiple antennas 812 (e.g., multiple antennas), including multiple antenna panels or antenna arrays, which may be able to send or receive multiple wireless transmissions concurrently. The transceiver 808 may communicate bidirectionally via one or more antennas 812, wired or wireless links as described herein. For example, the transceiver 808 may represent a wireless transceiver and may communicate bidirectionally with another wireless transceiver. The transceiver 808 may also include a modem for modulating packets, providing the modulated packets to one or more antennas 812 for transmission, and demodulating packets received from one or more antennas 812.

[0120] Fig. 9 A flowchart of a method 900 for supporting secure management of trusted network functions according to aspects of the present disclosure is shown. The operations of the method 900 may be implemented by a device or component thereof as described herein. For example, the operations of the method 900 may be performed by an NRF, as described in reference to Figures 1 to 8 In some implementations, the device may execute a set of instructions to control functional elements of the device to perform the functions. Additionally or alternatively, the device may use dedicated hardware to perform aspects of the functions.

[0121] At 902, the method may include receiving first signaling from the NF as an NF request, the NF request including at least the NF type, the NF ID, and the NF security status information. The operation of 902 may be performed according to the examples described herein. In some implementations, aspects of the operation of 902 may be referred to as Figure 1 The device described performs the following.

[0122] At 904, the method may include verifying the NF security state based at least in part on the NF ID and the NF security state information. The operation of 904 may be performed according to the examples described herein. In some implementations, aspects of the operation of 904 may be described in detail in the context of FIG. Figure 1 The device described is used to perform the

[0123] At 906, the method may include sending a second signaling as a NF response, the NF response including a security verification of the NF request. The operation of 906 may be performed according to the examples described herein. In some implementations, aspects of the operation of 906 may be described in detail in the context of FIG. Figure 1 The device described is used to perform the

[0124] Fig.10 1000 is a flowchart of a method 1000 for supporting secure management of trusted network functions according to aspects of the present disclosure. The operations of the method 1000 may be implemented by the devices described herein or components thereof. For example, the operations of the method 1000 may be performed by an NRF, as described in reference to Figures 1 to 8 In some implementations, the device may execute a set of instructions to control functional elements of the device to perform the functions. Additionally or alternatively, the device may use dedicated hardware to perform aspects of the functions.

[0125] At 1002, the method may include verifying the NF security state information by verifying the authentication code of the NF security state information using a public key or a shared key. The operation of 1002 may be performed according to the examples described herein. In some implementations, aspects of the operation of 1002 may be as described in reference to Figure 1 The device performs.

[0126] At 1004, the method may include verifying the NF security state information by matching the NF ID or NF instance ID corresponding to the stored NF security state information associated with the NF. The operation of 1004 may be performed according to the examples described herein. In some implementations, aspects of the operation of 1004 may be described by reference to Figure 1 The device described performs the following.

[0127] At 1006, the method may include generating an access control security policy for a service associated with the NF. The operations of 1006 may be performed according to examples as described herein. In some implementations, aspects of the operations of 1006 may be described by reference to Figure 1 The device described performs the following.

[0128] At 1008, the method may include enforcing an access control security policy for services associated with the NF. The operations of 1008 may be performed according to examples as described herein. In some implementations, aspects of the operations of 1008 may be described in detail in conjunction with the examples described herein. Figure 1 The device described performs the following.

[0129] At 1010, the method may include storing an NF profile of the NF, the NF profile including the NF ID, stored NF security state information associated with the NF, and trust assessment information associated with the NF. The operations of 1010 may be performed according to examples as described herein. In some implementations, aspects of the operations of 1010 may be described with reference to Figure 1 The device described is used to perform the

[0130] At 1012, the method may include sending a third signaling to the NF service producer as an allowed trust range value to allow the NF service consumer with the allowed trust range value to consume the service associated with the NF. The operation of 1012 may be performed according to the examples described herein. In some implementations, aspects of the operation of 1012 may be described with reference to Figure 1 The device described is used to perform the

[0131] At 1014, the method may include assigning one or more allowed trust levels to services associated with the NF based on the established policy, NF trust information, and NF security data. The operations of 1014 may be performed according to examples as described herein. In some implementations, aspects of the operations of 1014 may be described with reference to Figure 1 The device described performs the following.

[0132] Fig.11 1 is a flowchart of a method 1100 for supporting secure management of trusted network functions according to aspects of the present disclosure. The operations of the method 1100 may be implemented by a device or component thereof as described herein. For example, the operations of the method 1100 may be performed by an NRF, as described in reference to Figures 1 to 8 In some implementations, the device may execute a set of instructions to control functional elements of the device to perform the functions. Additionally or alternatively, the device may use dedicated hardware to perform aspects of the functions.

[0133] At 1102, the method may include receiving first signaling from a NF service consumer as an access token request, the access token request including at least NF profile information and NF security state information. The operation of 1102 may be performed according to the examples described herein. In some implementations, aspects of the operation of 1102 may be described by reference to Figure 1 The device is used to perform the above.

[0134] At 1104, the method may include authorizing the NF service consumer based on the NF profile information and the NF security status information. The operations of 1104 may be performed according to examples as described herein. In some implementations, aspects of the operations of 1104 may be described in detail in conjunction with the referenced embodiments. Figure 1 The device described performs the following.

[0135] At 1106, the method may include sending a second signaling to the NF service consumer as an access token response, the access token response including the access token. The operation of 1106 may be performed according to the examples described herein. In some implementations, aspects of the operation of 1106 may be described by reference to Figure 1 The device described performs the following.

[0136] Fig.121 is a flow chart of a method 1200 for supporting secure management of trusted network functions according to aspects of the present disclosure. The operations of the method 1200 may be implemented by a device or components thereof as described herein. For example, the operations of the method 1200 may be performed by an NRF, as described in reference to Figures 1 to 8 In some implementations, the device may execute a set of instructions to control functional elements of the device to perform the functions. Additionally or alternatively, the device may use dedicated hardware to perform aspects of the functions.

[0137] At 1202, the method may include sending a NF trust request to a trust assessment service, the NF trust request including at least an NF ID of the NF service consumer and NF security status information. The operations of 1202 may be performed according to the examples described herein. In some implementations, aspects of the operations of 1202 may be described by reference to Figure 1 The device performs.

[0138] At 1204, the method may include receiving a NF trust response from a trust assessment service, the NF trust response including a trust verification of the NF service consumer. The operations of 1204 may be performed according to examples as described herein. In some implementations, aspects of the operations of 1204 may be described by reference to Figure 1 The device described performs the following.

[0139] At 1206, the method may include generating an access token that allows the NF service consumer to access services associated with the NF service producer. The operations of 1206 may be performed according to examples as described herein. In some implementations, aspects of the operations of 1206 may be described by reference to Figure 1 The device described performs the following.

[0140] Fig.13 A flow chart of a method 1300 for supporting secure management of a trusted network function according to aspects of the present disclosure is shown. The operations of the method 1300 may be implemented by a device or a component thereof as described herein. For example, the operations of the method 1300 may be performed by a NF service producer and / or a NF service consumer, as described in reference to Figures 1 to 8 In some implementations, the device may execute a set of instructions to control functional elements of the device to perform the functions. Additionally or alternatively, the device may use dedicated hardware to perform aspects of the functions.

[0141] At 1302, the method may include receiving first signaling from a NF service consumer as a NF service request, the NF service request including at least a NF ID of the NF service consumer and an access token with NF trust information. The operations of 1302 may be performed according to examples as described herein. In some implementations, aspects of the operations of 1302 may be described with reference to Figure 1 The device performs.

[0142] At 1304, the method may include verifying NF trust information associated with the NF ID of the requested service that allows the NF service request. The operations of 1304 may be performed according to examples as described herein. In some implementations, aspects of the operations of 1304 may be described in detail in conjunction with reference to Figure 1 The device described performs the following.

[0143] At 1306, the method may include sending a second signaling to the NF service consumer as a NF service response. The operations of 1306 may be performed according to the examples described herein. In some implementations, aspects of the operations of 1306 may be described by reference to Figure 1 The device described performs the following.

[0144] Fig.14 A flow chart of a method 1400 for supporting secure management of a trusted network function according to aspects of the present disclosure is shown. The operations of the method 1400 may be implemented by a device or a component thereof as described herein. For example, the operations of the method 1400 may be performed by a NF service producer and / or a NF service consumer, as described in reference to Figures 1 to 8 In some implementations, the device may execute a set of instructions to control functional elements of the device to perform the functions. Additionally or alternatively, the device may use dedicated hardware to perform aspects of the functions.

[0145] At 1402, the method may include validating the NF service request based at least in part on the access control security policy. The operations of 1402 may be performed according to examples as described herein. In some implementations, aspects of the operations of 1402 may be described in detail in conjunction with reference to Figure 1 The device performs.

[0146] At 1404, the method may include authorizing the NF service request based on the trust evaluation data stored by the device. The operations of 1404 may be performed according to examples as described herein. In some implementations, aspects of the operations of 1404 may be described with reference to Figure 1 The device described performs the following.

[0147] At 1406, the method may include sending a NF trust request to a trust evaluation service, the NF trust request including at least the NF ID of the NF service consumer and the NF trust information. The operation of 1406 may be performed according to the examples described herein. In some implementations, aspects of the operation of 1406 may be described by reference to Figure 1 The device described performs the following.

[0148] At 1408, the method may include receiving a NF trust response from the trust assessment service, the NF trust response including a trust verification of the NF service request. The operations of 1408 may be performed according to examples as described herein. In some implementations, aspects of the operations of 1408 may be described by reference to Figure 1 The device described performs the following.

[0149] At 1410, the method may include performing the requested service for the NF service consumer. The operations of 1410 may be performed according to examples as described herein. In some implementations, aspects of the operations of 1410 may be described by reference to Figure 1 The device performs.

[0150] It should be noted that the methods described herein describe possible implementations, and that the operations and steps may be rearranged or otherwise modified, and that other implementations are possible. Furthermore, aspects from two or more methods may be combined.

[0151] The various illustrative blocks and components described in connection with the disclosure herein may be implemented or performed with a general purpose processor, a DSP, an ASIC, a CPU, an FPGA or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general purpose processor may be a microprocessor, but alternatively, the processor may be any processor, controller, microcontroller, or state machine. A processor may also be implemented as a combination of computing devices (e.g., a combination of a DSP and a microprocessor, a plurality of microprocessors, a combination of one or more microprocessors and a DSP core, or any other such configuration).

[0152] The functions described herein may be implemented in hardware, software executed by a processor, firmware, or any combination thereof. If implemented in software executed by a processor, the functions may be stored as one or more instructions or codes on or sent via a computer-readable medium. Other examples and implementations are within the scope of this disclosure and the appended claims. For example, due to the nature of software, the functions described herein may be implemented using software executed by a processor, hardware, firmware, hard wiring, or any combination of these. Features that implement the functions may also be physically located in various locations, including distribution, such that parts of the functions are implemented in different physical locations.

[0153] Computer-readable media include non-transient computer storage media and communication media, including any medium that facilitates the transfer of a computer program from one place to another. Non-transient storage media can be any available medium that can be accessed by a general or special-purpose computer. By way of example, and not limitation, non-transient computer-readable media can include RAM, ROM, electrically erasable programmable ROM (EEPROM), flash memory, compact disk (CD) ROM or other optical disk storage, disk storage or other magnetic storage device, or can be used to carry or store required program code components in the form of instructions or data structures and can be accessed by a general or special-purpose computer or a general or special-purpose processor.

[0154] Any connection may be appropriately referred to as a computer-readable medium. For example, if the software is sent from a website, server, or other remote source using a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technology (such as infrared, radio, and microwave), the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technology (such as infrared, radio, and microwave) are all included in the definition of computer-readable media. As used herein, disks and optical disks include CDs, laser discs, optical disks, digital versatile discs (DVDs), floppy disks, and Blu-ray discs, where disks typically reproduce data magnetically, while optical disks reproduce data optically using lasers. The above combinations are also included within the scope of computer-readable media.

[0155] As used herein, including in the claims, "or" as used in a list of items (e.g., a list of items beginning with a phrase such as "at least one" or "one or more" or "one or two") indicates an inclusive list, for example, a list of at least one of A, B, or C means A or B or C or AB or AC or BC or ABC (e.g., A and B and C). Similarly, a list of one or more of A, B, or C means A or B or C or AB or AC or BC or ABC (e.g., A and B and C). In addition, as used herein, the phrase "based on" should not be interpreted as a reference to a closed set of conditions. For example, an example step described as "based on condition A" can be based on condition A and condition B without departing from the scope of the present disclosure. In other words, as used herein, the phrase "based on" should be interpreted in the same manner as the phrase "based at least in part on". In addition, as used herein, including in the claims, a "set" may include one or more elements.

[0156] The terms "send," "receive," or "communicate," when referring to a network entity, may refer to any part of a network entity of a RAN (e.g., base station, CU, DU, RU) communicating with another device (e.g., directly or via one or more other network entities).

[0157] The descriptions set forth herein in conjunction with the accompanying drawings describe example configurations and do not represent all examples that may be implemented or within the scope of the claims. The term "example" as used herein means "used as an example, instance, or illustration," rather than "preferred" or "superior to other examples." The detailed description includes specific details for the purpose of providing an understanding of the technology. However, the technologies may be practiced without these specific details. In some cases, known structures and devices are shown in block diagram form to avoid obscuring the concepts of the examples.

[0158] The description herein is intended to enable one of ordinary skill in the art to make or use the present disclosure. Various modifications of the present disclosure will be apparent to one of ordinary skill in the art, and the general principles defined herein can be applied to other variations without departing from the scope of the present disclosure. Therefore, the present disclosure is not limited to the examples and designs described herein, but should be given the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A device for wireless communication, comprising: processor; a transceiver coupled to the processor; as well as A memory coupled to the processor, wherein the processor and the transceiver are configured to: receiving first signaling from the NF as a network function (NF) request, the NF request including at least: an NF type, an NF identifier (ID), and NF security status information; verifying a NF security status based at least in part on the NF ID and the NF security status information; and The second signaling is sent as an NF response, wherein the NF response includes: the security verification requested by the NF.

2. The apparatus of claim 1, wherein the processor is configured to: enforce an access control security policy for services associated with the NF.

3. The apparatus of claim 2, wherein the processor is configured to generate the access control security policy for the service associated with the NF.

4. The apparatus of claim 2, wherein the processor is configured to generate the access control security policy based on one or more of: an established policy, NF profile information, the NF security status information, or an allowed trust level for the service associated with the NF.

5. The apparatus of claim 2, wherein the processor is configured to: enforcing the access control security policy based at least in part on an allowed trust scope value for an NF service consumer to consume the service associated with the NF; and A third signaling is sent to the NF service producer as the allowed trust range value to allow the NF service consumer having the allowed trust range value to consume the service associated with the NF.

6. The device according to claim 1, wherein: The NF response includes: one or more allowed trust levels for services associated with the NF; and The processor is configured to assign the one or more allowed trust levels for the service associated with the NF based at least in part on: established policies, NF trust information, and NF security data.

7. The apparatus of claim 1, wherein the NF request comprises: A NF profile, an authentication code, and an indication of a trust level for services associated with the NF, and the NF security status information is part of the NF profile.

8. The device according to claim 7, wherein at least one of the following: The NF is a NF service producer, and the authentication code of the NF security status information is generated by the NF service producer using a private key or a shared key of the NF service producer; or The NF is a NF service consumer, and the authentication code of the NF security status information is generated by the NF service consumer using the private key or the shared key of the NF service consumer.

9. The apparatus according to claim 7, wherein the processor is configured to verify the NF security status information by verifying the authentication code of the NF security status information using a public key or a shared key.

10. The apparatus of claim 1, wherein the processor is configured to: verifying the NF security status information by matching the NF ID or NF instance ID corresponding to stored NF security status information, the stored NF security status information being associated with the NF; and A NF configuration file of the NF is stored, wherein the NF configuration file at least includes: The NFID, the stored NF security status information associated with the NF, and trust evaluation information associated with the NF.

11. The apparatus according to claim 1, wherein the access control security policy for the service associated with the NF comprises: The allowed trust level for a service associated with the NF and at least one of: a service provision restriction list, a service consumption restriction list, or a resource access restriction list.

12. The device of claim 1, wherein at least one of the following: The NF request is received from the NF as a NF registration request, and the NF response is sent to the NF as a NF registration response; The NF request is received from the NF as a NF registration update request, and the NF response is sent to the NF as a NF registration update response; or The NF request is received from the NF as a NF discovery request, and the NF response is sent to the NF as a NF discovery response.

13. An apparatus for wireless communication, comprising: processor; a transceiver coupled to the processor; as well as A memory coupled to the processor, wherein the processor and the transceiver are configured to: receiving first signaling from a network function (NF) service consumer as an access token request, the access token request comprising at least: NF profile information and NF security state information; authorizing the NF service consumer based at least in part on the NF profile information and the NF security status information; and A second signaling is sent to the NF service consumer as an access token response, wherein the access token response includes an access token.

14. The apparatus of claim 13, wherein the processor is configured to authorize the NF service consumer based at least in part on an access control security policy.

15. The apparatus of claim 13, wherein the processor is configured to authorize the NF service consumer based at least in part on trust assessment data stored by the apparatus.

16. The apparatus according to claim 13, wherein in order to authorize the NF service consumer, the processor is configured to: Sending a NF trust request to a trust assessment service, wherein the NF trust request includes at least: an NF identifier (ID) of the NF service consumer, and the NF security status information; as well as A NF trust response is received from the trust assessment service, wherein the NF trust response includes: a trust verification of the NF service consumer.

17. The apparatus of claim 13, wherein the processor is configured to generate the access token that allows the NF service consumer to access services associated with the NF service producer, the access token comprising: NF trust information associated with the NF service consumer.

18. An apparatus for wireless communication, comprising: processor; a transceiver coupled to the processor; as well as A memory coupled to the processor, wherein the processor and the transceiver are configured to: receiving a first signaling as a network function (NF) service request from a NF service consumer, the NF service request including at least: an NF identifier (ID) of the NF service consumer, and an access token having NF trust information; verifying the NF trust information associated with the NF ID requesting service to allow the NF service request; and A second signaling is sent to the NF service consumer as an NF service response.

19. The apparatus of claim 18, wherein the processor is configured to verify the NF service request based at least in part on an access control security policy.

20. The apparatus of claim 18, wherein the processor is configured to authorize the NF service request based at least in part on trust assessment data stored by the apparatus.

Images