Equipment, method and device for high-security network slicing and computer readable medium

Abstract

Apparatuses, methods, apparatuses, and computer-readable media for network slicing with high security are disclosed. An example network slice management generator may include at least one processor and at least one memory. The at least one memory may include computer program code, and the at least one memory and the computer program code may be configured, with the at least one processor, to cause the network slice management generator to perform the following: receive a request for security management requirements in a network slice from a network slice management consumer; evaluating resources for the security management requirements; and transmitting a report to the network slice management consumer regarding the resources allocated for the security management requirements.

Description

Technical Field

[0001] Various embodiments relate to devices, methods, apparatus, and computer-readable media for network slicing with high security. Background Art

[0002] Network slicing, also referred to as slicing, can be understood as a logical network on top of a shared infrastructure. An end-to-end (E2E) logical network for security management can be deployed and configured to provide security-as-a-service (SECaaS). This allows communication of security management and operation-related aspects between centralized clouds, edge clouds, and radio access network (RAN) network entities (NEs) including user equipment (UE) and Internet of Things (IoT) devices. There are millions of network entities in the fifth generation (5G) wireless telecommunication system, and ensuring the security of each device will be a huge challenge. Existing wireless networks have various limitations in the E2E automation of security operations and services. For example, there is no dedicated resource allocation mechanism to ensure the reliable execution of various security services. Existing systems do not have dedicated and secure resources to ensure fail-proof execution of E2E operations. Due to the lack of dedicated resources for security services, E2E automation of security event log collection, security log analysis, and risk mitigation steps cannot be reliably performed for complex and large systems such as 5G wireless networks. In addition, sharing or exchanging any security-sensitive materials such as keys over the air may be vulnerable to man-in-the-middle (MITM) attacks, etc. Summary of the invention

[0003] A brief summary of exemplary embodiments is provided below to provide a basic understanding of some aspects of various embodiments. It should be noted that this summary is not intended to identify key features of basic elements or define the scope of various embodiments, and its sole purpose is to introduce some concepts in a simplified form as a prelude to the more detailed description provided below.

[0004] In a first aspect, a network slice management producer is disclosed. The network slice management producer may include at least one processor and at least one memory. The at least one memory may include computer program code, and the at least one memory and the computer program code may be configured to use the at least one processor to cause the network slice management producer to perform the following operations: receive a request for security management requirements in a network slice from a network slice management consumer; evaluate resources for the security management requirements; and transmit a report on the resources allocated for the security management requirements to the network slice management consumer.

[0005] In some example embodiments, the evaluated resources may include at least one of transport resources and radio access network resources.

[0006] In some example embodiments, the at least one memory and the computer program code may also be configured to utilize the at least one processor to cause the network slice management generator to further execute: transmitting a request for the transport resources required for the security management to a transport slice orchestrator; and receiving a response from the transport slice orchestrator with the transport resources allocated for the security management requirement.

[0007] In some example embodiments, the at least one memory and the computer program code may also be configured to utilize the at least one processor to cause the network slice management generator to further execute: transmitting a request for the radio access network resources for the security management requirements to a radio access network slice orchestrator; and receiving a response from the radio access network slice orchestrator with the radio access network resources allocated for the security management requirements.

[0008] In some example embodiments, the security management requirements may be associated with a quality of service and / or service level agreement for the network slice.

[0009] In some example embodiments, the request for the security management requirement may include at least one of: a dedicated slice service type value for the network slice, at least one service distinguisher specific to the network slice, and at least one network slice type attribute specific to the network slice.

[0010] In some example embodiments, the at least one network slice type attribute may correspond to at least one service of security management and / or operation, respectively.

[0011] In a second aspect, a network slice management consumer is disclosed. The network slice management consumer may include at least one processor and at least one memory. The at least one memory may include computer program code, and the at least one memory and the computer program code may be configured to, with the at least one processor, cause the network slice management consumer to perform the following operations: transmit a request for security management requirements in a network slice to a network slice management generator; and receive a report from the network slice management generator on resources allocated for the security management requirements.

[0012] In some example embodiments, the security management requirements may be associated with a quality of service and / or service level agreement for the network slice.

[0013] In some example embodiments, the request for the security management requirement may include at least one of: a dedicated slice service type value for the network slice, at least one service distinguisher specific to the network slice, and at least one network slice type attribute specific to the network slice.

[0014] In some example embodiments, the at least one network slice type attribute may correspond to at least one service of security management and / or operation, respectively.

[0015] In a third aspect, a method performed by a network slice management generator is disclosed. The method may include: receiving a request for security management requirements in a network slice from a network slice management consumer; evaluating the resources for the security management requirements; and transmitting a report on the resources allocated for the security management requirements to the network slice management consumer.

[0016] In some example embodiments, the evaluated resources may include at least one of transport resources and radio access network resources.

[0017] In some example embodiments, the method may further include: transmitting a request for the transmission resources for the security management requirement to a transport slice orchestrator; and receiving a response from the transport slice orchestrator with the transmission resources allocated for the security management requirement.

[0018] In some example embodiments, the method may further include: transmitting a request for the radio access network resources for the security management requirement to a radio access network slice orchestrator; and receiving a response from the radio access network slice orchestrator with the radio access network resources allocated for the security management requirement.

[0019] In some example embodiments, the security management requirements may be associated with a quality of service and / or service level agreement for the network slice.

[0020] In some example embodiments, the request for the security management requirement may include at least one of: a dedicated slice service type value for the network slice, at least one service distinguisher specific to the network slice, and at least one network slice type attribute specific to the network slice.

[0021] In some example embodiments, the at least one network slice type attribute may correspond to at least one service of security management and / or operation, respectively.

[0022] In a fourth aspect, a method performed by a network slice management consumer is disclosed. The method may include: transmitting a request for security management requirements in a network slice to a network slice management generator; and receiving a report from the network slice management generator on resources allocated for the security management requirements.

[0023] In some example embodiments, the security management requirements may be associated with a quality of service and / or service level agreement for the network slice.

[0024] In some example embodiments, the request for the security management requirement may include at least one of: a dedicated slice service type value for the network slice, at least one service distinguisher specific to the network slice, and at least one network slice type attribute specific to the network slice.

[0025] In some example embodiments, the at least one network slice type attribute may correspond to at least one service of security management and / or operation, respectively.

[0026] In a fifth aspect, an apparatus is disclosed. The apparatus as a network slice management generator may include: means for receiving a request for security management requirements in a network slice from a network slice management consumer; means for evaluating resources for the security management requirements; and means for transmitting a report of the resources allocated for the security management requirements to the network slice management consumer.

[0027] In some example embodiments, the evaluated resources may include at least one of transport resources and radio access network resources.

[0028] In some example embodiments, the apparatus may further include: means for transmitting a request for the transmission resources for the security management requirement to a transmission slice scheduler; and means for receiving a response from the transmission slice scheduler with the transmission resources allocated for the security management requirement.

[0029] In some example embodiments, the apparatus may further include: means for transmitting a request for the radio access network resources for the security management requirement to a radio access network slice orchestrator; and means for receiving a response from the radio access network slice orchestrator with the radio access network resources allocated for the security management requirement.

[0030] In some example embodiments, the security management requirements may be associated with a quality of service and / or service level agreement for the network slice.

[0031] In some example embodiments, the request for the security management requirement may include at least one of: a dedicated slice service type value for the network slice, at least one service distinguisher specific to the network slice, and at least one network slice type attribute specific to the network slice.

[0032] In some example embodiments, the at least one network slice type attribute may correspond to at least one service of security management and / or operation, respectively.

[0033] In a sixth aspect, an apparatus is disclosed. The apparatus as a network slice management consumer may include: means for transmitting a request for security management requirements in a network slice to a network slice management generator; and means for receiving a report of resources allocated for the security management requirements from the network slice management generator.

[0034] In some example embodiments, the security management requirements may be associated with a quality of service and / or service level agreement for the network slice.

[0035] In some example embodiments, the request for the security management requirement may include at least one of: a dedicated slice service type value for the network slice, at least one service distinguisher specific to the network slice, and at least one network slice type attribute specific to the network slice.

[0036] In some example embodiments, the at least one network slice type attribute may correspond to at least one service of security management and / or operation, respectively.

[0037] In a seventh aspect, a computer-readable medium is disclosed. The computer-readable medium may include instructions stored thereon for causing a network slice management generator to: receive a request for security management requirements in a network slice from a network slice management consumer; evaluate resources for the security management requirements; and transmit a report of the resources allocated for the security management requirements to the network slice management consumer.

[0038] In some example embodiments, the evaluated resources may include at least one of transport resources and radio access network resources.

[0039] In some example embodiments, the computer-readable medium may also include instructions stored thereon for causing the network slice management generator to further execute: transmitting a request for the transport resources for the security management requirements to a transport slice orchestrator; and receiving a response from the transport slice orchestrator with the transport resources allocated for the security management requirements.

[0040] In some example embodiments, the computer-readable medium may also include instructions stored thereon for causing the network slice management generator to further execute: transmitting a request for the radio access network resources for the security management requirements to a radio access network slice orchestrator; and receiving a response from the radio access network slice orchestrator with the radio access network resources allocated for the security management requirements.

[0041] In some example embodiments, the security management requirements may be associated with a quality of service and / or service level agreement for the network slice.

[0042] In some example embodiments, the request for the security management requirement may include at least one of: a dedicated slice service type value for the network slice, at least one service distinguisher specific to the network slice, and at least one network slice type attribute specific to the network slice.

[0043] In some example embodiments, the at least one network slice type attribute may correspond to at least one service of security management and / or operation, respectively.

[0044] In an eighth aspect, a computer-readable medium is disclosed. The computer-readable medium may include instructions stored thereon for causing a network slice management consumer to: transmit a request for security management requirements in a network slice to a network slice management generator; and receive a report from the network slice management generator on resources allocated for the security management requirements.

[0045] In some example embodiments, the security management requirements may be associated with a quality of service and / or service level agreement for the network slice.

[0046] In some example embodiments, the request for the security management requirement may include at least one of: a dedicated slice service type value for the network slice, at least one service distinguisher specific to the network slice, and at least one network slice type attribute specific to the network slice.

[0047] In some example embodiments, the at least one network slice type attribute may correspond to at least one service of security management and / or operation, respectively.

[0048] Other features and advantages of example embodiments of the present disclosure will also be apparent from the following description of specific embodiments when read in conjunction with the accompanying drawings, which illustrate, by way of example, the principles of example embodiments of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Some example embodiments will now be described, by way of non-limiting examples, with reference to the accompanying drawings.

[0050] Figure 1 Exemplary scenarios are shown that can be implemented by example embodiments of the present disclosure.

[0051] Figure 2 An exemplary sequence diagram for creating a network slice with high security according to an example embodiment of the present disclosure is shown.

[0052] Figure 3 Exemplary scenarios are shown in which some example embodiments of the present disclosure may be implemented.

[0053] Figure 4 Exemplary scenarios are shown in which some example embodiments of the present disclosure may be implemented.

[0054] Figure 5 An exemplary sequence diagram for secure PDU session establishment for slices with high security according to an exemplary embodiment of the present disclosure is shown.

[0055] Figure 6 An exemplary sequence diagram illustrating an example use case scenario for secure key preparation according to an example embodiment of the present disclosure is shown.

[0056] Figure 7 A flowchart of an example method 700 for network slicing with high security according to an example embodiment of the present disclosure is shown.

[0057] Figure 8 A flowchart is shown illustrating an example method 800 for network slicing with high security according to an example embodiment of the present disclosure.

[0058] Fig. 9 A block diagram is shown illustrating an example device 900 for network slicing with high security according to an example embodiment of the present disclosure.

[0059] Fig.10 A block diagram is shown illustrating an example device 1000 for network slicing with high security according to an example embodiment of the present disclosure.

[0060] Fig.11 A block diagram is shown illustrating an example device 1100 for network slicing with high security according to an example embodiment of the present disclosure.

[0061] Fig.12 A block diagram is shown illustrating an example device 1200 for network slicing with high security according to an example embodiment of the present disclosure.

[0062] Throughout the drawings, the same or similar reference numerals indicate the same or similar elements, and repeated description of the same elements will be omitted. DETAILED DESCRIPTION

[0063] Below, some example embodiments are described in detail with reference to the accompanying drawings. The following description includes specific details for the purpose of providing a thorough understanding of the various concepts. However, it will be appreciated by those skilled in the art that these concepts can be practiced without these specific details. In some cases, well-known circuits, techniques, and components are shown in block diagram form to avoid obscuring the concepts and features described.

[0064] Each exemplary embodiment of the present disclosure provides a network slicing solution with high security. According to an exemplary embodiment of the present disclosure, a network slice with high security can be created as a network slice dedicated to security management or a network slice with features dedicated to security management.

[0065] Figure 1 An exemplary scenario that can be implemented by an exemplary embodiment of the present disclosure is shown. Figure 1 The highly secure E2E network slice of the example embodiment of the present disclosure can provide various terminal users such as terminal user 1, terminal user 2, ... terminal user n and various terminal devices such as terminal device 1, terminal device 2, ... terminal device n with the resources required for reliable and secure security services and operational workflows in various use cases and / or applications such as certificate management, key distribution, key renewal, security software upgrades, vulnerability patch management, security event log collection, and security event analysis.

[0066] Figure 2 An exemplary sequence diagram for creating a network slice with high security according to an exemplary embodiment of the present disclosure is shown. Figure 2 , RAN slice orchestrator 210, transport slice orchestrator 220, central slice orchestrator 230, and operator 240 are shown as example entities for creating network slices with high security.

[0067] refer to Figure 2 , an operator 240, which may be a network slice management consumer, may transmit a request 242 for security management requirements in a network slice to a central slice orchestrator 230, which may be a network slice management generator. The request 242 may trigger configuration of a network slice with high security that meets the security management requirements. In some embodiments, the operator 240 may request the creation of a network slice with high security for key management. Alternatively or additionally, in some embodiments, the operator 240 may request the creation of another network slice with high security for certificate management and patch management.

[0068] In operation 232, receiving a request 242 for security management requirements in a network slice from an operator 240, the central slice orchestrator 230 may evaluate resources for the security management requirements. In one embodiment, the central slice orchestrator 230 may evaluate at least transport resources and RAN resources for the security management requirements. In this embodiment, the evaluated resources may include at least one of transport resources and RAN resources.

[0069] The central slice orchestrator 230 may transmit a request 234 for transmission resources for the security management requirement to the transport slice orchestrator 220. For example, the transmission resources may be the transmission resources required for the security management requirement evaluated in operation 232. Upon receiving the request 234, the transport slice orchestrator 220 may allocate the required transmission resources, and then transmit a response 224 having the transmission resources allocated for the security management requirement to the central slice orchestrator 230. Also, the central slice orchestrator 230 may receive a response 224 having the transmission resources allocated for the security management requirement from the transport slice orchestrator 220.

[0070] Before, in parallel with, or after transmitting the request 234 and receiving the response 224, the central slice orchestrator 230 may transmit a request 236 for RAN resources for security management requirements to the RAN slice orchestrator 210. For example, the RAN resources may be the RAN resources required for the security management requirements evaluated in operation 232. Upon receiving the request 236, the RAN slice orchestrator 210 may allocate the required RAN resources and then transmit a response 216 with the RAN resources allocated for the security management requirements to the central slice orchestrator 230. And, the central slice orchestrator 230 may receive a response 216 with the RAN resources allocated for the security management requirements from the RAN slice orchestrator 210.

[0071] The central slice orchestrator 230 may then transmit a report 238 about the resources allocated for the security management requirements to the operator 240. Upon receiving the report 238 about the resources allocated for the security management requirements from the central slice orchestrator 230, the operator 240 may use the network slice with high security for various use cases as needed. The network slice with high security may have configurations for security management use cases for industrial IoT, home security, public safety, etc. regarding security services, such as application functions (KAFs) for refreshing keys for authentication and key management (AKMA) of applications, key management including short-term / long-term key distribution for IoT devices and / or UEs, certificate management on IoT devices or UEs, security patch management on IoT devices or UEs, security software management on IoT devices or UEs, security logs collected from IoT devices and / or UEs, etc.

[0072] In one embodiment, the security management requirements may be associated with the quality of service (QoS) and / or service level agreement (SLA) of the network slice. For example, the security management requirements may be associated with different levels of QoS. The QoS of a network slice may be, for example, ensuring high throughput for use cases such as security log collection, patch download, secure software download, and integrity protection.

[0073] Alternatively or additionally, the security management requirements may be associated with different SLA requirements for E2E security management and / or network slicing operations. The SLA requirements may be, for example, at least one of: enhanced slice isolation requirements, support for UE network authorization, authentication of application functions (AF), E2E replay protection requirements, E2E confidentiality protection requirements, E2 integrity protection requirements, security policies on N6, N6 may be an interface between a user plane function (UPF) of a core network (CN) and a data network (DN), etc.

[0074] In one embodiment, the request 242 for security management requirements may include at least one of the following: a dedicated slice service type (SST) value for the network slice, at least one service differentiator (SD) specific to the network slice, and at least one network slice type (NEST) attribute specific to the network slice.

[0075] For example, in the case of introducing a dedicated SST value for a network slice dedicated to security management, if the dedicated SST value is included in the request 234, a network slice with high security may be created as a network slice dedicated to security management. For example, an SST value of "6" may be introduced for security of a slice / service type having slice characteristics suitable for processing security services. Using the dedicated SST value in the request 234, a network slice dedicated to security management may be created for security services.

[0076] Alternatively or additionally, in one embodiment, the request 234 may include at least one network slice-specific SD. For example, for the same SST value, there may be different SDs corresponding to different security services, such as security patch updates, software downloads and integrity protection, security log transmission, security analysis services, key distribution, etc. In this embodiment, as an option, the network slice dedicated to security management may share the SST value with other slices / service types. In the case where the SST value is not dedicated to the security service type, the SST value may have a dedicated SD defined for at least one security service. Using at least one SD specific to the network slice in the request 234, a network slice dedicated to security management can be created for the corresponding security service.

[0077] Alternatively or additionally, in one embodiment, the request 234 may include at least one NEST attribute specific to the network slice. For example, different values ​​of NEST attributes may be predefined and configured on network slices with high security that share the same security SST but have different SDs. In one embodiment, at least one NEST attribute may correspond to at least one service of security management and / or operation, respectively. The NEST attributes corresponding to the security management and / or operation services may be, for example, use case-specific attributes, such as key management-related attributes, certificate management-related attributes, and / or security log management-related attributes. Certificate management-related attributes may be, for example, the minimum acceptable certificate expiration time, which means that all certificate updates must occur before this time. For example, if the minimum acceptable certificate expiration time is set to 7 days, certificate management must ensure that all certificates that expire within 7 days are updated immediately. Security log management-related attributes may be, for example, the period of security event log transmission from UE / IoT devices to the network, security monitoring and log analysis function configuration at the network, etc. NEST attributes may also be attributes such as SLA defined in a service profile, the isolation level may be physical isolation, availability should be ensured to reach 99.9999%, session and service continuity support, etc. A network slice dedicated to security management or having features dedicated to security management may be created for corresponding security management and / or operation services using at least one NEST attribute specific to the network slice included in the request 234. In the case where a network slice with high security is used for E2E security management, E2E encryption may be required.

[0078] Figure 3 The following shows some exemplary scenarios that can be implemented by some exemplary embodiments of the present disclosure. Figure 3 In the scenario of , the E2E network slice includes UE slice, RAN slice, transport slice and CN slice. UE 1 uses slice 1 dedicated to enhanced mobile broadband (eMBB), slice 2 dedicated to ultra-reliable low latency communication (URLLC) and slice 3 dedicated to security management, and UE 2 uses slice 3 dedicated to security control and slice 4 dedicated to mobile Internet of Things (MIoT). The RAN slice provides RANeMBB for slice 1, RAN URLLC for slice 2, RAN security for slice 3, and RAN MIoT for slice 4. The CN slice provides CN eMBB for slice 1, CN URLLC for slice 2, CN security for slice 3, and CNMIoT for slice 4. The transport slice provides N2 and / or N3 interfaces between the RAN slice and the corresponding CN slice. Slice 3 dedicated to security management used by UE 1 and UE 2 is highly secure, and the mobile network operator (MNO) can use slice 3 for security operations.

[0079] Figure 4 The following shows some exemplary scenarios that can be implemented by some exemplary embodiments of the present disclosure. Figure 3 In comparison, Figure 4 In the scenario, instead of creating a network slice dedicated to security management, a network slice with features dedicated to security management is created. Figure 4 In the example, the UE uses slice 1, slice 2, and slice 3. Slice 3 is created for the slice tenant, and two packet data unit (PDU) sessions are established in slice 3. PDU session 1 is used for MIoT, and PDU session 2 is dedicated to security management and is highly secure. The tenant of slice 3 can use PDU session 2 in slice 3 for security operations.

[0080] Figure 5 An exemplary sequence diagram of secure PDU session establishment for a slice with high security according to an exemplary embodiment of the present disclosure is shown. Figure 5 , UE 510, RAN 520, session management function (SMF) 530, UPF 540, AF 550, access and mobility management function (AMF) 560, and unified data management (UDM) 570 are shown as entities for establishing a secure PDU session for a slice with high security. A slice with high security may be, for example, a network slice dedicated to security management, e.g. Figure 3 Slice 3 shown in , or a network slice with features dedicated to security management, such as Figure 4 Slice 3 is shown in FIG. 5. The AF 550 can be controlled by the operator.

[0081] In operation 512, UE 510 may register in a slice with high security through a UE registration procedure. Then, UE 510 may transmit a PDU session establishment request 514 to SMF 530 via AMF 560. Upon receiving the request 514, SMF 530 may obtain a security policy that satisfies the security management requirements in the slice with high security from UDM 570. Here, UDM 570 is shown as an example of a policy device, and it is understandable that a network slice selection function (NSSF) and / or a policy control function (PCF) may also be used as a policy device that stores and provides security policies.

[0082] After obtaining the security policy, in operation 534, SMF 530 may configure routing in UPF 540 according to the security policy. In operation 522, SME 530 may create a PUD session with RAN 520 via AMF 560 according to the security policy, so that the created PUD session may meet the security management requirements in the slice.

[0083] Then, the SMF 530 may transmit a PDU session establishment response 536 with the security policy to the UE 510 via the AMF 560. Compared with other slices or other PDU sessions, the PUD session created in the slice may provide highly secure E2E protection, such as encryption and / or integrity, with enhanced security. For example, compared with other slices or other PDU sessions, the algorithms used for integrity and encryption in the created PUD session may have a higher E2E security level.

[0084] Figure 6 An example sequence diagram is shown for an example use case scenario for secure key configuration according to an example embodiment of the present disclosure.

[0085] In operation 612, a PDU session is established in a slice with high security. For example, the PDU session may be established based on, for example, Figure 5 The exemplary sequence shown in creates a PDU session to provide highly secure E2E protection with enhanced security in terms of, for example, encryption and / or integrity compared to other slices or other PDU sessions.

[0086] In operation 652, AF 550 may, for example, update the home network public key. AF 550 may then transmit the updated home network public key and identifier set to UE 510 via UPF 540 and RAN 520 in a downlink (DL) packet 654. In operation 614, UE 510 may store the updated home network public key and identifier set in, for example, a universal subscriber identity module (USIM).

[0087] In operation 656, the AF 550 may perform other security updates in the USIM with the protection scheme identifier list. After a successful security update, in operation 616, the PDU session may be released.

[0088] Figure 7 A flow chart illustrating an example method 700 for network slicing with high security according to an example embodiment of the present disclosure is shown. The example method 700 may be performed, for example, at a network slice management generator such as the central slice orchestrator 230.

[0089] refer to Figure 7 , the example method 700 may include: operation 710, receiving a request for security management requirements in a network slice from a network slice management consumer; operation 720, evaluating resources used for the security management requirements; and operation 730, transmitting a report to the network slice management consumer regarding resources allocated for the security management requirements.

[0090] In the above description, the details of operation 710 have been described at least with respect to request 242, and a repeated description thereof is omitted here.

[0091] In the above description, the details of operation 720 have been described at least with respect to operation 232, and a repeated description thereof is omitted here.

[0092] In the above description, at least the details of operation 730 are described with respect to the report 238, and a repeated description thereof is omitted here.

[0093] In one embodiment, the evaluated resources may include at least one of transmission resources and RAN resources. In the above description, more details have been described at least for operation 232, request 234 and request 236, and their repeated description is omitted here.

[0094] In one embodiment, the example method 700 may further include an operation of transmitting a request for a transmission resource required for security management to a transmission slice organizer; and an operation of receiving a response having the transmission resource allocated for security management requirements from the transmission slice organizer. In the above description, more details have been described at least for the request 234 and the response 224, and their repeated description is omitted here.

[0095] In one embodiment, the example method 700 may further include an operation of transmitting a request for RAN resources required for security management to the RAN slice organizer; and an operation of receiving a response having the RAN resources allocated for security management requirements from the RAN slice organizer. In the above description, more details have been described at least for the request 236 and the response 216, and their repeated description is omitted here.

[0096] In one embodiment, security management requirements may be associated with the QoS and / or SLA of the network slice.

[0097] In one embodiment, the request for security management requirements may include at least one of the following: a dedicated SST value for the network slice, at least one SD specific to the network slice, and at least one NEST attribute specific to the network slice. More details have been described at least for request 242 in the above description, and their repeated description is omitted here.

[0098] In one embodiment, at least one NEST attribute may respectively correspond to at least one service of security management and / or operation.

[0099] Figure 8 A flow chart illustrating an example method 800 for network slicing with high security according to an example embodiment of the present disclosure is shown. The example method 800 may be performed, for example, at a network slice management consumer such as operator 240.

[0100] refer to Figure 8 , the example method 800 may include: operation 810, transmitting a request for security management requirements in a network slice to a network slice management generator; and operation 820, receiving a report from the network slice management generator regarding resources allocated for the security management requirements.

[0101] In the above description, the details of operation 810 have been described at least for request 242, and a repeated description thereof is omitted here.

[0102] In the above description, at least the details of operation 820 are described with respect to the report 238, and a repeated description thereof is omitted here.

[0103] In one embodiment, security management requirements may be associated with the QoS and / or SLA of the network slice.

[0104] In one embodiment, the request for security management requirements may include at least one of the following: a dedicated SST value for the network slice, at least one SD specific to the network slice, and at least one NEST attribute specific to the network slice. More details have been described at least for request 242 in the above description, and their repeated description is omitted here.

[0105] In one embodiment, at least one NEST attribute may respectively correspond to at least one service of security management and / or operation.

[0106] Fig. 9 A block diagram showing an example device (apparatus) 900 for network slicing with high security according to an example embodiment of the present disclosure is shown. For example, the device may be a network slice management generator, such as at least a part of the central slice orchestrator 230 in the above example.

[0107] like Fig. 9 As shown in FIG. 1 , the example device 900 may include at least one processor 910 and at least one memory 920 that may include computer program code 930. The at least one memory 920 and the computer program code 930 may be configured to utilize the at least one processor 910 to cause the device 900 to perform at least the example method 700 described above.

[0108] In various example embodiments, at least one processor 910 in the example device 900 may include, but is not limited to, at least one hardware processor, including at least one microprocessor such as a central processing unit (CPU), a portion of at least one hard processor, and any other suitable special-purpose processor, such as a processor developed based on, for example, a field programmable gate array (FPGA) and an application-specific integrated circuit (ASIC). In addition, the at least one processor 910 may also include Fig. 9 At least one other circuit or element not shown.

[0109] In various example embodiments, at least one memory 920 in the example device 900 may include various forms of at least one storage medium, such as volatile memory and / or non-volatile storage. Volatile memory may include, but is not limited to, for example, random access memory (RAM), cache, etc. Non-volatile memory may include, but is not limited to, for example, read-only memory (ROM), hard disk, flash memory, etc. In addition, at least memory 920 may include, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any combination of the above.

[0110] Furthermore, in various example embodiments, the example device 900 may further include at least one other circuit, element, and interface, such as at least one I / O interface, at least one antenna element, and the like.

[0111] In various example embodiments, circuits, components, elements, and interfaces in an example device 900 including at least one processor 910 and at least one memory 920 may be coupled together in any suitable manner, such as electrically, magnetically, optically, electromagnetically, etc., via any suitable connection including, but not limited to, buses, switches, wiring, and / or wireless lines.

[0112] It should be understood that the structure of the device on the network slice management generator side is not limited to the above-mentioned example device 900.

[0113] Fig.10 A block diagram showing an example device (apparatus) 1000 for network slicing with high security according to an example embodiment of the present disclosure is shown. For example, the device can be at least a part of a network slice management consumer, such as the operator 240 in the above example.

[0114] like Fig.10 As shown in FIG. 8 , the example device 1000 may include at least one processor 1010 and at least one memory 1020 that may include computer program code 1030. The at least one memory 1020 and the computer program code 1030 may be configured to utilize the at least one processor 1010 to cause the device 1000 to perform at least the example method 800 described above.

[0115] In various example embodiments, at least one processor 1010 in the example device 1000 may include, but is not limited to, at least one hardware processor, including at least one microprocessor such as a central processing unit (CPU), a portion of at least one hardware processor, and any other suitable special-purpose processor, such as a processor developed based on a field programmable gate array (FPGA) and an application-specific integrated circuit (ASIC). In addition, the at least one processor 1010 may also include Fig.10 At least one other circuit or element not shown.

[0116] In various example embodiments, at least one memory 1020 in the example device 1000 may include various forms of at least one storage medium, such as volatile memory and / or non-volatile memory. Volatile memory may include, but is not limited to, for example, random access memory (RAM), cache, etc. Non-volatile memory may include, but is not limited to, for example, read-only memory (ROM), hard disk, flash memory, etc. In addition, at least memory 1020 may include, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any combination of the above.

[0117] Furthermore, in various example embodiments, the example device 1000 may further include at least one other circuit, element, and interface, such as at least one I / O interface, at least one antenna element, and the like.

[0118] In various example embodiments, the circuits, components, elements, and interfaces in the example device 1000 including at least one processor 1010 and at least one memory 1020 may be coupled together in any suitable manner, such as electrically, magnetically, optically, electromagnetically, etc., via any suitable connection including, but not limited to, buses, switches, wiring, and / or wireless lines.

[0119] It should be understood that the structure of the device on the network slice management consumer side is not limited to the above-mentioned example device 1000.

[0120] Fig.11 A block diagram showing an example device 1100 for network slicing with high security according to an example embodiment of the present disclosure is shown. For example, the device may be at least a part of a network slice management generator, such as the central slice orchestrator 230 in the above example.

[0121] like Fig.11 As shown in the example device 1100, the example device 1100 may include means 1110 for performing operation 710 of the example method 700, means 1120 for performing operation 720 of the example method 700, and means 1130 for performing operation 730 of the example result 700. In one or more other example embodiments, the example device 1100 may further include at least one I / O interface, at least one antenna element, etc.

[0122] In some example embodiments, examples of means in example device 1100 may include circuitry. For example, an example of means 1110 may include circuitry configured to perform operation 710 of example method 700, an example of means 1120 may include circuitry configured to perform operation 720 of example method 700, and an example of means 1130 may include circuitry configured to perform operation 730 of example result 700. In some example embodiments, examples of means may also include software modules and any other suitable functional entities.

[0123] Fig.12 A block diagram showing an example device 1200 for network slicing with high security according to an example embodiment of the present disclosure is shown. For example, the device can be at least a part of a network slice management consumer, such as the operator 240 in the above example.

[0124] like Fig.12 As shown in the example device 1200, the example device 1200 may include means 1210 for performing operation 810 of the example method 800 and means 1220 for performing operation 820 of the example process 800. In one or more other example embodiments, the example device 1200 may also include at least one I / O interface, at least one antenna element, etc.

[0125] In some example embodiments, examples of means in example device 1200 may include circuitry. For example, examples of means 1210 may include circuitry configured to perform operation 810 of example method 800, and examples of means 1220 may include circuitry configured to perform operation 820 of example process 800. In some example embodiments, examples of means may also include software modules and any other suitable functional entities.

[0126] As used in this application, the term "circuitry" may refer to one or more or all of the following: (a) hardware-only implementations of the circuit (such as implementations in analog and / or digital circuits only); and (b) combinations of hardware circuitry and software, such as (as applicable) (i) a combination of analog and / or digital hardware circuitry and software / firmware, and (ii) a hardware processor and software (including a digital signal processor), any portion of software and memory that work together to enable a device such as a mobile phone or server to perform various functions); and (c) a hardware circuit and / or processor, such as a microprocessor or a portion of a microprocessor, that requires software (e.g., firmware) to operate, but the software may not be present when the software is not required to operate. This definition of circuitry applies to this disclosure, including one or all uses of the term in any claim. As a further example, as used in this disclosure, the term circuitry also covers implementations of hardware circuitry or a processor (or multiple processors) or a portion of a hardware circuit or processor and its (or their) accompanying software and / or firmware. The term circuitry also covers, for example and if applicable to the claimed element, a baseband integrated circuit or processor integrated circuit for a mobile device or a similar integrated circuit in a server, cellular network equipment, or other computing or networking equipment.

[0127] Another example embodiment may involve computer program code or instructions that can cause an apparatus to perform at least each of the above methods. Another example embodiment may involve a computer readable medium having such computer program code or instructions stored thereon. In some example embodiments, such a computer readable medium may include at least one storage medium in various forms, such as volatile memory and / or non-volatile memory. Volatile memory may include, but is not limited to, for example, RAM, cache, etc. Non-volatile memory may include, but is not limited to, ROM, hard disk, flash memory, etc. Non-volatile memory may also include, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices, or devices or any combination of the above.

[0128] Unless the context clearly requires otherwise, throughout the specification and claims, the words "comprise", "including", and the like are to be interpreted in an inclusive rather than an exclusive or exhaustive sense; that is, in the sense of "including but not limited to". As generally used herein, the word "coupled" refers to two or more elements that can be directly connected or connected through one or more intermediate elements. Similarly, as generally used herein, the word "connected" refers to two or more elements that can be directly connected or connected through one or more intermediate elements. In addition, the words "herein", "above", "below", and words of similar meaning as used in this application shall refer to the entirety of this application and not to any particular part of this application. Where the context permits, words used in the specification in the singular or plural may also include the plural or singular, respectively. The word "or" refers to a list of two or more items, and the word covers all of the following interpretations of the word: any item in the list, all items in the list, and any combination of items in the list.

[0129] Furthermore, conditional language used herein, such as "may," "could," "might," "likely," "for example," "for example," "such as," and the like, unless otherwise specifically noted or otherwise understood in the context of use, is generally intended to convey that certain embodiments include, while other embodiments do not include, certain features, elements, and / or states. Thus, such conditional language generally does not imply that features, elements, and / or states are in any way required by one or more embodiments, or that one or more embodiments necessarily include logic for determining, with or without author input or prompting, whether such features, elements, or states are included or will be performed in any particular embodiment.

[0130] As used herein, the term "determining" (and grammatical variations thereof) may include at least the following: calculating, computing, processing, deriving, measuring, investigating, searching (e.g., searching in a table, database, or other data structure), confirming, etc. In addition, "determining" may include receiving (e.g., receiving information), accessing (e.g., accessing data in a memory), obtaining, etc. In addition, "determining" may include resolving, selecting, choosing, establishing, etc.

[0131] Although some embodiments have been described, these embodiments are presented by way of example and are not intended to limit the scope of the present disclosure. In fact, the devices, methods, and systems described herein may be embodied in various other forms; in addition, various omissions, substitutions, and changes may be made to the forms of the methods and systems described herein without departing from the spirit of the present disclosure. For example, although the blocks are presented in a given arrangement, alternative embodiments may utilize different components and / or circuit topologies to perform similar functions, and may delete, move, add, subdivide, combine, and / or modify some blocks. At least one of these blocks may be implemented in various different ways. The order of these blocks may also be changed. Any suitable combination of the elements and actions of some of the above-described embodiments may be combined to provide further embodiments. The attached claims and their equivalents are intended to cover such forms or modifications that fall within the scope and spirit of the present disclosure.

[0132] The abbreviations used in the specification and / or drawings are defined as follows:

[0133] AF application function

[0134] Authentication and key management for AKMA applications

[0135] AMF access and mobility management function

[0136] CN Core Network

[0137] DL Downlink

[0138] DN Data Network

[0139] eMBB Enhanced Mobile Broadband

[0140] E2E End to End

[0141] IoT

[0142] KAF is the key used for application functions

[0143] MIoT Mobile Internet of Things

[0144] MITM

[0145] MNO Mobile Network Operator

[0146] NE Network Entity

[0147] NEST network slice type

[0148] NSSF network slice selection function

[0149] PCF Policy Control Function

[0150] PDU Packet Data Unit

[0151] QoS Quality of Service

[0152] RAN Radio Access Network

[0153] SD Service Differentiator

[0154] SECaaS Security as a Service

[0155] SLA Service Level Agreement

[0156] SMF session management functions

[0157] SST Slice Service Type

[0158] UDM Unified Data Management

[0159] UE User Equipment

[0160] UPF User Plane Function

[0161] URLLC Ultra-Reliable Low Latency Communications

[0162] USIM Universal Subscriber Identity Module

[0163] 5G Fifth Generation

Claims

1. A network slice management generator, comprising: at least one processor; as well as at least one memory including computer program code, the at least one memory and the computer program code being configured to, with the at least one processor, cause the network slice management generator to execute: receiving a request for security management requirements in a network slice from a network slice management consumer; Evaluating resources for said security management requirements; as well as Transmitting a report to the network slice management consumer regarding the resources allocated for the security management requirement.

2. The network slice management generator according to claim 1, wherein: The evaluated resources include at least one of transmission resources and radio access network resources.

3. The network slice management generator according to claim 2, wherein: The at least one memory and the computer program code are further configured to, with the at least one processor, cause the network slice management generator to further execute: transmitting a request for the transport resources for the security management requirement to a transport slice orchestrator; as well as A response is received from the transport slice orchestrator with the transport resources allocated for the security management requirement.

4. The network slice management generator according to claim 2 or 3, wherein: The at least one memory and the computer program code are further configured to, with the at least one processor, cause the network slice management generator to further execute: transmitting a request to a radio access network slice orchestrator for the radio access network resources for the security management requirement; as well as A response is received from the radio access network slice orchestrator with the radio access network resources allocated for the security management requirement.

5. The network slice management generator according to any one of claims 1 to 4, wherein: The security management requirements are associated with the quality of service and / or service level agreement of the network slice.

6. The network slice management generator according to any one of claims 1 to 5, wherein: The request for security management requirements includes at least one of the following: a dedicated slice service type value for the network slice, at least one service distinguisher dedicated to the network slice, and at least one network slice type attribute dedicated to the network slice.

7. The network slice management generator according to claim 6, wherein: The at least one network slice type attribute corresponds to at least one service of security management and / or operation, respectively.

8. A network slice management consumer, comprising: at least one processor; as well as at least one memory including computer program code, the at least one memory and the computer program code being configured to, with the at least one processor, cause the network slice management consumer to perform: transmitting a request for security management requirements in the network slice to a network slice management generator; as well as Receiving a report from the network slice management generator regarding resources allocated for the security management requirements.

9. The network slice management consumer according to claim 8, wherein: The security management requirements are associated with the quality of service and / or service level agreement of the network slice.

10. The network slice management consumer according to claim 8 or 9, wherein: The request for security management requirements includes at least one of: a dedicated slice service type value for the network slice, at least one service distinguisher specific to the network slice, and at least one network slice type attribute specific to the network slice.

11. The network slice management consumer according to claim 10, wherein: The at least one network slice type attribute corresponds to at least one service of security management and / or operation, respectively.

12. A method performed by a network slice management generator, comprising: receiving a request for security management requirements in a network slice from a network slice management consumer; Evaluating resources for said security management requirements; as well as Transmitting a report to the network slice management consumer regarding the resources allocated for the security management requirement.

13. The method of claim 12, wherein: The evaluated resources include at least one of transmission resources and radio access network resources.

14. The method of claim 13, further comprising: transmitting a request for the transport resources for the security management requirement to a transport slice orchestrator; as well as A response is received from the transport slice orchestrator with the transport resources allocated for the security management requirement.

15. The method according to claim 13 or 14, further comprising: transmitting a request to a radio access network slice orchestrator for the radio access network resources for the security management requirement; as well as A response is received from the radio access network slice orchestrator with the radio access network resources allocated for the security management requirement.

16. The method according to any one of claims 12 to 15, wherein: The security management requirements are associated with the quality of service and / or service level agreement of the network slice.

17. The method according to any one of claims 12 to 16, wherein: The request for security management requirements includes at least one of: a dedicated slice service type value for the network slice, at least one service distinguisher specific to the network slice, and at least one network slice type attribute specific to the network slice.

18. The method of claim 17, wherein: The at least one network slice type attribute corresponds to at least one service of security management and / or operation, respectively.

19. A method performed by a network slice management consumer, comprising: transmitting a request for security management requirements in the network slice to a network slice management generator; as well as Receiving a report from the network slice management generator regarding resources allocated for the security management requirements.

20. The method of claim 19, wherein: The security management requirements are associated with the quality of service and / or service level agreement of the network slice.

21. The method of claim 19 or 20, wherein: The request for security management requirements includes at least one of: a dedicated slice service type value for the network slice, at least one service distinguisher specific to the network slice, and at least one network slice type attribute specific to the network slice.

22. The method of claim 21, wherein: The at least one network slice type attribute corresponds to at least one service of security management and / or operation, respectively.

23. A device as a network slice management generator, comprising: means for receiving a request for security management requirements in a network slice from a network slice management consumer; means for evaluating resources for said security management requirement; as well as Means for transmitting a report to the network slice management consumer regarding resources allocated for the security management requirement.

24. A device as a network slice management consumer, comprising: means for transmitting a request for security management requirements in a network slice to the network slice management generator; as well as Means for receiving a report from the network slice management generator of resources allocated for the security management requirements.

25. A computer readable medium comprising program instructions for causing a network slice management generator to: receiving a request for security management requirements in a network slice from a network slice management consumer; assessing resources for said security management requirements; and Transmitting a report to the network slice management consumer regarding resources allocated for the security management requirement.

26. A computer readable medium comprising program instructions for causing a network slice management consumer to: transmitting a request for security management requirements in the network slice to a network slice management generator; and Receiving a report from the network slice management generator regarding resources allocated for the security management requirements.

Images