Device, method and apparatus for network slice isolation, and computer readable medium

Abstract

Apparatuses, methods, apparatus, and computer readable media for network slice isolation are disclosed. An example terminal device may include at least one processor and at least one memory. The at least one memory may include computer program code, and the at least one memory and the computer program code may be configured, with the at least one processor, to cause the terminal device to perform: receiving security information specific to a network slice from a core network device; and based on the security information, obtaining at least one key specific to the network slice from a key of an access network device associated with the terminal device, the key of the access network device being shared by the access network device or specific to the network slice.

Description

Technical Field

[0001] Various embodiments relate to devices, methods, apparatus, and computer-readable media for network slice isolation. Background Art

[0002] A network slice (also referred to as a slice) can be understood as a logical network on a shared infrastructure. For example, by coexisting multiple network slice instances on the same network infrastructure, various communication service instances with different requirements for data rate, reliability, latency, communication range, and speed can be supported. Different service types may include different degrees of isolation and security requirements. Since network slice instances are configured on a shared infrastructure, strict network slice isolation needs to be ensured to ensure security across network slices and reduce the impact of compromised network functions on other network slices. Weak network slice isolation may compromise the security of the entire network. For example, sensitive data of one network slice may be exposed to applications running in other network slices through side channel attacks. This risk is higher if resources are distributed across multiple domains of the network architecture. Therefore, network slice isolation is very important for reliable and guaranteed service assurance and is critical for network deployment based on network slicing technology. Summary of the invention

[0003] A brief summary of exemplary embodiments is provided below to provide a basic understanding of some aspects of various embodiments. It should be noted that this summary is not intended to identify key features of essential elements or define the scope of the embodiments, and its sole purpose is to introduce some concepts in a simplified form as a prelude to the more detailed description provided below.

[0004] In a first aspect, a terminal device is disclosed. The terminal device may include at least one processor and at least one memory. The at least one memory may include computer program code, and the at least one memory and the computer program code may be configured to, together with the at least one processor, enable the terminal device to perform: receiving security information specific to a network slice from a core network device; and based on the security information, deriving at least one key specific to the network slice from a key of an access network device with which the terminal device is associated, wherein the key of the access network device is common to the access network devices or specific to the network slice.

[0005] In some example embodiments, the at least one memory and the computer program code may also be configured, together with the at least one processor, so that the terminal device further performs: during a registration process, sending to the core network device the capability of supporting different keys and / or encryption algorithms for different network slices.

[0006] In some example embodiments, the security information may be received in a registration acceptance, and the registration acceptance may further include: a lifetime of the at least one key.

[0007] In some example embodiments, the security information may be received in a configuration update command, and the configuration update command may further include: a lifetime of the at least one key.

[0008] In some example embodiments, the at least one memory and the computer program code may also be configured, together with the at least one processor, so that the terminal device further performs: sending a network slice-specific security request to a core network device, security information may be received in a response to the security request, and the response may also include: the lifetime of at least one key.

[0009] In some example embodiments, the security information may be received via a protocol data unit session setup accept.

[0010] In some example embodiments, the at least one memory and the computer program code may also be configured, together with the at least one processor, to enable the terminal device to perform: deriving a key of a core network device specific to the network slice from the key of the core network device based on the identity information of the network slice; and deriving a key of an access network device specific to the network slice from the key of the core network device specific to the network slice.

[0011] In some example embodiments, the security information may include at least one of: an indication for deriving at least one key specific to the network slice, identity information of the network slice, and encryption algorithm information specific to the network slice.

[0012] In some example embodiments, the at least one key may include at least one of: a network slice-specific key for user plane integrity, a network slice-specific key for user plane encryption, a network slice-specific key for radio resource control integrity, and a network slice-specific key for radio resource control encryption.

[0013] In some example embodiments, the at least one memory and the computer program code may also be configured, together with the at least one processor, so that the terminal device also performs: protecting data in the network slice using at least one of the following items: a key for user plane integrity, and an encryption algorithm for deriving a key for user plane integrity, and a key for user plane encryption, and an encryption algorithm for deriving a key for user plane encryption.

[0014] In a second aspect, an access network device is disclosed. The access network device may include at least one processor and at least one memory. The at least one memory may include computer program code, and the at least one memory and the computer program code may be configured to, together with the at least one processor, enable the access network device to perform: receiving security information specific to a network slice from a core network device; and deriving at least one key specific to the network slice from a key of the access network device based on the security information, wherein the key of the access network device is common to the access network device or specific to the network slice.

[0015] In some example embodiments, the security information may be received in a configuration message of the terminal device, and the configuration message may further include: a lifetime of at least one key.

[0016] In some example embodiments, the security information may be received from the core network device via a protocol data unit session request.

[0017] In some example embodiments, the key of the access network device may be specific to the network slice and derived by the core network device from the key of the core network device specific to the network slice, and the key of the core network device may be derived based on the identity information of the network slice.

[0018] In some example embodiments, the security information may include at least one of: an indication for deriving at least one key specific to the network slice, identity information of the network slice, and encryption algorithm information specific to the network slice.

[0019] In some example embodiments, the at least one key may include at least one of: a network slice-specific key for user plane integrity, a network slice-specific key for user plane encryption, a network slice-specific key for radio resource control integrity, and a network slice-specific key for radio resource control encryption.

[0020] In some example embodiments, the at least one memory and the computer program code may also be configured, together with the at least one processor, to cause the access network device to further perform: protecting data in the network slice using at least one of the following items: a key for user plane integrity and an encryption algorithm for deriving a key for user plane integrity, and a key for user plane encryption and an encryption algorithm for deriving a key for user plane encryption.

[0021] In some example embodiments, an access network device may be associated with a centralized unit control plane and a centralized unit user plane, and the centralized unit user plane may send encryption capabilities for a network slice list, or specific to a network slice, to the centralized unit control plane so that the centralized unit control plane makes a selection of the centralized unit user plane to support requirements for the network slice list, or specific to a network slice.

[0022] In a third aspect, a core network device is disclosed. The core network device may include at least one processor and at least one memory. The at least one memory may include computer program code, and the at least one memory and the computer program code may be configured to, together with the at least one processor, enable the core network device to perform: based on the ability of the terminal device to support different keys and / or encryption algorithms for different network slices, and a security policy specific to the network slice, determine security information specific to the network slice; and send security information specific to the network slice to the terminal device and the access network device associated with the terminal device, respectively, so that the terminal device and the access network device respectively derive at least one key specific to the network slice.

[0023] In some example embodiments, the at least one memory and the computer program code may also be configured, together with the at least one processor, to cause the core network device to further perform: during a registration process, receiving from the terminal device the capability to support different keys and / or encryption algorithms for different network slices.

[0024] In some example embodiments, the at least one memory and the computer program code may also be configured, together with the at least one processor, to cause the core network device to further perform: retrieving a security policy specific to a network slice from a policy device.

[0025] In some example embodiments, the at least one memory and the computer program code may also be configured, together with the at least one processor, to cause the core network device to further perform: deriving a key of a core network device specific to the network slice from the key of the core network device based on the identity information of the network slice; and deriving a key of an access network device specific to the network slice from the key of the core network device specific to the network slice.

[0026] In some example embodiments, the security information may include at least one of: an indication for deriving at least one key specific to the network slice, identity information of the network slice, and encryption algorithm information specific to the network slice.

[0027] In some example embodiments, the at least one memory and the computer program code may also be configured, together with the at least one processor, to cause the core network device to further perform: receiving a security request specific to a network slice from a terminal device, and security information being sent in a response to the security request.

[0028] In some example embodiments, the at least one memory and the computer program code may also be configured to, together with the at least one processor, cause the core network device to further perform: determining a lifetime of at least one key, the lifetime being sent together with the security information.

[0029] In a fourth aspect, a method performed by a terminal device is disclosed. The method may include: receiving security information specific to a network slice from a core network device; and deriving at least one key specific to the network slice from a key of an access network device associated with the terminal device based on the security information, wherein the key of the access network device is common to the access network devices or specific to the network slice.

[0030] In some example embodiments, the method may further include: during the registration process, sending to the core network device the capability of supporting different keys and / or encryption algorithms for different network slices.

[0031] In some example embodiments, the security information may be received in a registration acceptance, and the registration acceptance may further include: a lifetime of the at least one key.

[0032] In some example embodiments, the security information may be received in a configuration update command, and the configuration update command may further include: a lifetime of the at least one key.

[0033] In some example embodiments, the method may further include sending a network slice-specific security request to a core network device, the security information may be received in a response to the security request, and the response may further include a lifetime of at least one key.

[0034] In some example embodiments, the security information may be received via a protocol data unit session setup accept.

[0035] In some example embodiments, the method may further include: deriving a key of a core network device specific to the network slice from the key of the core network device based on the identity information of the network slice; and deriving a key of an access network device specific to the network slice from the key of the core network device specific to the network slice.

[0036] In some example embodiments, the security information may include at least one of: an indication for deriving at least one key specific to the network slice, identity information of the network slice, and encryption algorithm information specific to the network slice.

[0037] In some example embodiments, the at least one key may include at least one of: a network slice-specific key for user plane integrity, a network slice-specific key for user plane encryption, a network slice-specific key for radio resource control integrity, and a network slice-specific key for radio resource control encryption.

[0038] In some example embodiments, the method may further include protecting data in the network slice using at least one of: a key for user plane integrity and an encryption algorithm for deriving a key for user plane integrity, and a key for user plane encryption and an encryption algorithm for deriving a key for user plane encryption.

[0039] In a fifth aspect, a method performed by an access network device is disclosed. The method may include: receiving security information specific to a network slice from a core network device; and deriving at least one key specific to the network slice from a key of the access network device based on the security information, wherein the key of the access network device is common to the access network devices or specific to the network slice.

[0040] In some example embodiments, the security information may be received in a configuration message of the terminal device, and the configuration message may further include: a lifetime of at least one key.

[0041] In some example embodiments, the security information may be received from the core network device via a protocol data unit session request.

[0042] In some example embodiments, the key of the access network device may be specific to the network slice and derived by the core network device from the key of the core network device specific to the network slice, and the key of the core network device may be derived based on the identity information of the network slice.

[0043] In some example embodiments, the security information may include at least one of: an indication for deriving at least one key specific to the network slice, identity information of the network slice, and encryption algorithm information specific to the network slice.

[0044] In some example embodiments, the at least one key may include at least one of: a network slice-specific key for user plane integrity, a network slice-specific key for user plane encryption, a network slice-specific key for radio resource control integrity, and a network slice-specific key for radio resource control encryption.

[0045] In some example embodiments, the method may further include protecting data in the network slice using at least one of: a key for user plane integrity and an encryption algorithm for deriving a key for user plane integrity, and a key for user plane encryption and an encryption algorithm for deriving a key for user plane encryption.

[0046] In some example embodiments, an access network device may be associated with a centralized unit control plane and a centralized unit user plane, and the centralized unit user plane may send encryption capabilities for a network slice list, or specific to a network slice, to the centralized unit control plane so that the centralized unit control plane makes a selection of the centralized unit user plane to support requirements for the network slice list, or specific to a network slice.

[0047] In a sixth aspect, a method performed by a core network device is disclosed. The method may include: determining security information specific to a network slice based on the ability of a terminal device to support different keys and / or encryption algorithms for different network slices and a security policy specific to the network slice; and sending the security information specific to the network slice to the terminal device and the access network device associated with the terminal device, respectively, so that the terminal device and the access network device respectively derive at least one key specific to the network slice.

[0048] In some example embodiments, the method may further include receiving, during a registration process, from a terminal device the capability of supporting different keys and / or encryption algorithms for different network slices.

[0049] In some example embodiments, the method may further include retrieving a network slice-specific security policy from a policy device.

[0050] In some example embodiments, the method may further include: deriving a key of a core network device specific to the network slice from the key of the core network device based on the identity information of the network slice; and deriving a key of an access network device specific to the network slice from the key of the core network device specific to the network slice.

[0051] In some example embodiments, the security information may include at least one of: an indication for deriving at least one key specific to the network slice, identity information of the network slice, and encryption algorithm information specific to the network slice.

[0052] In some example embodiments, the method may further include receiving a network slice-specific security request from a terminal device, the security information being sent in a response to the security request.

[0053] In some example embodiments, the method may further comprise determining a lifetime of the at least one key, the lifetime being sent with the security information.

[0054] In a seventh aspect, an apparatus is disclosed. The apparatus as a terminal device may include: a component for receiving security information specific to a network slice from a core network device; and a component for deriving at least one key specific to the network slice from a key of an access network device associated with the terminal device based on the security information, wherein the key of the access network device is common to the access network devices or specific to the network slice.

[0055] In some example embodiments, the apparatus may further include a component for sending, during a registration process, to a core network device the capability of supporting different keys and / or encryption algorithms for different network slices.

[0056] In some example embodiments, the security information may be received in a registration acceptance, and the registration acceptance may further include: a lifetime of the at least one key.

[0057] In some example embodiments, the security information may be received in a configuration update command, and the configuration update command may further include: a lifetime of the at least one key.

[0058] In some example embodiments, the apparatus may further include: a component for sending a network slice-specific security request to a core network device, the security information may be received in a response to the security request, and the response may further include: a lifetime of at least one key.

[0059] In some example embodiments, the security information may be received via a protocol data unit session setup accept.

[0060] In some example embodiments, the apparatus may further include: a component for deriving a key of a core network device specific to the network slice from the key of the core network device based on the identity information of the network slice; and a component for deriving a key of an access network device specific to the network slice from the key of the core network device specific to the network slice.

[0061] In some example embodiments, the security information may include at least one of: an indication for deriving at least one key specific to the network slice, identity information of the network slice, and encryption algorithm information specific to the network slice.

[0062] In some example embodiments, the at least one key may include at least one of: a network slice-specific key for user plane integrity, a network slice-specific key for user plane encryption, a network slice-specific key for radio resource control integrity, and a network slice-specific key for radio resource control encryption.

[0063] In some example embodiments, the apparatus may further include: a component for protecting data in a network slice using at least one of: a key for user plane integrity and an encryption algorithm for deriving a key for user plane integrity, and a key for user plane encryption and an encryption algorithm for deriving a key for user plane encryption.

[0064] In an eighth aspect, an apparatus is disclosed. The apparatus as an access network device may include: a component for receiving security information specific to a network slice from a core network device; and a component for deriving at least one key specific to the network slice from a key of the access network device based on the security information, wherein the key of the access network device is common to the access network devices or specific to the network slice.

[0065] In some example embodiments, the security information may be received in a configuration message of the terminal device, and the configuration message may further include: a lifetime of at least one key.

[0066] In some example embodiments, the security information may be received from the core network device via a protocol data unit session request.

[0067] In some example embodiments, the key of the access network device may be specific to the network slice and derived by the core network device from the key of the core network device specific to the network slice, and the key of the core network device may be derived based on the identity information of the network slice.

[0068] In some example embodiments, the security information may include at least one of: an indication for deriving at least one key specific to the network slice, identity information of the network slice, and encryption algorithm information specific to the network slice.

[0069] In some example embodiments, the at least one key may include at least one of: a network slice-specific key for user plane integrity, a network slice-specific key for user plane encryption, a network slice-specific key for radio resource control integrity, and a network slice-specific key for radio resource control encryption.

[0070] In some example embodiments, the apparatus may further include: a component for protecting data in a network slice using at least one of: a key for user plane integrity and an encryption algorithm for deriving a key for user plane integrity, and a key for user plane encryption and an encryption algorithm for deriving a key for user plane encryption.

[0071] In some example embodiments, an access network device may be associated with a centralized unit control plane and a centralized unit user plane, and the centralized unit user plane may send encryption capabilities for a network slice list, or specific to a network slice, to the centralized unit control plane so that the centralized unit control plane makes a selection of the centralized unit user plane to support requirements for the network slice list, or specific to a network slice.

[0072] In a ninth aspect, an apparatus is disclosed. The apparatus as a core network device may include: a component for determining security information specific to a network slice based on the ability of a terminal device to support different keys and / or encryption algorithms for different network slices and a security policy specific to the network slice; and a component for sending the security information specific to the network slice to the terminal device and the access network device associated with the terminal device, respectively, so that the terminal device and the access network device respectively derive at least one key specific to the network slice.

[0073] In some example embodiments, the apparatus may further include a component for receiving, during a registration process, from a terminal device the ability to support different keys and / or encryption algorithms for different network slices.

[0074] In some example embodiments, the apparatus may further include: a component for retrieving a security policy specific to the network slice from a policy device.

[0075] In some example embodiments, the apparatus may further include: a component for deriving a key of a core network device specific to the network slice from the key of the core network device based on the identity information of the network slice; and a component for deriving a key of an access network device specific to the network slice from the key of the core network device specific to the network slice.

[0076] In some example embodiments, the security information may include at least one of: an indication for deriving at least one key specific to the network slice, identity information of the network slice, and encryption algorithm information specific to the network slice.

[0077] In some example embodiments, the apparatus may further include: a component for receiving a security request specific to a network slice from a terminal device, the security information being sent in a response to the security request.

[0078] In some example embodiments, the apparatus may further comprise means for determining a lifetime of the at least one key, the lifetime being sent with the security information.

[0079] In a tenth aspect, a computer-readable medium is disclosed. The computer-readable medium may include instructions stored thereon, the instructions being used to cause a terminal device to execute: receiving security information specific to a network slice from a core network device; and deriving at least one key specific to the network slice from a key of an access network device associated with the terminal device based on the security information, wherein the key of the access network device is common to the access network devices or specific to the network slice.

[0080] In some example embodiments, the computer-readable medium may also include instructions stored thereon, which are used to cause the terminal device to further execute: during the registration process, sending to the core network device the ability to support different keys and / or encryption algorithms for different network slices.

[0081] In some example embodiments, the security information may be received in a registration acceptance, and the registration acceptance may further include: a lifetime of the at least one key.

[0082] In some example embodiments, the security information may be received in a configuration update command, and the configuration update command may further include: a lifetime of the at least one key.

[0083] In some example embodiments, the computer-readable medium may also include instructions stored thereon, the instructions being used to cause the terminal device to further execute: sending a network slice-specific security request to a core network device, the security information may be received in a response to the security request, and the response may also include: the lifetime of at least one key.

[0084] In some example embodiments, the security information may be received via a protocol data unit session setup accept.

[0085] In some example embodiments, the computer-readable medium may also include instructions stored thereon, the instructions being used to cause the terminal device to further execute: deriving a key of a core network device specific to the network slice from the key of the core network device based on the identity information of the network slice; and deriving a key of an access network device specific to the network slice from the key of the core network device specific to the network slice.

[0086] In some example embodiments, the security information may include at least one of: an indication for deriving at least one key specific to the network slice, identity information of the network slice, and encryption algorithm information specific to the network slice.

[0087] In some example embodiments, the at least one key may include at least one of: a network slice-specific key for user plane integrity, a network slice-specific key for user plane encryption, a network slice-specific key for radio resource control integrity, and a network slice-specific key for radio resource control encryption.

[0088] In some example embodiments, the computer-readable medium may also include instructions stored thereon, the instructions being used to cause the terminal device to further execute: protecting data in the network slice using at least one of the following items: a key for user plane integrity and an encryption algorithm for deriving a key for user plane integrity, and a key for user plane encryption and an encryption algorithm for deriving a key for user plane encryption.

[0089] In an eleventh aspect, a computer-readable medium is disclosed. The computer-readable medium may include instructions stored thereon, the instructions being used to cause an access network device to execute: receiving security information specific to a network slice from a core network device; and deriving at least one key specific to the network slice from a key of the access network device based on the security information, wherein the key of the access network device is common to the access network device or specific to the network slice.

[0090] In some example embodiments, the security information may be received in a configuration message of the terminal device, and the configuration message may further include: a lifetime of at least one key.

[0091] In some example embodiments, the security information may be received from the core network device via a protocol data unit session request.

[0092] In some example embodiments, the key of the access network device may be specific to the network slice and derived by the core network device from the key of the core network device specific to the network slice, and the key of the core network device may be derived based on the identity information of the network slice.

[0093] In some example embodiments, the security information may include at least one of: an indication for deriving at least one key specific to the network slice, identity information of the network slice, and encryption algorithm information specific to the network slice.

[0094] In some example embodiments, the at least one key may include at least one of: a network slice-specific key for user plane integrity, a network slice-specific key for user plane encryption, a network slice-specific key for radio resource control integrity, and a network slice-specific key for radio resource control encryption.

[0095] In some example embodiments, the computer-readable medium may also include instructions stored thereon, the instructions being used to cause the access network device to further execute: protecting data in the network slice using at least one of the following items: a key for user plane integrity and an encryption algorithm for deriving a key for user plane integrity, and a key for user plane encryption and an encryption algorithm for deriving a key for user plane encryption.

[0096] In some example embodiments, an access network device may be associated with a centralized unit control plane and a centralized unit user plane, and the centralized unit user plane may send encryption capabilities for a network slice list, or specific to a network slice, to the centralized unit control plane so that the centralized unit control plane makes a selection of the centralized unit user plane to support requirements for the network slice list, or specific to a network slice.

[0097] In a twelfth aspect, a computer-readable medium is disclosed. The computer-readable medium may include instructions stored thereon, the instructions being used to cause a core network device to perform: determining security information specific to a network slice based on the ability of a terminal device to support different keys and / or encryption algorithms for different network slices, and a security policy specific to the network slice; and sending the security information specific to the network slice to the terminal device and the access network device associated with the terminal device, respectively, so that the terminal device and the access network device respectively derive at least one key specific to the network slice.

[0098] In some example embodiments, the computer-readable medium may also include instructions stored thereon, which are used to cause the core network device to further execute: during a registration process, receiving from the terminal device the ability to support different keys and / or encryption algorithms for different network slices.

[0099] In some example embodiments, the computer-readable medium may also include instructions stored thereon, the instructions being used to cause the core network device to further perform: retrieving a security policy specific to the network slice from a policy device.

[0100] In some example embodiments, the computer-readable medium may also include instructions stored thereon, the instructions being used to cause the core network device to further execute: deriving a key of the core network device specific to the network slice from the key of the core network device based on the identity information of the network slice; and deriving a key of an access network device specific to the network slice from the key of the core network device specific to the network slice.

[0101] In some example embodiments, the security information may include at least one of: an indication for deriving at least one key specific to the network slice, identity information of the network slice, and encryption algorithm information specific to the network slice.

[0102] In some example embodiments, the computer-readable medium may also include instructions stored thereon, the instructions being used to cause the core network device to further perform: receiving a security request specific to a network slice from a terminal device, and security information being sent in a response to the security request.

[0103] In some example embodiments, the computer-readable medium may further include instructions stored thereon, the instructions being configured to cause the core network device to further perform: determining a lifetime of at least one key, the lifetime being sent together with the security information.

[0104] Other features and advantages of example embodiments of the present disclosure will also be apparent from the following description of specific embodiments when read in conjunction with the accompanying drawings, which illustrate, by way of example, the principles of example embodiments of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0105] Some example embodiments will now be described, by way of non-limiting examples, with reference to the accompanying drawings.

[0106] Figure 1 Exemplary scenarios are shown in which example embodiments of the present disclosure may be implemented.

[0107] Figure 2 An exemplary sequence diagram of network slice isolation according to an example embodiment of the present disclosure is shown.

[0108] Figure 3 Another exemplary sequence diagram of network slice isolation according to an example embodiment of the present disclosure is shown.

[0109] Figure 4 Another exemplary sequence diagram of network slice isolation according to an example embodiment of the present disclosure is shown.

[0110] Figure 5 Another exemplary sequence diagram of network slice isolation according to an example embodiment of the present disclosure is shown.

[0111] Figure 6 A slice-specific key derivation diagram according to an example embodiment of the present disclosure is shown.

[0112] Figure 7 Another slice-specific key derivation diagram according to an example embodiment of the present disclosure is shown.

[0113] Figure 8 An exemplary sequence diagram of an E1AP interface management process according to an exemplary embodiment of the present disclosure is shown.

[0114] Fig. 9 Another exemplary sequence diagram of the E1AP interface management process according to an exemplary embodiment of the present disclosure is shown.

[0115] Fig.10 A flowchart illustrating an example method 1000 for network slice isolation according to an example embodiment of the present disclosure is shown.

[0116] Fig.11 A flowchart illustrating an example method 1100 for network slice isolation according to an example embodiment of the present disclosure is shown.

[0117] Fig.12 A flowchart illustrating an example method 1200 for network slice isolation according to an example embodiment of the present disclosure is shown.

[0118] Fig.13 A block diagram illustrating an example device 1300 for network slice isolation according to an example embodiment of the present disclosure is shown.

[0119] Fig.14 A block diagram illustrating an example device 1400 for network slice isolation according to an example embodiment of the present disclosure is shown.

[0120] Fig.15 A block diagram illustrating an example device 1500 for network slice isolation according to an example embodiment of the present disclosure is shown.

[0121] Fig.16 A block diagram illustrating an example apparatus 1600 for network slice isolation according to an example embodiment of the present disclosure is shown.

[0122] Fig.17 A block diagram illustrating an example apparatus 1700 for network slice isolation according to an example embodiment of the present disclosure is shown.

[0123] Fig.18 A block diagram illustrating an example apparatus 1800 for network slice isolation according to an example embodiment of the present disclosure is shown.

[0124] Throughout the drawings, the same or similar reference numerals denote the same or similar elements, and repeated description of the same elements will be omitted. DETAILED DESCRIPTION

[0125] Below, some example embodiments are described in detail with reference to the accompanying drawings. The following description includes specific details, which are intended to provide a thorough understanding of various concepts. However, it will be appreciated by those skilled in the art that these concepts can be practiced without these specific details. In some cases, well-known circuits, technologies, and components are shown in block diagram form to avoid obscuring the concepts and features described.

[0126] The exemplary embodiments of the present disclosure provide a solution for network slice isolation. According to the exemplary embodiments of the present disclosure, strict network slice isolation can be achieved by introducing network slice-specific key derivation. And because network slice-specific keys are used, different (e.g., high or low) security level configurations can be implemented between different network slices of the same user equipment (UE).

[0127] Figure 1 An exemplary scenario in which an exemplary embodiment of the present disclosure may be implemented is shown. Figure 1 In the figure, three example network slice instances (NSIs) A, B, and C are shown, and three root network slice subnet instances (NSSIs) A, B, and C are associated with NSI A, NSI B, and NSI C, respectively. NSSI A, NSSI B, and NSSI C constitute NSSI CN-1, NSSI CN-2, and NSSI CN-3, respectively, in the core network (CN), and constitute NSSI RAN-1 and NSSI RAN-2, respectively, in the radio access network (RAN). NSI A uses resources grouped in NSSI RAN-1, and NSI B and NSI C share the same resources grouped in NSSI RAN-2. In order to prevent a compromise in one slice from extending the risk to other slices, an example embodiment of the present disclosure may provide different key derivations for the logical separation between NSI A, NSI B, and NSI C at the RAN layer, so that strict slice isolation between NSIs may be ensured. In addition, in an example embodiment of the present disclosure, slice-specific key derivations may be implemented at the CN level as well as at the RAN level.

[0128] Figure 2 An exemplary sequence diagram of network slice isolation according to an exemplary embodiment of the present disclosure is shown. Figure 2 , UE 210 may represent any terminal device in a wireless communication network. Access network device 220 may be used as a base transceiver station (BTS) in a wireless communication network and serve UE 210. Core network device 230 may be used as an access and mobility management function (AMF) or a session management function (SMF) in a CN of a wireless communication network. Policy device 260 may be used as, for example, a unified data management (UDM), a network slice selection function (NSSF), and / or a policy control function (PCF) in a CN.

[0129] The UE 210 may send a capability 214 of supporting different keys and / or encryption algorithms for different network slices to the core network device 230 during the registration process. The capability 214 may be sent, for example, in the registration request 212. The encryption algorithm may relate to at least one of the following: a network slice-specific algorithm for user plane (UP) integrity, a network slice-specific algorithm for UP encryption, a network slice-specific algorithm for radio resource control (RRC) integrity, and a network slice-specific algorithm for RRC encryption.

[0130] Before, after, or simultaneously with receiving the capability 214, the core network device 230 may retrieve a security policy 262 specific to the network slice #n from the policy device 260. In this operation, for example, the core network device 230 may retrieve a slice security policy for the network slice in the allowed network slice selection assistance information (NSSAI), and find one or more network slices that require slice-specific protection, in which case the core network device 230 may obtain a security policy specific to the network slice that requires slice-specific protection from the policy device 260. For the sake of clarity and brevity, the following description will be made with respect to the network slice #n that requires slice-specific protection, but it will be understood that if there are multiple network slices that require slice-specific protection, the operations described with respect to the network slice #n may actually be performed on multiple network slices respectively, and the network slice #n may represent any one of the multiple network slices.

[0131] In the case where the capability 214 can support different keys for different network slices and the core network device 230 can retrieve the security policy 262 specific to the network slice #n, the key specific to the network slice #n can be derived. If the capability 214 can further support different encryption algorithms for different network slices, the key specific to the network slice #n can also be derived based on the encryption algorithm specific to the network slice #n.

[0132] In operation 234, the core network device 230 may determine security information 236 specific to the network slice #n based on the capability 214 and the security policy 262 specific to the network slice #n. In one embodiment, the security information 236 may include at least one of the following items: an indication for deriving at least one key specific to the network slice #n, identity information of the network slice #n, and encryption algorithm information specific to the network slice #n. Then, the core network device 230 may send the security information 236 specific to the network slice #n to the UE 210 and the access network device 220 with which the UE 210 is associated, respectively, so that the UE 210 and the access network device 220 respectively derive at least one key specific to the network slice #n.

[0133] In one embodiment, the security information 236 may be sent to the UE 210 via the registration acceptance 237, and may be sent to the access network device 220 via a configuration message (e.g., the initial context establishment request 235). Then, in operation 216, the UE 210 may derive at least one key specific to the network slice #n from the keys of the access network device 220 based on the security information 236, and in operation 226, the access network device 220 may derive at least one key specific to the network slice #n from the keys of the access network device 220 based on the security information 236. The key of the access network device 220 may be common to the access network device 220 or specific to the network slice #n.

[0134] As about Figure 1 As described above, the slice-specific key derivation can be implemented at the CN level and the RAN level. The following will describe the slice-specific key derivation at the CN level and the RAN level.

[0135] Figure 6 FIG. 2 shows a slice-specific key derivation diagram according to an exemplary embodiment of the present disclosure. If the security information 236 includes an indication for deriving at least one key specific to the network slice #n, the UE 210 may perform in operation 216 Figure 6 The slice #n specific key shown in is derived, and the access network device 220 can perform the derivation in operation 226. Figure 6 In, K gNB is the key of the access network device 220 shared by the access network device 220. The core network device 230 can derive K gNB , and K gNB (e.g., together with security information 236) is sent to access network device 220 and used to derive K gNB The parameters are sent to UE 210 so that UE 210 can obtain K gNB The identity information of the network slice #n in the security information 236 may be single network slice selection assistance information (S-NSSAI) #n. The UE 210 and the access network device 220 may derive the length of the S-NSSAI #n from the S-NSSAI #n, respectively, and both the S-NSSAI #n and the length of the S-NSSAI #n (not shown) are input to the key derivation function (KDF) 610, KDF 620, KDF 630, and KDF 640, respectively.

[0136] In addition to K gNBIn addition to the slice identity information, encryption algorithm information may also be input to KDF 610, KDF 620, KDF 630, and KDF 640. In one embodiment, the encryption algorithm information is not necessarily specific to network slice #n, and in this case, security information 236 may not include encryption algorithm information specific to network slice #n. Alternatively, in the case where security information 236 includes encryption algorithm information specific to network slice #n, encryption algorithm information specific to network slice #n may be input to KDF 610, KDF 620, KDF 630, and KDF 640. Figure 6 In the figure, encryption algorithm information specific to network slice #n is shown as an example, and it can be understood that a common encryption algorithm can be applied, and as long as S-NSSAI #n is input into KDF 610, 620, 630, and 640, the resulting key can be specific to network slice #n.

[0137] The common or specific encryption algorithm information of network slice #n may include an algorithm type discriminator and an algorithm identity. The UE 210 and the access network device 220 may respectively derive the length of the algorithm type discriminator and the length of the algorithm identity according to the algorithm type discriminator and the algorithm identity, and the algorithm type discriminator and the length of the algorithm type discriminator (not shown), and the algorithm identity and the length of the algorithm identity (not shown) may be input into the corresponding KDF.

[0138] like Figure 6 As shown in FIG. 6 , N-UP-int-alg may represent an algorithm type specifier of an algorithm used for UP integrity, Alg-ID may represent a corresponding algorithm identity, and both N-UP-int-alg and the corresponding Alg-ID and their lengths (not shown) may be input to KDF 610 to derive K. SUPint , which can represent the key for UP integrity specific to network slice #n. gNB It can be, for example, 256 bits, and the K output from KDF 610 is SUPint It can be 256 bits. After being truncated by Trunc 615, it can be 128 bits K SUPint . For example, the algorithm used for UP integrity can be common to multiple network slices or specific to network slice #n.

[0139] Similarly, N-UP-enc-alg may represent the algorithm type specifier of the algorithm used for UP encryption, Alg-ID may represent the corresponding algorithm identity, and both N-UP-enc-alg and the corresponding Alg-ID and their lengths (not shown) may be input to KDF 620 to derive K. SUPenc, which can represent the key for UP encryption specific to network slice #n. gNB It can be, for example, 256 bits, and the K output from KDF 620 is SUPenc It can be 256 bits. After being truncated by Trunc 625, it can be 128 bits K SUPenc . For example, the algorithm used for UP encryption can be common to multiple network slices or specific to network slice #n.

[0140] Similarly, N-RRC-int-alg may represent an algorithm type specifier of an algorithm used for RRC integrity, Alg-ID may represent a corresponding algorithm identity, and both N-RRC-int-alg and the corresponding Alg-ID and their lengths (not shown) may be input to KDF 630 to derive K. SRRCint , which may represent the key for RRC integrity specific to network slice #n. gNB It can be, for example, 256 bits, and the K output from KDF 630 is SRRCint can be 256 bits. After being truncated by Trunc 635, it can be 128 bits K SRRCint . For example, the algorithm used for RRC integrity can be common to multiple network slices or specific to network slice #n.

[0141] Similarly, N-RRC-enc-alg may represent an algorithm type specifier of an algorithm used for RRC encryption, Alg-ID may represent a corresponding algorithm identity, and both N-RRC-enc-alg and the corresponding Alg-ID and their lengths (not shown) may be input to KDF 640 to derive K. SRRCenc , which may represent the key used for RRC encryption specific to network slice #n. gNB It can be, for example, 256 bits, and the K output from KDF 640 is SRRCenc It can be 256 bits. After being truncated by Trunc 645, it can be 128 bits K SRRCenc . For example, the algorithm used for RRC encryption can be common to multiple network slices or specific to network slice #n.

[0142] Figure 7 Another slice-specific key derivation diagram according to an example embodiment of the present disclosure is shown. Figure 7 In, K AMF It can represent the key of the core network device 230, K SAMF may represent a key of the core network device 230 specific to network slice #n, and K SgNB The key of the access network device 220 specific to the network slice #n may be represented. Figure 7 Zhongyu Figure 6 The same or similar processes will be described herein and repetition will be omitted.

[0143] Reference again Figure 2 In operation 232, the core network device 230 may derive a key of the core network device 230 specific to the network slice #n from the key of the core network device 230 based on the identity information of the network slice #n. Figure 7 As shown in AMF and S-NSSAI#n and the length of S-NSSAI#n (not shown) may be input to KDF 702 to derive K SAMF Then, in operation 233, the core network device 230 may derive a key of the access network device 220 specific to the network slice #n from a key of the core network device 230 specific to the network slice #n. Figure 7 As shown in SAMF can be input to KDF 706 to derive K SgNB Then, the core network device 230 can SgNB The access network device 220 may send the security information 236 to the access network device 220 (e.g., together with the security information 236), and if the security information 236 includes an indication for deriving at least one key specific to the network slice #n, the access network device 220 may perform in operation 226 Figure 7 The subsequent slice #n specific keys shown in are derived.

[0144] Therefore, on the network side, Figure 7 The slice #n specific key derivation shown in FIG. 2 can be performed by the core network device 230 in operations 232 and 233, and performed by the access network device 220 in operation 226. And, since the core network device 230 has used the identity information of the network slice #n to derive a key of the core network device 230 specific to the network slice #n, the access network device 220 does not need to use the identity information of the network slice #n in further slice specific key derivation.

[0145] On the UE side, the UE 210 can obtain the K from the core network device 230. AMF Parameters, and get K AMF If the security information 236 includes an indication for deriving at least one key specific to the network slice #n, the UE 210 may perform in operation 216 Figure 7 The entire slice #n specific key shown in FIG. 1 is derived, including a key (e.g., K AMF ) to obtain a key (e.g., K SAMF); from a key (e.g., K SAMF ) to obtain a key (e.g., K SgNB ), and K SUPint , K SUPenc , K SRRCint , and K SRRCenc At least one of .

[0146] Based on the common or specific encryption algorithm information of network slice #n, UE 210 and access network device 220 can derive the corresponding length. SgNB and corresponding encryption algorithm information and corresponding length (not shown) may be respectively input to KDF 710, KDF 720, KDF 730, and KDF 740 to derive K SUPint , K SUPenc , K SRRCint , and K SRRCenc S-NSSAI#n and the length of S-NSSAI#n may or may not be input to KDF 710, KDF 720, KDF 730, and KDF 740 to derive K SUPint , K SUPenc , K SRRCint , and K SRRCenc . Figure 7 Key bits omitted, truncated, etc.

[0147] Therefore, the at least one key specific to network slice #n may include at least one of the following items: a key for UP integrity specific to network slice #n, a key for UP encryption specific to network slice #n, a key for RRC integrity specific to network slice #n, and a key for RRC encryption specific to network slice #n. It can be understood that the slice #n specific key can be derived according to actual needs. For example, for a specific protection in UP, K SUPint and K SUPenc , but not necessarily K SRRCint and K SRRCenc For example, for integrity protection, we can derive K SUPint and K SRRCint , but not necessarily K SUPenc and K SRRCenc .

[0148] Reference again Figure 2In one embodiment, the core network device 230 may determine a lifetime 238 of at least one key specific to the network slice #n, and the lifetime 238 may be sent to the UE 210 and the access network device 220, respectively, together with the security information 236. For example, if the security information 236 is sent to the UE 210 in the registration accept 237, the lifetime 238 may also be sent to the UE 210 in the registration accept 237, and if the security information 236 is sent to the access network device 220 in the initial context establishment request 235, the lifetime 238 may also be sent to the access network device 220 in the initial context establishment request 235. The lifetime 238 may be a validity period of the derived key(s). For example, if the network slice #n is to cover a weekend match at a stadium, the lifetime 238 of the network slice #n specific key(s) may be the period of the weekend match.

[0149] Using (multiple) network slice #n specific keys, UE 210 and access network device 220 may use (multiple) specific keys and (multiple) corresponding algorithms to protect uplink and downlink data in network slice #n. In operation 218, UE 210 or access network device 220 or both may use at least one of the following items to protect data in network slice #n: a key for UP integrity, such as K SUPint ; and an encryption algorithm for deriving a key for UP integrity; and a key for UP encryption, such as K SUPenc ; and an encryption algorithm for deriving a key for UP encryption.

[0150] The control plane (CP) can also be protected. For example, Minimization of Drive Test (MDT) messages carried in Signaling Radio Bearer 1 (SRB1), and Quality of Experience (QoE) messages using SRB1 and SRB4 can be protected by RRC slice-specific keys (e.g., K SRRCint and K SRRCenc ) to protect. In addition, non-access stratum (NAS) level messages between UE 210 and core network device 230 (such as network slice specific authentication command, network slice specific authentication completion, network slice specific authentication result) can be protected by using K SAMF To protect.

[0151] In the case where the core network device 230 is an SMF, the core network device 230 may select transport layer security (TLS) and / or Internet Protocol Security (IPsec) specific to network slice #n in operation 242, and notify the user plane function (UPF) 240 of the TLS / IPsec specific to network slice #n. In the case where the core network device 230 is an AMF, the SMF may perform operation 242. Then, in operation 244, the access network device 220 and the UPF 240 may set domain security based on the TLS and / or IPsec specific to network slice #n, so that the domain security between the UPF and the RAN may also be extended to have different security protections for different slices.

[0152] Figure 3 Another exemplary sequence diagram of network slice isolation according to an example embodiment of the present disclosure is shown. Figure 2 The operations shown in Figure 3 is executed in the example embodiment, regardless of whether Figure 3 Unless otherwise indicated Figure 3 For example, in Figure 3 In the example embodiment of , UE 210 can send capability 214 to core network device 230, and core network device 230 can retrieve security policy 262 specific to network slice #n from policy device 260, although Figure 3 In addition, Figure 6 and Figure 7 The slice-specific key described here can be applied to Figure 3 Example embodiments of the present invention.

[0153] See also Figure 3 , in operation 332, the core network device 230 may determine a network slice #n specific key update and implement the network slice #n specific key update with the aid of a UE configuration update procedure. Operation 332 may be performed, for example, periodically or triggered by an event such as an upgrade protection of a slice. After determining the security information 236 in operation 234, the core network device 230 may send the security information 236 to the UE 210 via a configuration update command 336. For example, the configuration update command 336 may include an information element (IE) for a slice-specific security configuration, which may include the security information 236. If the configuration update command 336 requires confirmation of the configuration update command 336, the UE 210 may send a UE configuration update complete message to the core network device 230. The core network device 230 may also send the security information 236 to the access network device 220 via a configuration message (e.g., an update RAN message 334).

[0154] Then, the UE 210 may derive at least one key specific to the network slice #n in operation 216, and the access network device 220 may derive at least one key specific to the network slice #n in operation 226. In operation 218, the UE 210 and the access network device 220 may protect data in the network slice #n by using the derived specific key and the corresponding algorithm.

[0155] As an option, the core network device 230 may determine a key lifetime 238 of the derived at least one key, and send the key lifetime 238 together with the security information 236 to the UE 210 and the access network device 220 , respectively.

[0156] Figure 4 Another exemplary sequence diagram of network slice isolation according to an example embodiment of the present disclosure is shown. Figure 2 The operations shown in Figure 4 Executed in the example embodiment of Figure 4 Unless otherwise indicated Figure 4 For example, in Figure 4 In the example embodiment of , UE 210 can send capability 214 to core network device 230, and core network device 230 can retrieve security policy 262 specific to network slice #n from policy device 260, although Figure 4 In addition, Figure 6 and Figure 7 The slice-specific key described here can be applied to Figure 4 Example embodiments of the present invention.

[0157] refer to Figure 4 , the UE 210 may send a network slice-specific security request 412 to the core network device 230. For example, in a roaming situation, if a local outage occurs and / or the UE 210 installs a new application, the UE 210 may request slice-specific protection by sending the security request 412. In operation 432, after receiving the security request 412, the core network device 230 may determine a network slice-specific key update. If the security request 412 requests specific protection for a slice that is not allowed to obtain specific protection (because, for example, the slice is not a high-profile slice but a default slice), the core network device 230 may determine that the network slice-specific key update should be rejected. Because there is a security policy 262 specific to network slice #n, the security request 412 specific to network slice #n may be allowed, and the core network device 230 may determine a network slice #n-specific key update.

[0158] After determining security information 236 in operation 234, core network device 230 may send security information 236 to UE 210 via response 436 to security request 412. Core network device 230 may also send security information 236 to access network device 220 via a configuration message (eg, response 434).

[0159] Then, the UE 210 may derive at least one key specific to the network slice #n in operation 216, and the access network device 220 may derive at least one key specific to the network slice #n in operation 226. In operation 218, the UE 210 and the access network device 220 may protect data in the network slice #n by using the derived specific key and the corresponding algorithm.

[0160] As an option, the core network device 230 may determine a key lifetime 238 of the derived at least one key, and send the key lifetime 238 together with the security information 236 to the UE 210 and the access network device 220 , respectively.

[0161] Figure 5 Another exemplary sequence diagram of network slice isolation according to an example embodiment of the present disclosure is shown. Figure 2 The operations shown in Figure 5 is executed in the example embodiment, regardless of whether Figure 5 Unless otherwise indicated Figure 5 For example, in Figure 5 In the example embodiment of , UE 210 can send capability 214 to core network device 230, and core network device 230 can retrieve security policy 262 specific to network slice #n from policy device 260, although Figure 5 In addition, Figure 6 and Figure 7 The slice-specific key described here can be applied to Figure 5 Example embodiments of the present invention. Figure 5 The core network device 230 in the example embodiment may be an AMF or an SMF.

[0162] refer to Figure 5 , the UE 210 may send a protocol data unit (PDU) session establishment request 512 to the core network device 230. If the request is to establish a PDU session in network slice #n (allowing specific protection for it according to the security policy 262 specific to network slice #n), a key specific to network slice #n may be implemented with the aid of the PDU session establishment process.

[0163] After determining the security information 236 in operation 234, the core network device 230 may send the security information 236 to the UE 210 via the PDU session establishment accept 534. The core network device 230 may also send the security information 236 to the access network device 220 via the PDU session request 532.

[0164] Then, the UE 210 may derive at least one key specific to the network slice #n in operation 216, and the access network device 220 may derive at least one key specific to the network slice #n in operation 226. In operation 218, the UE 210 and the access network device 220 may protect data in the network slice #n by using the derived specific key and the corresponding algorithm.

[0165] exist Figure 5 In an example embodiment of , network slice #n specific security may be associated with the UP, and specific security in the CP may not be required. Therefore, at least one key and corresponding algorithm specific to network slice #n may be associated with the UP, and the key and algorithm in the CP may not be required. In addition, the activity time of the (multiple) network slice #n specific key may be the duration of the established PDU session, and thus the key lifetime 238 may not be required.

[0166] Figure 8 An exemplary sequence diagram of an E1AP interface management process according to an exemplary embodiment of the present disclosure is shown. The E1 Application Protocol (E1AP) may be used for signaling transmission between a Centralized Unit (CU)-CP and a CU-UP. Figure 8 , CU-CP 810 and CU-UP 820 are associated with the access network device 220. The access network device 220 may be associated with a plurality of CU-UPs, and CU-UP 820 may represent any CU-UP among the plurality of CU-UPs.

[0167] The CU-UP 820 may send the encryption capability 824 for the network slice list or specific network slice #n to the CU-CP 810 so that the CU-CP 810 makes a selection of the CU-UP 820 to support the requirement for the network slice list or specific network slice #n. Figure 8 In the example, the encryption capability 824 is sent via the CU-UP E1 setup request 822 during the CU-UP E1 setup process.

[0168] In one embodiment, the encryption capability 824 may include: the encryption capability of the corresponding network slice in the network slice list, and in this case, the encryption capability 824 may be an IE of the encryption capability of each S-NSSAI support list. Different CU-UPs may have different encryption capabilities in supporting slice-specific requirements for network slices in the network slice list. For example, encryption performed by some CU-UPs may require more processing time and may increase more end-to-end (E2E) delay. For example, encryption performed by some CU-UPs can achieve higher slice isolation. Requirements for the network slice list may include: for example, E2E delay requirements for the corresponding network slices in the list, slice isolation level requirements, algorithm requirements, etc. CU-CP 810 may consider the requirements of the network slices in the list and the encryption capability 824 to select CU-UP 820 to support the requirements for the network slice list.

[0169] Alternatively, in one embodiment, the encryption capability 824 may be specific to network slice #n, and in this case, the encryption capability 824 may be an encryption capability for each slice. The CU-CP 810 may consider, for example, the E2E latency requirements of network slice #n, the slice isolation level requirements, the algorithm requirements, etc., and the encryption capability 824 to select the CU-UP 820 to support the requirements specific to network slice #n.

[0170] The CU-CP 810 may then send a CU-UP E1 setup response 812 to the selected CU-UP 820 .

[0171] Fig. 9 Another exemplary sequence diagram of the E1AP interface management process according to an exemplary embodiment of the present disclosure is shown. Figure 8 Different, in Fig. 9 In the example embodiment of , the encryption capability 824 is sent via the CU-UP configuration update message 922 during the CU-UP configuration update process.

[0172] The encryption capability 824 may be for a network slice list, or specific to network slice #n, and the CU-CP 810 may use the encryption capability 824 to make a selection of the CU-UP 820 to support the requirement for the network slice list, or specific to network slice #n. The CU-CP 810 may then send a CU-UP E1 configuration update confirmation 912 to the selected CU-UP 820.

[0173] Fig.10 A flow chart illustrating an example method 1000 for network slice isolation according to an example embodiment of the present disclosure is shown. The example method 1000 may be performed, for example, at a terminal device such as UE 210.

[0174] refer to Fig.10 , the example method 1000 may include: an operation 1010 of receiving security information specific to a network slice from a core network device; and an operation 1020 of deriving at least one key specific to the network slice from a key of an access network device with which the terminal device is associated based on the security information, wherein the key of the access network device is shared by the access network devices or is specific to the network slice.

[0175] The details of operation 1010 have been described at least with respect to the security information 236 in the above description, and a repeated description thereof is omitted here.

[0176] In the above description, at least operations 216, Figure 6 ,as well as Figure 7 The details of operation 1020 are described, and a repeated description thereof is omitted here.

[0177] In one embodiment, the example method 1000 may also include: during the registration process, sending to the core network device an operation of supporting different keys and / or encryption algorithms for different network slices. More details have been described in the above description at least for capability 214, and its repeated description is omitted here.

[0178] In one embodiment, the security information may be received in a registration acceptance, and the registration acceptance may further include: the lifetime of at least one key. More details have been described above for at least the registration acceptance 237 and the key lifetime 238, and their repeated description is omitted here.

[0179] In one embodiment, the security information may be received in a configuration update command, and the configuration update command may further include: the lifetime of at least one key. More details have been described above for at least the configuration update command 326 and the key lifetime 238, and their repeated description is omitted here.

[0180] In one embodiment, the example method 1000 may further include: sending a security request specific to the network slice to the core network device, the security information may be received in a response to the security request, and the response may further include: the lifetime of at least one key. More details have been described in the above description at least for the security request 412, the response 436, and the key lifetime 238, and their repeated description is omitted here.

[0181] In one embodiment, the security information may be received via the PDU Session Setup Accept.More details have been described in the above description at least for the PDU Session Setup Accept 534, and a repeated description thereof is omitted here.

[0182] In one embodiment, the exemplary method 1000 may further include the following operations: based on the identity information of the network slice, deriving a key of the core network device specific to the network slice from the key of the core network device; and deriving a key of the access network device specific to the network slice from the key of the core network device specific to the network slice. Figure 7 More details are described, and their repeated description is omitted here.

[0183] In one embodiment, the security information may include at least one of the following items: an indication for deriving at least one key specific to the network slice, identity information of the network slice, and encryption algorithm information specific to the network slice. Figure 6 and Figure 7 More details are described, and their repeated description is omitted here.

[0184] In one embodiment, the at least one key may include at least one of the following: a network slice-specific key for UP integrity, a network slice-specific key for UP encryption, a network slice-specific key for RRC integrity, and a network slice-specific key for RRC encryption. Figure 6 and Figure 7 More details are described, and their repeated description is omitted here.

[0185] In one embodiment, the example method 1000 may also include an operation of protecting data in the network slice using at least one of the following items: a key for UP integrity and an encryption algorithm for deriving a key for UP integrity, and a key for UP encryption and an encryption algorithm for deriving a key for UP encryption. More details have been described in the above description at least for operation 218, and their repeated description is omitted here.

[0186] Fig.11 A flow chart illustrating an example method 1100 for network slice isolation according to an example embodiment of the present disclosure is shown. The example method 1100 may be performed, for example, at an access network device such as the access network device 220.

[0187] refer to Fig.11 , the example method 1100 may include: an operation 1110 of receiving security information specific to a network slice from a core network device; and an operation 1120 of deriving at least one key specific to the network slice from a key of an access network device based on the security information, wherein the key of the access network device is shared by the access network devices or is specific to the network slice.

[0188] The details of operation 1110 have been described at least with respect to the security information 236 in the above description, and a repeated description thereof is omitted here.

[0189] In the above description, at least operations 226, Figure 6 ,as well as Figure 7 The details of operation 1120 are described, and a repeated description thereof is omitted here.

[0190] In one embodiment, the security information may be received in a configuration message of the terminal device, and the configuration message may further include: the lifetime of at least one key. More details have been described in the above description at least for the initial context establishment request 235, the update RAN message 334, the response 434, and the key lifetime 238, and their repeated description is omitted here.

[0191] In one embodiment, the security information may be received from the core network device via a PDU session request.More details have been described in the above description at least for the PDU session request 532, and a repeated description thereof is omitted here.

[0192] In one embodiment, the key of the access network device may be specific to the network slice and derived by the core network device from the key of the core network device specific to the network slice, and the key of the core network device may be derived based on the identity information of the network slice. Figure 7 More details are described, and their repeated description is omitted here.

[0193] In one embodiment, the security information may include at least one of the following items: an indication for deriving at least one key specific to the network slice, identity information of the network slice, and encryption algorithm information specific to the network slice. Figure 6 ,as well as Figure 7 More details are described, and their repeated description is omitted here.

[0194] In one embodiment, the at least one key may include at least one of the following: a network slice-specific key for UP integrity, a network slice-specific key for UP encryption, a network slice-specific key for RRC integrity, and a network slice-specific key for RRC encryption. Figure 6 and Figure 7 More details are described, and their repeated description is omitted here.

[0195] In one embodiment, the example method 1100 may also include an operation of protecting data in the network slice using at least one of the following items: a key for UP integrity and an encryption algorithm for deriving a key for UP integrity, and a key for UP encryption and an encryption algorithm for deriving a key for UP encryption. More details have been described in the above description at least for operation 218, and their repeated description is omitted here.

[0196] In one embodiment, the access network device may be associated with the CU-CP and the CU-UP, and the CU-UP may send the CU-CP an encryption capability for a network slice list or specific to a network slice, so that the CU-CP makes a selection of the CU-UP to support the requirements for the network slice list or specific to the network slice. Figure 8 and Fig. 9 More details are described, and their repeated description is omitted here.

[0197] Fig.12 A flow chart illustrating an example method 1200 for network slice isolation according to an example embodiment of the present disclosure is shown. The example method 1200 may be performed, for example, at a core network device such as the core network device 230.

[0198] refer to Fig.12 , the example method 1200 may include: an operation 1210 of determining security information specific to a network slice based on the ability of a terminal device to support different keys and / or encryption algorithms for different network slices and a security policy specific to the network slice; and an operation 1220 of sending security information specific to the network slice to the terminal device and an access network device associated with the terminal device, respectively, so that the terminal device and the access network device can respectively derive at least one key specific to the network slice.

[0199] The details of operation 1210 have been described in the above description at least with respect to operation 234 , and a repeated description thereof is omitted here.

[0200] The details of operation 1220 have been described at least with respect to the security information 236 in the above description, and a repeated description thereof is omitted here.

[0201] In one embodiment, the example method 1200 may also include: during the registration process, receiving from the terminal device an operation of supporting different keys and / or encryption algorithms for different network slices. More details have been described in the above description at least for capability 214, and its repeated description is omitted here.

[0202] In one embodiment, the example method 1200 may also include an operation of retrieving a security policy specific to the network slice from the policy device. More details have been described in the above description at least for the security policy 262, and their repeated description is omitted here.

[0203] In one embodiment, the example method 1200 may further include: based on the identity information of the network slice, deriving a key of the core network device specific to the network slice from the key of the core network device; and deriving a key of the access network device specific to the network slice from the key of the core network device specific to the network slice. At least operations 232, 233, and Figure 7 More details are described, and their repeated description is omitted here.

[0204] In one embodiment, the security information may include at least one of the following items: an indication for deriving at least one key specific to the network slice, identity information of the network slice, and encryption algorithm information specific to the network slice. Figure 6 ,as well as Figure 7 More details are described, and their repeated description is omitted here.

[0205] In one embodiment, the example method 1200 may also include: receiving a security request specific to the network slice from the terminal device, the security information being sent in a response to the security request. More details have been described in the above description at least for the security request 412, the response 436, and the response 434, and their repeated description is omitted here.

[0206] In one embodiment, the example method 1200 may further include an operation of determining a lifetime of at least one key, the lifetime being sent together with the security information. More details have been described above at least for the key lifetime 238, and a repeated description thereof is omitted here.

[0207] Fig.13 A block diagram illustrating an example device 1300 for network slice isolation according to an example embodiment of the present disclosure is shown. For example, the device may be at least part of a terminal device such as the UE 210 in the above example.

[0208] like Fig.13 As shown in FIG. 1 , the example device 1300 may include at least one processor 1310 and at least one memory 1320 that may include computer program code 1330. The at least one memory 1320 and the computer program code 1330 may be configured to, together with the at least one processor 1310, enable the device 1300 to at least perform the above-described example method 1000.

[0209] In various example embodiments, at least one processor 1310 in the example device 1300 may include, but is not limited to, at least one hardware processor, including at least one microprocessor, such as a central processing unit (CPU); a portion of at least one hardware processor; and any other suitable special-purpose processor, such as a processor developed based on, for example, a field programmable gate array (FPGA) and an application-specific integrated circuit (ASIC). In addition, the at least one processor 1310 may also include Fig.13 At least one other circuit system or component not shown.

[0210] In various example embodiments, at least one memory 1320 in the example device 1300 may include various forms of at least one storage medium, such as volatile memory and / or non-volatile memory. Volatile memory may include, but is not limited to, for example, random access memory (RAM), cache, etc. Non-volatile memory may include, but is not limited to, for example, read-only memory (ROM), hard disk, flash memory, etc. In addition, at least memory 1320 may include, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any combination of the above.

[0211] Furthermore, in various example embodiments, the example device 1300 may further include at least one other circuit system, element, and interface, such as at least one I / O interface, at least one antenna element, and the like.

[0212] In various example embodiments, the circuit systems, components, elements, and interfaces in the example device 1300 (including at least one processor 1310 and at least one memory 1320) may be coupled together in any suitable manner (e.g., electrically, magnetically, optically, electromagnetically, etc.) via any suitable connections (including but not limited to buses, crossbars, wires, and / or wireless links).

[0213] It should be understood that the structure of the device on the UE 210 side is not limited to the above-mentioned example device 1300.

[0214] Fig.14 A block diagram illustrating an example device 1400 for network slice isolation according to an example embodiment of the present disclosure is shown. For example, the device can be at least part of an access network device such as the access network device 220 in the above example.

[0215] like Fig.14As shown in FIG. 1 , the example device 1400 may include at least one processor 1410 and at least one memory 1420 that may include computer program code 1430. The at least one memory 1420 and the computer program code 1430 may be configured to, together with the at least one processor 1410, enable the device 1400 to at least perform the above-described example method 1100.

[0216] In various example embodiments, at least one processor 1410 in the example device 1400 may include, but is not limited to, at least one hardware processor, including at least one microprocessor, such as a central processing unit (CPU); a portion of at least one hardware processor; and any other suitable special-purpose processor, such as a processor developed based on, for example, a field programmable gate array (FPGA) and an application-specific integrated circuit (ASIC). In addition, the at least one processor 1410 may also include Fig.14 At least one other circuit system or component not shown.

[0217] In various example embodiments, at least one memory 1420 in the example device 1400 may include at least one storage medium in various forms, such as volatile memory and / or non-volatile memory. Volatile memory may include, but is not limited to, for example, random access memory (RAM), cache, etc. Non-volatile memory may include, but is not limited to, for example, read-only memory (ROM), hard disk, flash memory, etc. In addition, at least memory 1420 may include, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any combination of the above.

[0218] Furthermore, in various example embodiments, the example device 1400 may further include at least one other circuit system, element, and interface, such as at least one I / O interface, at least one antenna element, and the like.

[0219] In various example embodiments, the circuit systems, components, elements, and interfaces in the example device 1400 (including at least one processor 1410 and at least one memory 1420) may be coupled together in any suitable manner (e.g., electrically, magnetically, optically, electromagnetically, etc.) via any suitable connections (including but not limited to buses, crossbars, wires, and / or wireless links).

[0220] It should be understood that the structure of the device on the access network device 220 side is not limited to the above-mentioned example device 1400.

[0221] Fig.15 A block diagram illustrating an example device 1500 for network slice isolation according to an example embodiment of the present disclosure is shown. For example, the device may be at least part of a core network device such as the core network device 230 in the above example.

[0222] like Fig.15 As shown in FIG. 1 , the example device 1500 may include at least one processor 1510 and at least one memory 1520 that may include computer program code 1530. The at least one memory 1520 and the computer program code 1530 may be configured to, together with the at least one processor 1510, cause the device 1500 to at least perform the above-described example method 1200.

[0223] In various example embodiments, at least one processor 1510 in the example device 1500 may include, but is not limited to, at least one hardware processor, including at least one microprocessor, such as a central processing unit (CPU); a portion of at least one hardware processor; and any other suitable special-purpose processor, such as a processor developed based on, for example, a field programmable gate array (FPGA) and an application-specific integrated circuit (ASIC). In addition, the at least one processor 1510 may also include Fig.15 At least one other circuit system or component not shown.

[0224] In various example embodiments, at least one memory 1520 in the example device 1500 may include various forms of at least one storage medium, such as volatile memory and / or non-volatile memory. Volatile memory may include, but is not limited to, for example, random access memory (RAM), cache, etc. Non-volatile memory may include, but is not limited to, for example, read-only memory (ROM), hard disk, flash memory, etc. In addition, at least memory 1520 may include, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any combination of the above.

[0225] Furthermore, in various example embodiments, the example device 1500 may further include at least one other circuit system, element, and interface, such as at least one I / O interface, at least one antenna element, and the like.

[0226] In various example embodiments, the circuit systems, components, elements, and interfaces in the example device 1500 (including at least one processor 1510 and at least one memory 1520) may be coupled together in any suitable manner (e.g., electrically, magnetically, optically, electromagnetically, etc.) via any suitable connections (including but not limited to buses, crossbars, wires, and / or wireless links).

[0227] It should be understood that the structure of the device on the core network device 230 side is not limited to the above-mentioned example device 1500.

[0228] Fig.16 A block diagram illustrating an example apparatus 1600 for network slice isolation according to an example embodiment of the present disclosure is shown. For example, the apparatus may be at least part of a terminal device such as the UE 210 in the above example.

[0229] like Fig.16 As shown in , the example apparatus 1600 may include: a component 1610 for performing the operation 1010 of the example method 1000, and a component 1620 for performing the operation 1020 of the example method 1000. In one or more other example embodiments, the example apparatus 1600 may further include at least one I / O interface, at least one antenna element, etc.

[0230] In some example embodiments, examples of components in example apparatus 1600 may include circuitry. For example, one example of component 1610 may include circuitry configured to perform operation 1010 of example method 1000, and one example of component 1620 may include circuitry configured to perform operation 1020 of example method 1000. In some example embodiments, examples of components may also include software modules and any other suitable functional entities.

[0231] Fig.17 A block diagram illustrating an example apparatus 1700 for network slice isolation according to an example embodiment of the present disclosure is shown. For example, the apparatus may be at least part of an access network device such as the access network device 220 in the above example.

[0232] like Fig.17 As shown in , the example apparatus 1700 may include: a component 1710 for performing the operation 1110 of the example method 1100, and a component 1720 for performing the operation 1120 of the example method 1100. In one or more other example embodiments, the example apparatus 1700 may further include at least one I / O interface, at least one antenna element, etc.

[0233] In some example embodiments, examples of components in example apparatus 1700 may include circuitry. For example, one example of component 1710 may include circuitry configured to perform operation 1110 of example method 1100, and one example of component 1720 may include circuitry configured to perform operation 1120 of example method 1100. In some example embodiments, examples of components may also include software modules and any other suitable functional entities.

[0234] Fig.18 A block diagram illustrating an example apparatus 1800 for network slice isolation according to an example embodiment of the present disclosure is shown. For example, the apparatus may be at least part of a core network device such as the core network device 230 in the above example.

[0235] like Fig.18As shown in , the example apparatus 1800 may include: a component 1810 for performing the operation 1210 of the example method 1200, and a component 1820 for performing the operation 1220 of the example method 1200. In one or more other example embodiments, the example apparatus 1800 may further include at least one I / O interface, at least one antenna element, etc.

[0236] In some example embodiments, examples of components in example apparatus 1800 may include circuitry. For example, one example of component 1810 may include circuitry configured to perform operation 1210 of example method 1200, and one example of component 1820 may include circuitry configured to perform operation 1220 of example method 1200. In some example embodiments, examples of components may also include software modules and any other suitable functional entities.

[0237] The term "circuitry" throughout this disclosure may refer to one or more or all of the following: (a) a pure hardware circuit implementation (such as an implementation in analog and / or digital circuitry only); (b) a combination of hardware circuitry and software, such as (as applicable) (i) a combination of (multiple) analog and / or digital hardware circuits and software / firmware, and (ii) any portion of (multiple) hardware processors (including (multiple) digital signal processors), software, and (multiple) memories with software, which work together to enable a device such as a mobile phone or server to perform various functions); and (c) (multiple) hardware circuits and / or (multiple) processors, such as (multiple) microprocessors or portions of (multiple) microprocessors, which require software (e.g., firmware) to operate, but when not required for operation, the software may not be present. This definition of circuitry applies to one or all uses of the term in this disclosure, including in any claims. As another example, as used in this disclosure, the term circuitry also covers an implementation of only a hardware circuit or processor (or multiple processors) or a portion of a hardware circuit or processor and its accompanying software and / or firmware. For example, the term circuitry would also cover, if applicable to a claim element, a baseband integrated circuit or a processor integrated circuit for a mobile device, or a similar integrated circuit in a server, cellular network device, or other computing or networking equipment.

[0238] Another example embodiment may involve a computer program code or instruction that can cause an apparatus to perform at least the above-described corresponding method. Another example embodiment may involve a computer-readable medium having such a computer program code or instruction stored thereon. In some embodiments, such a computer-readable medium may include at least one storage medium in various forms, such as a volatile memory and / or a non-volatile memory. Volatile memory may include, but is not limited to, for example, RAM, cache, etc. Non-volatile memory may include, but is not limited to, ROM, hard disk, flash memory, etc. Non-volatile memory may also include, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices, or equipment, or any combination of the above.

[0239] Unless the context clearly requires otherwise, throughout the specification and claims, the words "include", "comprises", etc. should be interpreted as inclusive, not exclusive or exhaustive; that is, in the sense of "including but not limited to". The word "coupled" as generally used herein refers to two or more elements that can be directly connected or connected through one or more intermediate elements. Similarly, the word "connected" as generally used herein refers to two or more elements that can be directly connected or connected through one or more intermediate elements. In addition, the words "herein", "above", "below" and words of similar meaning used in this application should refer to the entire application, not to any particular part of this application. Where the context permits, words used in the singular or plural in the specification may also include the plural or singular, respectively. The word "or" refers to a list of two or more items, and the word covers all the following interpretations of the word: any item in the list, all items in the list, and any combination of items in the list.

[0240] Furthermore, unless otherwise specifically stated or understood in the context of use, conditional language used herein (such as "may," "can," "might," "could," "may," "for example," "for example," "such as," etc.) is generally intended to convey that some embodiments include and other embodiments do not include certain features, elements, and / or states. Thus, such conditional language generally does not indicate that one or more embodiments require features, elements, and / or states in any way, nor does it indicate that one or more embodiments must include logic for deciding whether to include or perform such features, elements, and / or states in any particular embodiment, with or without author input or prompting.

[0241] As used herein, the term "determine / determining" (and grammatical variations thereof) may include, among other things, calculating, computing, processing, deriving, measuring, investigating, searching (e.g., searching in a table, database, or other data structure), confirming, etc. Furthermore, "determining" may include receiving (e.g., receiving information), accessing (e.g., accessing data in a memory), obtaining, etc. Furthermore, "determine / determining" may include solving, selecting, choosing, establishing, etc.

[0242] Although some embodiments have been described, these embodiments are presented by way of example and are not intended to limit the scope of the present disclosure. In fact, the devices, methods, and systems described herein may be embodied in various other forms; in addition, various omissions, substitutions, and changes may be made to the forms of the methods and systems described herein without departing from the spirit of the present disclosure. For example, although the blocks are presented in a given arrangement, alternative embodiments may perform similar functions using different components and / or circuit topologies, and some blocks may be deleted, moved, added, subdivided, combined, and / or modified. At least one of these blocks may be implemented in a variety of different ways. The order of these blocks may also be changed. Any suitable combination of the elements and actions of some of the above-described embodiments may be combined to provide additional embodiments. The attached claims and their equivalents are intended to cover forms or modifications that fall within the scope and spirit of the present disclosure.

[0243] The abbreviations used in the specification and / or drawings are defined as follows:

[0244] AMF: Access and Mobility Management Function

[0245] AN: Access Network

[0246] BTS: Base Transceiver Station

[0247] CN: Core Network

[0248] CP: Control plane

[0249] CU: Centralized Unit

[0250] E1AP: E1 Application Protocol

[0251] E2E: End to End

[0252] IE: Information Element

[0253] IPsec: Internet Protocol Security

[0254] KDF: Key Derivation Function

[0255] MDT: Minimization of driving tests

[0256] NAS: Non-Access Stratum

[0257] NSI: Network Slicing Example

[0258] NSSAI: Network Slice Selection Assistance Information

[0259] NSSF: Network Slice Selection Function

[0260] NSSI: Network Slicing Subnet Instance

[0261] PCF: Policy Control Function

[0262] PDU: Protocol Data Unit

[0263] QoE: Quality of Experience

[0264] RAN: Random Access Network

[0265] RRC: Radio Resource Control

[0266] SMF: Session Management Function

[0267] S-NSSAI: Single Network Slice Selection Auxiliary Information

[0268] SRB: Signalling Radio Bearer

[0269] TLS: Transport Layer Security

[0270] UDM: Unified Data Management

[0271] UE: User Equipment

[0272] UP: User plane

[0273] UPF: User Plane Function

Claims

1. A terminal device, comprising: at least one processor; as well as at least one memory including computer program code, wherein the at least one memory and the computer program code are configured to, together with the at least one processor, cause the terminal device to execute: Receive network slice-specific security information from core network devices; as well as Based on the security information, at least one key specific to the network slice is derived from the key of the access network device associated with the terminal device, and the key of the access network device is shared by the access network devices or specific to the network slice.

2. The terminal device according to claim 1, wherein the at least one memory and the computer program code are further configured to, together with the at least one processor, cause the terminal device to further execute: During the registration process, the capability of supporting different keys and / or encryption algorithms for different network slices is sent to the core network device.

3. The terminal device according to claim 1 or 2, wherein the security information is received in a registration acceptance, and the registration acceptance further comprises: A lifetime of the at least one key.

4. The terminal device according to claim 1 or 2, wherein the security information is received in a configuration update command, and the configuration update command further comprises: A lifetime of the at least one key.

5. The terminal device according to claim 1 or 2, wherein the at least one memory and the computer program code are further configured to, together with the at least one processor, cause the terminal device to further execute: Sending a security request specific to the network slice to the core network device, the security information being received in a response to the security request, and the response further comprising: A lifetime of the at least one key.

6. The terminal device according to claim 1 or 2, wherein the security information is received via a protocol data unit session setup accept.

7. The terminal device according to any one of claims 1 to 6, wherein the at least one memory and the computer program code are further configured to, together with the at least one processor, cause the terminal device to further execute: Based on the identity information of the network slice, deriving a key of the core network device specific to the network slice from the key of the core network device; and The key of the access network device specific to the network slice is derived from the key of the core network device specific to the network slice.

8. A terminal device according to any one of claims 1 to 7, wherein the security information includes at least one of the following items: an indication for deriving at least one key specific to the network slice, identity information of the network slice, and encryption algorithm information specific to the network slice.

9. A terminal device according to any one of claims 1 to 8, wherein the at least one key comprises at least one of the following items: a key specific to the network slice for user plane integrity, a key specific to the network slice for user plane encryption, a key specific to the network slice for radio resource control integrity, and a key specific to the network slice for radio resource control encryption.

10. The terminal device according to claim 9, wherein the at least one memory and the computer program code are further configured to, together with the at least one processor, cause the terminal device to further execute: The data in the network slice is protected using at least one of the following items: the key for user plane integrity, and the encryption algorithm for deriving the key for user plane integrity, and the key for user plane encryption and the encryption algorithm for deriving the key for user plane encryption.

11. An access network device, comprising: at least one processor; as well as At least one memory including computer program code, wherein the at least one memory and the computer program code are configured to, together with the at least one processor, cause the access network device to execute: Receive network slice-specific security information from core network devices; as well as Based on the security information, at least one key specific to the network slice is derived from the key of the access network device, and the key of the access network device is shared by the access network devices or specific to the network slice.

12. The access network device according to claim 11, wherein the security information is received in a configuration message of the terminal device, and the configuration message further comprises: A lifetime of the at least one key.

13. The access network device of claim 11, wherein the security information is received from the core network device via a protocol data unit session request.

14. An access network device according to any one of claims 11 to 13, wherein the key of the access network device is specific to the network slice and is derived by the core network device from the key of the core network device specific to the network slice, and the key of the core network device is derived based on the identity information of the network slice.

15. An access network device according to any one of claims 11 to 14, wherein the security information includes at least one of the following items: an indication for deriving at least one key specific to the network slice, identity information of the network slice, and encryption algorithm information specific to the network slice.

16. An access network device according to any one of claims 11 to 15, wherein the at least one key comprises at least one of the following items: a key for user plane integrity specific to the network slice, a key for user plane encryption specific to the network slice, a key for radio resource control integrity specific to the network slice, and a key for radio resource control encryption specific to the network slice.

17. The access network device according to claim 16, wherein the at least one memory and the computer program code are further configured to, together with the at least one processor, cause the access network device to further execute: The data in the network slice is protected using at least one of the following items: the key for user plane integrity and the encryption algorithm for deriving the key for user plane integrity, and the key for user plane encryption and the encryption algorithm for deriving the key for user plane encryption.

18. An access network device according to any one of claims 11 to 17, wherein the access network device is associated with a centralized unit control plane and a centralized unit user plane, and the centralized unit user plane sends encryption capabilities for a network slice list or specific to a network slice to the centralized unit control plane, so that the centralized unit control plane makes a selection of the centralized unit user plane to support requirements for the network slice list or specific to the network slice.

19. A core network device, comprising: at least one processor; as well as At least one memory including computer program code, wherein the at least one memory and the computer program code are configured to, together with the at least one processor, cause the core network device to execute: Determining security information specific to the network slice based on the ability of the terminal device to support different keys and / or encryption algorithms for different network slices and a security policy specific to the network slice; as well as The security information specific to the network slice is sent to the terminal device and the access network device associated with the terminal device, respectively, so that the terminal device and the access network device can respectively derive at least one key specific to the network slice.

20. The core network device according to claim 19, wherein the at least one memory and the computer program code are further configured to, together with the at least one processor, cause the core network device to further execute: During the registration process, the capability of supporting different keys and / or encryption algorithms for different network slices is received from the terminal device.

21. The core network device according to claim 19 or 20, wherein the at least one memory and the computer program code are further configured to, together with the at least one processor, enable the core network device to further execute: The security policy specific to the network slice is retrieved from a policy device.

22. The core network device according to any one of claims 19 to 21, wherein the at least one memory and the computer program code are further configured to, together with the at least one processor, cause the core network device to further execute: Based on the identity information of the network slice, deriving a key of the core network device specific to the network slice from the key of the core network device; and A key for the access network device specific to the network slice is derived from the key for the core network device specific to the network slice.

23. A core network device according to any one of claims 19 to 22, wherein the security information includes at least one of the following items: an indication for deriving at least one key specific to the network slice, identity information of the network slice, and encryption algorithm information specific to the network slice.

24. The core network device according to any one of claims 19 to 23, wherein the at least one memory and the computer program code are further configured to, together with the at least one processor, cause the core network device to further execute: A security request specific to the network slice is received from the terminal device, and the security information is sent in a response to the security request.

25. The core network device according to any one of claims 19 to 24, wherein the at least one memory and the computer program code are further configured to, together with the at least one processor, enable the core network device to further execute: A lifetime of the at least one key is determined, the lifetime being sent with the security information.

26. A method performed by a terminal device, comprising: Receive network slice-specific security information from core network devices; as well as Based on the security information, at least one key specific to the network slice is derived from the key of the access network device associated with the terminal device, and the key of the access network device is shared by the access network devices or specific to the network slice.

27. The method according to claim 26, further comprising: During the registration process, the capability of supporting different keys and / or encryption algorithms for different network slices is sent to the core network device.

28. The method of claim 26 or 27, wherein the security information is received in a registration acceptance, and the registration acceptance further comprises: A lifetime of the at least one key.

29. The method of claim 26 or 27, wherein the security information is received in a configuration update command, and the configuration update command further comprises: A lifetime of the at least one key.

30. The method according to claim 26 or 27, further comprising: A security request specific to the network slice is sent to the core network device, the security information is received in a response to the security request, and the response also includes: the lifetime of the at least one key.

31. The method of claim 26 or 27, wherein the security information is received via a protocol data unit session setup accept.

32. The method according to any one of claims 26 to 31, further comprising: Based on the identity information of the network slice, deriving a key of the core network device specific to the network slice from the key of the core network device; as well as The key of the access network device specific to the network slice is derived from the key of the core network device specific to the network slice.

33. A method according to any one of claims 26 to 32, wherein the security information includes at least one of the following items: an indication for deriving at least one key specific to the network slice, identity information of the network slice, and encryption algorithm information specific to the network slice.

34. A method according to any one of claims 26 to 33, wherein the at least one key comprises at least one of the following items: a key for user plane integrity specific to the network slice, a key for user plane encryption specific to the network slice, a key for radio resource control integrity specific to the network slice, and a key for radio resource control encryption specific to the network slice.

35. The method of claim 34, further comprising: The data in the network slice is protected using at least one of the following items: the key for user plane integrity and the encryption algorithm for deriving the key for user plane integrity, and the key for user plane encryption and the encryption algorithm for deriving the key for user plane encryption.

36. A method performed by an access network device, comprising: Receive network slice-specific security information from core network devices; as well as Based on the security information, at least one key specific to the network slice is derived from the key of the access network device, and the key of the access network device is shared by the access network devices or specific to the network slice.

37. The method of claim 36, wherein the security information is received in a configuration message of the terminal device, and the configuration message further comprises: A lifetime of the at least one key.

38. The method of claim 36, wherein the security information is received from the core network device via a protocol data unit session request.

39. A method according to any one of claims 36 to 38, wherein the key of the access network device is specific to the network slice and is derived by the core network device from the key of the core network device specific to the network slice, and the key of the core network device is derived based on the identity information of the network slice.

40. A method according to any one of claims 36 to 39, wherein the security information includes at least one of the following items: an indication for deriving at least one key specific to the network slice, identity information of the network slice, and encryption algorithm information specific to the network slice.

41. A method according to any one of claims 36 to 40, wherein the at least one key comprises at least one of the following items: a key for user plane integrity specific to the network slice, a key for user plane encryption specific to the network slice, a key for radio resource control integrity specific to the network slice, and a key for radio resource control encryption specific to the network slice.

42. The method of claim 41 further comprising: The data in the network slice is protected using at least one of the following items: the key for user plane integrity and the encryption algorithm for deriving the key for user plane integrity, and the key for user plane encryption and the encryption algorithm for deriving the key for user plane encryption.

43. A method according to any one of claims 36 to 42, wherein the access network device is associated with a centralized unit control plane and a centralized unit user plane, and the centralized unit user plane sends encryption capabilities for a network slice list or specific to a network slice to the centralized unit control plane, so that the centralized unit control plane makes a selection of the centralized unit user plane to support requirements for the network slice list or specific to the network slice.

44. A method performed by a core network device, comprising: Determining security information specific to the network slice based on the ability of the terminal device to support different keys and / or encryption algorithms for different network slices and a security policy specific to the network slice; as well as The security information specific to the network slice is sent to the terminal device and the access network device associated with the terminal device, respectively, so that the terminal device and the access network device can respectively derive at least one key specific to the network slice.

45. The method of claim 44, further comprising: During the registration process, the capability of supporting different keys and / or encryption algorithms for different network slices is received from the terminal device.

46. ​​The method according to claim 44 or 45, further comprising: The security policy specific to the network slice is retrieved from a policy device.

47. The method according to any one of claims 44 to 46, further comprising: Based on the identity information of the network slice, deriving a key of the core network device specific to the network slice from the key of the core network device; as well as A key for the access network device specific to the network slice is derived from the key for the core network device specific to the network slice.

48. A method according to any one of claims 44 to 47, wherein the security information includes at least one of the following items: an indication for deriving at least one key specific to the network slice, identity information of the network slice, and encryption algorithm information specific to the network slice.

49. The method according to any one of claims 44 to 48, further comprising: A security request specific to the network slice is received from the terminal device, and the security information is sent in a response to the security request.

50. The method according to any one of claims 44 to 49, further comprising: A lifetime of the at least one key is determined, the lifetime being sent with the security information.

51. A device as a terminal device, comprising: means for receiving network slice-specific security information from core network equipment; as well as A component for deriving at least one key specific to the network slice from a key of an access network device with which the terminal device is associated based on the security information, wherein the key of the access network device is common to the access network devices or is specific to the network slice.

52. A device as an access network device, comprising: means for receiving network slice-specific security information from core network equipment; as well as A component for deriving at least one key specific to the network slice from a key of the access network device based on the security information, wherein the key of the access network device is common to the access network devices or is specific to the network slice.

53. A device as a core network device, comprising: means for determining security information specific to the network slice based on the capability of the terminal device to support different keys and / or encryption algorithms for different network slices and a security policy specific to the network slice; as well as A component for sending the security information specific to the network slice to the terminal device and the access network device associated with the terminal device, respectively, so that the terminal device and the access network device can respectively derive at least one key specific to the network slice.

54. A computer-readable medium comprising program instructions for causing a terminal device to: receiving network slice-specific security information from core network equipment; and Based on the security information, at least one key specific to the network slice is derived from the key of the access network device associated with the terminal device, and the key of the access network device is shared by the access network devices or specific to the network slice.

55. A computer-readable medium comprising program instructions for causing an access network device to: receiving network slice-specific security information from core network equipment; and Based on the security information, at least one key specific to the network slice is derived from the key of the access network device, and the key of the access network device is shared by the access network devices or specific to the network slice.

56. A computer-readable medium comprising program instructions for causing a core network device to perform the following: Determining security information specific to the network slice based on the ability of the terminal device to support different keys and / or encryption algorithms for different network slices and a security policy specific to the network slice; and The security information specific to the network slice is sent to the terminal device and the access network device associated with the terminal device, respectively, so that the terminal device and the access network device can respectively derive at least one key specific to the network slice.

Images