Context-based password selection

Abstract

A system and method of selecting a cryptographic algorithm within a network. The method may include receiving network data from one or more network interfaces or network elements; analyzing the network data to identify a cryptographic algorithm from a plurality of cryptographic algorithms; and identifying a cryptographic algorithm from a plurality of cryptographic algorithms based on at least one of the following parameters: network security level, network criticality, or energy efficiency. In addition, the step of analyzing the network data to identify the cryptographic algorithm may further include receiving a plurality of identifiers associated with the network data, where the plurality of identifiers are each further associated with a degree of importance related to the network security level parameter.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application is based upon and claims the benefit of priority from Indian Patent Application No. 202241040077 filed on July 13, 2022, the disclosure of which is incorporated herein by reference in its entirety. Technical Field

[0003] The present disclosure described herein relates to context-based cipher selection for energy-efficient operation. Background Art

[0004] Various standards bodies are focusing on post-quantum cryptography (PQC) algorithms that are resistant to cryptanalytic attacks by quantum computers due to the availability of quantum computing resources. Standards bodies have reviewed various PQC algorithms, such as, for example, the National Institute of Standards and Technology (NIST) is considering a PQC algorithm such as disclosed in NIST IR 8413, "Status Report on the Third Round of the NIST Post-Quantum Cryptography Standardization Process," published in July 2022. In addition, Banerjee et al. discuss energy consumption analysis of various cryptographic algorithms in "Energy Consumption of Candidate Algorithms for NIST PQC Standards," University of Waterloo, pp. 1-13. In addition, researchers can also use many proprietary and open source implementations of PQC algorithms to study performance characteristics and cryptographic strength.

[0005] Therefore, due to the requirement of quantum resistance of PQC algorithms, the complexity of cryptographic operations involved in PQC algorithms needs to be enhanced, such as regarding new mathematical principles, increased key size, and algorithm complexity, etc. The common method proposed by NIST for classifying PQC algorithms according to the security level provided is as follows:

[0006] Level I: This is at least as difficult as an exhaustive key search to break the security of a block cipher using a 128-bit key, such as but not limited to Advanced Encryption Standard (AES) 128.

[0007] Level II: This can be at least as difficult as using a collision search for a 256-bit hash message digest to break the security of a hash function such as, but not limited to, Secure Hash Algorithm (SHA) 256 / SHA3-256.

[0008] Level III: This can be at least as difficult as an exhaustive key search to break the security of a block cipher using a 192-bit key, such as but not limited to AES192.

[0009] Level IV: This is at least as difficult as breaking the security of a hash function using a collision search for a 384-bit hash message digest, such as but not limited to SHA384 / SHA3-384.

[0010] Level V: This is at least as difficult as breaking the security of a block cipher with a 256-bit key using an exhaustive key search, such as but not limited to AES256.

[0011] However, enhanced cryptographic operations result in higher performance requirements for the central processing unit (CPU) and memory resources of computing devices and other components, and therefore result in higher energy consumption of network elements. Wireless telecommunication networks, such as those deployed behind fifth generation (5G) or sixth generation (6G) open radio access network (O-RAN) elements, are expected to support zero trust network design and operation. Each network element interface may be required to provide methods for ensuring confidentiality, integrity, and authenticity of operations, which needs to be achieved by implementing PQC cryptographic methods and protocols. Although standards specify various PQC algorithms and associated parameter changes, these standards will retain different levels of energy consumption signatures. Therefore, mobile network operators are faced with a very complex problem of adopting a suitable cryptographic algorithm for each network use case, resulting in non-optimal or suboptimal selection of PQC algorithms and parameters, resulting in waste of resources and energy. Therefore, it is desirable to address the above-mentioned shortcomings or other shortcomings and provide useful alternatives.

[0012] Therefore, there is a need for a method and system for context-based password selection that requires minimal energy consumption, is resource efficient, and places less burden on computing resources and network elements. Summary of the invention

[0013] According to example embodiments, a context-based cryptographic selection method and system for energy-efficient operation in a wireless communication network is disclosed. The method and system may provide an optimal and automated process for determining an appropriate PQC cryptographic algorithm based on various parameters, including but not limited to the context of network usage, cryptographic protection level, and energy consumption, etc. The disclosed method and system described herein achieves advantages such as reduced energy consumption, optimization of encryption levels based on the context of network utilization, and associated performance improvements (delay reduction, etc.) due to automation in the decision-making process.

[0014] According to other example embodiments, a method and system for context-based password selection for energy-efficient operation is disclosed, wherein the method and system may include: initializing system parameters, and collecting O-Cloud telemetry information via O1 and O2 interfaces, and receiving external system context via application interface or operator input, which external system context may include network criticality level and applicable security level. The method and system of the present disclosure described herein may also include: determining the optimal energy-efficient password configuration via a lookup table, supervised learning or decision tree method, and selecting final password parameters from the password series guidance via O-Cloud, the password series guidance received from rApp and service management and orchestration (SMO). Here, rApp may refer to an application hosted on a non-real-time RAN intelligent controller (non-RT-RIC). The method and system of the present disclosure described herein may also include: providing final policy guidance to the O-Cloud layer by the rApp security application, and applying the policy to the O-Cloud layer. In addition, the implementation of password optimization can be more generally supported by the cloud orchestration layer.

[0015] According to other exemplary embodiments, a method for selecting a cryptographic algorithm within a network is disclosed. The method may include: receiving network data from one or more network interfaces or network elements; analyzing the network data to identify a cryptographic algorithm from a plurality of cryptographic algorithms; and identifying the cryptographic algorithm from the plurality of cryptographic algorithms based on at least one of the following parameters: network security level, network criticality, or energy efficiency.

[0016] Additionally, analyzing the network data to identify the cryptographic algorithm may further include receiving a plurality of identifiers associated with the network data, wherein each of the plurality of identifiers is further associated with a level of importance related to the network security level parameter.

[0017] Additionally, analyzing the network data to identify the cryptographic algorithm may further include receiving a plurality of identifiers associated with the network data, wherein each of the plurality of identifiers is further associated with a level of importance related to a network criticality parameter.

[0018] Additionally, analyzing the network data to identify the cryptographic algorithm may further include receiving a plurality of identifiers associated with the network data, wherein each of the plurality of identifiers is further associated with a level of importance related to the energy efficiency parameter.

[0019] Furthermore, the step of receiving network data from one or more network interfaces or network elements within the network is also based on a service management and orchestrator (SMO) framework, wherein the SMO framework includes an orchestrator module in communication with the network infrastructure module.

[0020] Additionally, the step of analyzing the network data to identify a cryptographic algorithm from a plurality of cryptographic algorithms may be performed via the orchestrator module.

[0021] Additionally, the method may include sending the identified cryptographic algorithm from the orchestrator module to the network infrastructure module.

[0022] Additionally, the method may include receiving, via the orchestrator module, from the network infrastructure module, a selection of a condition regarding the identified cryptographic algorithm.

[0023] Additionally, the method may include generating, via the orchestrator module, a cryptographic policy for the network regarding the identified cryptographic algorithm.

[0024] Additionally, the method may include sending, via the orchestrator module, to the network infrastructure module, a cryptographic policy for the network regarding the identified cryptographic algorithm.

[0025] In other exemplary embodiments, an apparatus for selecting a cryptographic algorithm within a network is disclosed. The apparatus may include: a memory storage device storing computer executable instructions; and a processor communicatively coupled to the memory storage device, wherein the processor is configured to execute the computer executable instructions and cause the apparatus to: receive network data from one or more network interfaces or network elements; analyze the network data to identify a cryptographic algorithm from a plurality of cryptographic algorithms; and identify a cryptographic algorithm from a plurality of cryptographic algorithms based on at least one of the following parameters: network security level, network criticality, or energy efficiency.

[0026] Furthermore, when executed by the processor, the computer executable instructions may further cause the apparatus to: receive a plurality of identifiers associated with the network data, wherein each of the plurality of identifiers is further associated with a degree of importance related to the network security level parameter.

[0027] In addition, when executed by the processor, the computer executable instructions may further cause the apparatus to: receive a plurality of identifiers associated with the network data, wherein each of the plurality of identifiers is further associated with a degree of importance related to a network criticality parameter.

[0028] In addition, when executed by the processor, the computer executable instructions may further cause the apparatus to: receive a plurality of identifiers associated with the network data, wherein each of the plurality of identifiers is further associated with a degree of importance related to the energy efficiency parameter.

[0029] Additionally, the step of receiving network data from one or more network interfaces or network elements within the network may also be based on a service management and orchestrator (SMO) framework, wherein the SMO framework includes an orchestrator module in communication with a network infrastructure module.

[0030] Additionally, the step of analyzing the network data to identify a cryptographic algorithm from a plurality of cryptographic algorithms may be performed via the orchestrator module.

[0031] Additionally, the computer executable instructions, when executed by the processor, may also cause the apparatus to: send the identified cryptographic algorithm from the orchestrator module to the network infrastructure module.

[0032] Additionally, the computer executable instructions, when executed by the processor, may also cause the apparatus to: receive, via the orchestrator module, from the network infrastructure module, a selection of a condition regarding the identified cryptographic algorithm.

[0033] Additionally, the computer executable instructions, when executed by the processor, may further cause the apparatus to: generate, via the orchestrator module, a cryptographic policy for the network regarding the identified cryptographic algorithm.

[0034] In other exemplary embodiments, a non-transitory computer-readable medium is disclosed, comprising computer-executable instructions for selecting a cryptographic algorithm within a network by a device, wherein the computer-executable instructions, when executed by at least one processor of the device, cause the device to: receive network data from one or more network interfaces or network elements; analyze the network data to identify a cryptographic algorithm from a plurality of cryptographic algorithms; and identify a cryptographic algorithm from a plurality of cryptographic algorithms based on at least one of the following parameters: network security level, network criticality, or energy efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The features, advantages, and significance of exemplary embodiments of the present disclosure will be described below with reference to the accompanying drawings, in which like symbols represent like elements, and in which:

[0036] Figure 1 A diagram illustrating a general system architecture of the disclosed context-based password selection method and system described herein, according to one or more embodiments;

[0037] Figure 2 shows a perspective view of a three-dimensional space representing normalized levels of parameters considered for selection of a cryptographic algorithm for energy efficient operation in a wireless communication network in accordance with one or more embodiments;

[0038] Figure 3 Another schematic diagram of a method for enabling an O-RAN network to achieve compatible selection of cryptographic algorithms for energy efficient operation with a Service Manager and Orchestrator (SMO) according to one or more embodiments is shown;

[0039] Figure 4A process flow diagram of a method for determining a password configuration for the disclosed context-based password selection method and system described herein is shown in accordance with one or more embodiments. DETAILED DESCRIPTION

[0040] The following detailed description of example embodiments refers to the accompanying drawings.The same reference numbers in different drawings may identify the same or similar elements.

[0041] The above disclosure provides illustration and description, but is not intended to be exhaustive or to limit implementation to the disclosed precise form. According to the above disclosure, modification and variation are possible, or can be obtained from the practice of implementation. In addition, one or more features or components of an embodiment can be incorporated into another embodiment (or one or more features of another embodiment) or combined with another embodiment (or one or more features of another embodiment). In addition, in the flow chart and the operation description provided below, it can be understood that one or more operations can be omitted, one or more operations can be added, one or more operations can be performed (at least in part) simultaneously, and the order of one or more operations can be transformed.

[0042] It is apparent that the systems and / or methods described herein can be implemented in various forms of hardware, firmware, or a combination of hardware and software. The actual dedicated control hardware or software code used to implement these systems and / or methods does not limit these implementations. Therefore, the operation and behavior of the systems and / or methods are described herein without reference to specific software codes, and it should be understood that software and hardware can be designed to implement these systems and / or methods based on the description herein.

[0043] Even though particular combinations of features are recited in the claims and / or disclosed in the specification, these combinations are not intended to limit the disclosure of possible implementations. In fact, many of these features may be combined in ways not specifically recited in the claims and / or disclosed in the specification. Although each dependent claim listed below may directly depend on only one claim, the disclosure of possible implementations includes each dependent claim in combination with every other claim in the claim set.

[0044] Unless explicitly stated, no element, act, or instruction used herein should be construed as critical or essential. In addition, as used herein, the terms "a" and "an" are intended to include one or more items and can be used interchangeably with "one or more". Figure 1items, the term "a" or similar language is used. In addition, as used herein, the terms "having," "having," "including," "comprising," "including," and the like are intended to be open-ended terms. In addition, unless otherwise expressly stated, the term "based on" means "based at least in part on." In addition, expressions such as "at least one of [A] and [B]" or "at least one of [A] or [B]" should be understood to include only A, only B, or both A and B.

[0045] In this specification, references to "one embodiment," "an embodiment," and "a non-limiting exemplary embodiment," or similar language indicate that a particular feature, structure, or characteristic described in connection with the illustrated embodiment is included in at least one embodiment of the present solution. Thus, the phrases "in one embodiment," "in an embodiment," and "in a non-limiting exemplary embodiment," and similar language throughout this specification may, but do not necessarily, all refer to the same embodiment.

[0046] In addition, the features, advantages and characteristics of the present disclosure may be combined in any suitable manner in one or more embodiments. Based on the description herein, those skilled in the relevant art will recognize that the present disclosure may be practiced without one or more of the specific features or advantages of a particular embodiment. In other cases, additional features and advantages that may not be present in all embodiments of the present disclosure may be recognized in certain embodiments.

[0047] In one implementation of the disclosure described herein, a display page may include information residing in a memory of a computing device, which may be sent from the computing device to a database center via a network, or vice versa. The information may be stored in a memory at each of the following locations: a computing device, a data storage device located at the edge of a network, or on a server at a database center. A computing device or mobile device may receive a non-transient computer-readable medium, which may contain instructions, logic, data, or code that may be stored in a persistent or temporary memory of a mobile device, or may affect or initiate an action of a mobile device in some way. Similarly, one or more servers may communicate with one or more mobile devices via a network, and may send computer files residing in a memory. For example, the network may include the Internet, a wireless communication network, or any other network for connecting one or more mobile devices to one or more servers.

[0048] Any discussion of computing or mobile devices may also apply to any type of networked device, including, but not limited to, mobile devices and phones, such as cellular phones (e.g., any "smartphone"), personal computers, server computers, or laptop computers; personal digital assistants; nomadic devices, such as network-connected nomadic devices; wireless devices, such as wireless email devices or other devices capable of wireless communication with a computer network; or any other type of network device that can communicate over a network and conduct electronic transactions. Any discussion of any mobile device mentioned may also apply to other devices, such as devices that include short-range ultra-high frequency (UHF) devices, near field communication (NFC), infrared (IR), and Wi-Fi capabilities, etc.

[0049] Phrases and terms like "software," "application," "app," and "firmware" may include any non-transitory computer-readable medium having a program stored thereon that, when executed by a computer, causes the computer to perform a method, function, or control operation.

[0050] Phrases and terms similar to "network" may include one or more data links that can transmit electronic data between computer systems and / or modules. When information is sent or provided to a computer via a network or another communication connection (hardwired, wireless, or a combination of hardwired or wireless), the computer uses the connection as a computer-readable medium. Therefore, by way of example and not limitation, a computer-readable medium may also include a network or data link that can be used to carry or store a desired program code device in the form of a computer-executable instruction or data structure and can be accessed by a general or special-purpose computer.

[0051] Phrases and terms similar to "portal" or "terminal" may include an intranet page, an Internet page, a locally resident software or application, a mobile device graphical user interface, or a digital presentation of a user. A portal may also be any graphical user interface for accessing the various modules, components, features, options, and / or properties of the disclosure described herein. For example, a portal may be a web page accessed by a web browser, a mobile device application, or any application or software resident on a computing device.

[0052] Figure 1 A diagram illustrating a general network architecture according to one or more embodiments. Figure 1According to one or more embodiments, end users 110, network support team users 120, and management terminal / dashboard users 130 (collectively referred to herein as users 110, 120, and 130) can communicate bidirectionally with a central server or application server 100 via a secure network. In addition, according to one or more embodiments, users 110, 120, and 130 can also communicate directly bidirectionally with each other via the disclosed network system described herein. Here, user 110 can be any type of customer, network service provider agent, or supplier of a network or telecommunications service provider, such as a user operating a computing device and user terminals A, B, and C. Each of users 110 can communicate with server 100 via its corresponding terminal or portal, wherein server 110 can provide or automatically operate the network impact prediction engine system and method of the present disclosure described herein. User 120 can include an application development member or support agent of a network service provider for developing, integrating, and monitoring the context-based password selection method and system described herein, including assisting, scheduling / modifying network events, and providing support services to end users 110. The management terminal / dashboard user 130 may be any type of user with access rights to the disclosed dashboard or management portal described herein, wherein the dashboard portal may provide various user tools, GUI information, maps, graphics, and customer support options. Within the scope of the present disclosure described herein, it is contemplated that any one of the users 110 and 120 may also access the disclosed management terminal / dashboard 130 described herein.

[0053] Still reference Figure 1 According to one or more embodiments, the disclosed central server 100 described herein may be in further two-way communication with a database / third party server 140, which may also include users. Here, the server 140 may include vendors and databases, where various captured, collected or aggregated data (such as current, real-time and past network-related historical and KPI data) may be stored on and retrieved from the vendors and databases for network analysis, prediction and simulation by the server 100. In addition, the server 140 may include various cipher suites or algorithms. However, within the scope of the present disclosure described herein, it is contemplated that the disclosed context-based cipher selection methods and systems described herein may include any type of general network architecture.

[0054] Still reference Figure 1One or more servers or terminals of elements 100-140 may include a personal computer (PC), a printed circuit board including a computing device, a minicomputer, a mainframe computer, a microcomputer, a telephone computing device, a wired / wireless computing device (e.g., a smartphone, a personal digital assistant (PDA)), a laptop, a tablet computer, a smart device, a wearable device, or any other similarly functional device.

[0055] In some embodiments, Figure 1 As shown, one or more servers, terminals and users 100-140 may include a set of components, such as a processor, a memory, a storage component, an input component, an output component, a communication interface and a JSON UI rendering component. The set of components of the device may be coupled via a bus.

[0056] The bus may include one or more components that allow communication between a group of components of one or more servers or terminals of elements 100-140. For example, the bus may be a communication bus, a jumper bar, a network, etc. The bus may be implemented using a single or multiple (two or more) connections between a group of components of one or more servers or terminals of elements 100-140. The present disclosure is not limited thereto.

[0057] One or more servers or terminals of element 100-140 may include one or more processors. One or more processors may be implemented with hardware, firmware, and / or a combination of hardware and software. For example, one or more processors may include a central processing unit (CPU), a graphics processing unit (GPU), an accelerated processing unit (APU), a microprocessor, a microcontroller, a digital signal processor (DSP), a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a general purpose single chip or multi-chip processor, or other programmable logic devices, discrete gates or transistor logic, discrete hardware components, or any combination thereof, designed to perform the functions described herein. A general purpose processor may be a microprocessor, or any traditional processor, controller, microcontroller, or state machine. One or more processors may also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors combined with a DSP core, or any other such configuration. In some embodiments, a specific process and method may be performed by a circuit system specific to a given function.

[0058] One or more processors may control the overall operation of one or more servers or terminals of elements 100-140, and / or a set of components (e.g., memory, storage components, input components, output components, communication interfaces, rendering components) of one or more servers or terminals of elements 100-140.

[0059] One or more servers or terminals of elements 100-140 may also include memory. In some embodiments, the memory may include random access memory (RAM), read-only memory (ROM), electrically erasable programmable ROM (EEPROM), flash memory, magnetic memory, optical memory, and / or another type of dynamic or static storage device. The memory may store information and / or instructions for use (e.g., execution) by the processor.

[0060] The storage component of one or more servers or terminals of elements 100-140 may store information and / or computer-readable instructions and / or codes related to the operation and use of one or more servers or terminals in elements 100-140. For example, the storage component may include a hard disk (e.g., a magnetic disk, an optical disk, a magneto-optical disk, and / or a solid-state disk), a compact disk (CD), a digital versatile disk (DVD), a universal serial bus (USB) flash drive, a personal computer memory card international association (PCMCIA) card, a floppy disk, a cassette, a magnetic tape, and / or another type of non-transitory computer-readable medium, and a corresponding drive.

[0061] One or more servers or terminals of elements 100-140 may also include an input component. The input component may include one or more components that allow one or more servers or terminals of 100-140 to receive information, such as via user input (e.g., a touch screen, keyboard, keypad, mouse, stylus, button, switch, microphone, camera, etc.). Alternatively or additionally, the input component may include a sensor for sensing information (e.g., a global positioning system (GPS) component, an accelerometer, a gyroscope, an actuator, etc.).

[0062] The output components of any one or more servers or terminals of elements 100-140 may include one or more components (e.g., a display, a liquid crystal display (LCD), a light emitting diode (LED), an organic light emitting diode (OLED), a tactile feedback device, a speaker, etc.) that can provide output information from device 100.

[0063] One or more servers or terminals of element 100-140 may also include a communication interface. The communication interface may include a receiver component, a transmitter component and / or a transceiver component. The communication interface may enable one or more servers or terminals of element 100-140 to establish a connection and / or transmit communication with other devices (e.g., a server, another device). Communication may be enabled via a combination of wired connection, wireless connection or wired and wireless connection. The communication interface may allow one or more servers or terminals of element 100-140 to receive information from another device and / or provide information to another device. In some embodiments, the communication interface may provide communication with another device via a network, such as a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), a private network, an ad hoc network, an intranet, the Internet, a fiber-based network, a cellular network (e.g., a fifth generation (5G) network, a sixth generation (6G) network, a long term evolution (LTE) network, a third generation (3G) network, a code division multiple access (CDMA) network, etc.), a public land mobile network (PLMN), a telephone network (e.g., a public switched telephone network (PSTN)), etc., and / or a combination of these or other types of networks. Alternatively or additionally, the communication interface may provide communication with another device via a device-to-device (D2D) communication link, such as FlashLinQ, WiMedia, Bluetooth, ZigBee, Wi-Fi, LTE, 5G, etc. In other embodiments, the communication interface may include an Ethernet interface, an optical interface, a coaxial interface, an infrared interface, a radio frequency (RF) interface, etc.

[0064] Figure 2 A three-dimensional space representing normalized levels of each parameter considered for selection of a cryptographic algorithm for energy efficient operation in a wireless communication network is shown according to embodiments disclosed herein. Figure 2 , the disclosed three-dimensional space optimization described herein is used to provide three standardized levels, namely "low", "medium" and "high", for each parameter considered for the selection of a cryptographic algorithm for energy-efficient operation in a wireless communication network. Each standardized level is represented in ascending order on its corresponding x, y and z axes. In addition, the context-based parameters considered in the context-based cryptographic selection system and method described herein may include a cryptographic algorithm (or cryptographic family or suite) and a corresponding encryption level selection, which is based on: 1) network usage indicating network criticality ("network criticality"), 2) energy consumption or energy efficiency in cryptographic operations / joules ("energy efficiency"), and 3) the level of cryptographic protection and security ("security level"). The above parameters are represented together with the three standardized levels on each axis of the three-dimensional space.

[0065] Here, the disclosed methods and systems described herein include seamless selection of cryptographic algorithms at a context-based parameter and standardized level for energy-efficient operation in wireless communication networks. The selection of cryptographic algorithms from a cryptographic algorithm family and corresponding variants can be achieved by a clustering method based on statistics or machine learning (ML). In addition, the standardized level can be extended to a more fine-grained level for determining the best combination of cryptographic algorithms and parameters for energy-efficient operation. Here, in some exemplary embodiments, the implementation of cryptographic algorithm selection optimization is described based on an O-RAN architecture implementation. However, within the scope of the present disclosure described herein, it is contemplated that the disclosed methods and systems can also be more supported through a cloud orchestration layer.

[0066] Figure 3 is a process flow or signaling diagram illustrating an exemplary method for enabling an O-RAN network to achieve compatible selection of cryptographic algorithms for energy-efficient operation within a service management and orchestration (SMO) module or framework 100 according to the disclosure described herein. In particular, at step 1, the O-Cloud platform module 200 sends the collected O1 and O2 telemetry data to the SMO module or framework 100, wherein the SMO module or framework 100 includes an rApp module 120 and a non-real-time RAN intelligent controller platform module 140 ("non-RT RIC"). Here, the rApp module 120 can be any type of RAN automation application or process, such as a network evolution rApp, a network deployment rApp, a network optimization rApp, a network recovery rApp, and an automation and artificial intelligence (AI) rApp. In addition, the non-RT RIC module 140 can be an orchestration and automation function, and in particular an element of an open RAN architecture, which can control and optimize other RAN elements and resources, such as using artificial intelligence and machine learning to enhance control and optimization of such network resources. In addition, the O-Cloud module 200 can be a general cloud infrastructure network-based module. In step 2, the rApp module 120 hosted within the non-RT RIC platform module 140 analyzes the O1 and O2 telemetry data based on the use case and security level (among other factors) and can identify a cipher suite or family of cipher algorithms. Here, elements O1 and O2 can be interfaces that connect the SMO module or framework 100 to the rApp module 120 and the non-RT RIC module 140 (and any other RAN managed elements). In particular, the O2 interface is typically how the SMO module or framework 100 communicates with the O-Cloud platform module 200.

[0067] Still reference Figure 3, in step 3, cryptographic policy ("Crypto Policy") guidance information is sent to the O-Cloud platform module 200 for selection of an energy-efficient cryptographic algorithm by the SMO module or framework 100, for example, selecting an algorithm such as Falcon or CrystalDilithium. Here, a cryptographic policy may refer to a rule-based condition determined at the rApp. In addition, since there is a set of predetermined cryptographic algorithms in the context of PQC, the application of these rule-based conditions will result in one or more sets of cryptographic algorithms. One method for finding a mapping to one or more sets of other cryptographic algorithms may be through a table lookup. However, in other embodiments, a more fine-grained approach through a decision tree / machine learning process may also be used. In step 4, the O-Cloud platform module 200 successfully selects a cryptographic policy, such as a cryptographic policy associated with the Falcon cryptographic algorithm, wherein the selected cryptographic policy is then sent to the SMO module or framework 100, and further wherein the rApp / non-RT RIC module receives confirmation of the change of the cryptographic policy selected at the O-Cloud platform module 200.

[0068] Still reference Figure 3 , in step 5, the rApp / non-RT RIC module of the SMO module or framework 100 generates final cryptographic policy guidance data for the O-Cloud platform module 200. Next, in step 6, the SMO module or framework 100 sends the final cryptographic policy guidance information for the cryptographic algorithm and the parameters to be applied to both static and in-transit data to the O-Cloud platform module 200. For example, such final cryptographic policy guidance information for the Falcon cryptographic algorithm may include the number of queries Qs, the target security level λ, and the ring degree n, etc. Here, it can be assumed that the system has enabled the previous baseline cryptographic policy before applying the final cryptographic policy in step 6. For example, in the 3GPP standard, even if encryption is disabled, it is regarded as a cryptographic policy with an empty password. In addition, the method for optimizing the cryptographic suite can be performed within an algorithm implemented within the rApp module 120 hosted in the non-RT RIC platform module 140. Energy consumption telemetry information collected from the O-Cloud platform, the context of network utilization, and the security level of the algorithm can be used as input to generate cryptographic policies enforced on interfaces (such as O1, O2, A1) and the cloud platform (persistent data encryption), etc.

[0069] Still reference Figure 3In step 6, as previously disclosed, an example of the final cryptographic policy guidance may include the Falcon cryptographic algorithm family of PQC algorithms. For further exemplary purposes, as shown in Table 2, the algorithm may satisfy the "high" security, "high" energy, and "high" network criticality characteristics. In addition, the three main parameters of the algorithm class are: 1) the maximum number of signature queries Qs, 2) the target security level λ, and 3) the degree n of the ring Z. For Qs=2^64, n=512, and λ=128 (for NIST Level I); and n=1024, and λ=256 (for NIST Level V). Therefore, for exemplary purposes, the final cryptographic policy and parameters for a critical infrastructure network (such as smart grid security) in CSV format may be expressed as {(security-high, energy-high, criticality-high)(Qs=2^64, n=1024, λ=256)}.

[0070] Here, in an exemplary embodiment, some exemplary cryptographic algorithm suites or families may be represented in an exemplary decision table or truth table, such as shown with respect to Table 1. Here, Table 1 shows some partial exemplary possibilities for context-based cryptographic algorithm or suite selection based on standardized levels (low, medium, high) applied to network security level, energy efficiency, and network criticality. However, within the scope of the present disclosure described herein, it is contemplated that there may be a total of 3 3 = 27 possibilities. For example, if the desired security level is low, the energy efficiency requirement is low, but the network criticality requirement or importance is medium, then the DualModeMS cipher family or suite may be selected for energy efficient operation within the network.

[0071] Table 1:

[0072] Security Level Energy efficiency Network Criticality Choice of cryptographic algorithm 1 Low Low Low DualModeMS 2 Low Low middle DualModeMS 3 Low middle Low Rainbow 4 middle Low middle DualModeMS / pqsigRM 5 middle middle Low pqsigRM 6 middle middle middle GeMSS 7 high middle Low HIMQ3F 8 high Low middle Gui 9 high Low high SPHINCSPlus Series 10 high high high Picnic-FS, Picnic-UR

[0073] Here, the selection of cryptographic algorithms, suites, schemes or families may also be based on the energy consumption of key generation operations in various PQC algorithms (or cryptographic algorithm families) and their security levels. In addition, the energy consumption during the signing of public key signatures may also be considered and taken into account when determining the selection of an appropriate PQC algorithm, which is related to various PQC algorithms (or cryptographic algorithm families).

[0074] Other suitable recommendations that can be dynamically generated for different cryptographic operations, such as those shown in Table 1, may also be considered within the scope of the present disclosure described herein, since the energy consumption during each operation may be different based on the software implementation and hardware platform on which the operation is performed. In an exemplary embodiment, an alternative decision function for a public key signature is shown below with respect to Table 2.

[0075] Table 2:

[0076] Security Level Energy efficiency Network Criticality Password selection 1 Low Low Low pqsigRM 2 Low Low middle SPhincsPlus Series 3 Low middle Low GeMSS 4 middle Low middle DualModeMS 5 middle middle Low MQDSS 6 middle middle middle Picnic-FS、UR 7 high middle Low pqNTRU symbol series 8 high Low middle Gui 9 high Low high SPHINCSPlus Series 10 high high high FALCON

[0077] In addition, context information related to applications, networks, and deployments can be obtained through one of an application programming interface (API) and operator input when the system is initialized. In one or more exemplary embodiments, a mapping of network criticality levels is shown in Table 3 below, and network security levels are shown in Table 4 below.

[0078] Table 3:

[0079] Network Use Cases Criticality level 1 Public safety, critical infrastructure networks high 2 IoT-optimized networks supporting social infrastructure middle 3 Public networks, such as free hotspots in airports, train stations, and parks Low

[0080] Table 4:

[0081] Network Use Cases Security Level 1 Public safety, critical infrastructure networks high 2 IoT-optimized networks supporting social infrastructure high 3 Public networks, such as free hotspots in airports, train stations, and parks middle 4 Emergency call, government asks to turn off encryption Low

[0082] FIG5 shows a flow chart of an exemplary embodiment of a method for determining a password configuration, such as logic embedded in an xApp when determining a password configuration, the password configuration being directed to a context-based password selection method and system for energy-efficient operation. Here, at step 502, the method may include initializing system parameters and collecting telemetry information of the O-Cloud module 200 via the O1 and O2 interfaces. Next, at step 504, the method may include receiving an external system context, which may include a network criticality level and an applicable security level, via an application interface (API) or operator input. Here, the external system context may refer to information that is not related to the network operation or security level itself. An example of this may be a change in the energy source for network operation, where such a change may be caused by an event such as a power grid failure. In such an event, a change may be made to an alternative or temporary energy source, such as a change to a sustainable / renewable energy source, where the network system reduces power consumption. In such a scenario where the network power consumption is reduced, although there are predetermined rules for the selection of the password policy, the lowest energy cryptographic algorithm will still be selected to meet the network's reduced power consumption requirements. Next, in step 506, the method may include: determining the optimal energy-efficient password configuration via a table lookup / supervised learning or decision tree method. Next, in step 508, the method may include: the O-Cloud module 200 selects final password parameters from the password series guidance, and the password series guidance is received from the rApp module 120 and the SMO module or framework 100. Next, in step 510, the method may include: providing final policy guidance to the O-Cloud layer module 200 by the rApp security application or rApp module 120. Further, in step 512, the final password policy can be applied to the O-Cloud layer module 200. Here, the aforementioned process of Figure 5 can be implemented at the K8S orchestration layer, particularly for static data encryption on the cloud platform.

[0083] Table 5 provides an overview of an exemplary embodiment of configuration parameters that can be used with the disclosed context-based selection methods and systems described herein. Here, the configuration parameters in "Encrypting Secret Data at Rest" of Kubernetes (May 30, 2022) are currently available, but do not meet post-quantum cryptographic requirements, which can be considered a "low" security level.

[0084] Table 5:

[0085]

[0086] However, AES with keys of 256 and above is currently considered quantum-safe and can be supported by extensions to the cryptographic library in the Kubernetes layer. This can be safely disclosed throughout the extension of the kube-apiserver encryption configuration, "Encrypting secret data at rest" from Kubernetes (May 30, 2022). Therefore, the security levels to which AES can be mapped for PQC requirements are provided in Table 6 below.

[0087] Table 6:

[0088] Low - Meets NIST defined Level I and Level II AES-128 Medium - Meets NIST defined Level III and Level IV AES–192 High - meets NIST defined Level V AES-256

[0089] In addition, the ProviderConfiguration API field appears in the ResourceConfiguration API field, where the ProviderConfiguration API field can store the configuration provided by the encryption provider, as shown in Table 7, as provided by Kubernetes.

[0090] Table 7:

[0091]

[0092] Here, in the example of Table 7, the ProviderConfiguration API may be extended to support the PostQuantumEncryption API field. The PQCConfiguration API field description may include algorithms and keys for creating cryptographic transformers, such as AES 128, 192, and 256-bit keys. The PostQuantumEncryption field contains the API configuration information for the AES cryptographic transformer provided in Table 8.

[0093] Table 8:

[0094]

[0095] Here, the key field may include the name and secret data of the provided key for the cryptographic transformer provided in Table 9.

[0096] Table 9:

[0097]

[0098] It should be understood that the specific order or hierarchy of the frames in the process / flowchart disclosed herein is an illustration of an exemplary method. Based on design preferences, it is understood that the specific order or hierarchy of the frames in the process / flowchart can be rearranged. In addition, some frames can be combined or omitted. The attached method requires the current elements of each frame to be presented in a sample order, and is not limited to the specific order or hierarchy presented.

[0099] Some embodiments may involve systems, methods, and / or computer-readable media at any possible level of integrated technical detail. In addition, one or more of the above components may be implemented as instructions stored on a computer-readable medium and executable by at least one processor (and / or may include at least one processor). The computer-readable medium may include a computer-readable non-transitory storage medium (or medium) having computer-readable program instructions thereon for causing a processor to perform operations.

[0100] Computer readable storage medium can be a tangible device, which can retain and store instructions for use by instruction execution devices. Computer readable storage medium can be, for example, but not limited to, electronic storage device, magnetic storage device, optical storage device, electromagnetic storage device, semiconductor storage device, or any suitable combination of the above. A non-exhaustive list of more specific examples of computer readable storage medium includes: portable computer disk, hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, mechanical coding device (such as a convex structure in a punch card or groove, with instructions recorded thereon) and any suitable combination of the above. Computer readable storage medium as used in this article should not be interpreted as transient signal itself, such as radio waves or other free propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (for example, light pulses passing through fiber optic cables) or electrical signals transmitted by wires.

[0101] The computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to a corresponding computing / processing device via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network), or downloaded to an external computer or external storage device. The network may include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network, and forwards the computer-readable program instructions to be stored in a computer-readable storage medium within the corresponding computing / processing device.

[0102] The computer readable program code / instruction for performing the operation can be an assembly instruction, an instruction set architecture (ISA) instruction, a machine instruction, a machine-related instruction, a microcode, a firmware instruction, a state setting data, a configuration data for an integrated circuit system, or a source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​(such as Smalltalk, C++, etc.) and process programming languages ​​(such as "C" programming languages ​​or similar programming languages). The computer readable program instruction can be executed completely on the user's computer, partially on the user's computer, executed as an independent software package, partially on the user's computer and partially on a remote computer, or completely on a remote computer or server. In the latter case, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection to an external computer can be executed (for example, using an Internet service provider through the Internet). In some embodiments, the electronic circuit system includes (for example, a programmable logic circuit system, a field programmable gate array (FPGA) or a programmable logic array (PLA)) can be executed by using the state information of the computer readable program instruction to personalize the electronic circuit system to execute the computer readable program instruction, thereby performing various aspects or operations.

[0103] These computer-readable program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device create components for implementing the functions / actions specified in the box or multiple boxes of the flowchart and / or block diagram. These computer-readable program instructions may also be stored in a computer-readable storage medium, which may direct the computer, programmable data processing device, and / or other equipment to operate in a specific manner, so that the computer-readable storage medium having the instructions stored therein includes an article of manufacture, which includes instructions, which implement various aspects of the functions / actions specified in the box or multiple boxes of the flowchart and / or block diagram.

[0104] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operating steps to be executed on the computer, other programmable apparatus, or other device, thereby producing a computer-implemented process, so that the instructions executed on the computer, other programmable apparatus, or other device implement the functions / actions specified in the box or multiple boxes of the flowchart and / or block diagram.

[0105] The flowchart and block diagram in the figure illustrate the possible implementation architecture, function and operation of the system, method and computer-readable medium according to various embodiments.In this regard, each frame in the flowchart or block diagram can represent a module, segment or part of an instruction, which includes one or more executable instructions for implementing (multiple) specified logical functions.The method, computer system and computer-readable medium may include more frames, fewer frames, different frames or frames arranged differently than shown in the figure.In some alternative implementations, the functions described in the frame may not appear in the order shown in the figure.For example, in fact, the two frames shown in succession can be performed simultaneously or substantially simultaneously, or these frames can sometimes be performed in the opposite order, depending on the functions involved.It will also be noted that each frame of the block diagram and / or flowchart illustration and the combination of frames in the block diagram and / or flowchart illustration can be implemented by a system based on special hardware, which performs a specified function or action or performs a combination of special hardware and computer instructions.

[0106] It is apparent that the systems and / or methods described herein can be implemented in various forms of hardware, firmware, or a combination of hardware and software. The actual dedicated control hardware or software code used to implement these systems and / or methods does not limit these implementations. Therefore, the operation and behavior of the systems and / or methods are described herein without reference to specific software codes - it should be understood that software and hardware can be designed to implement these systems and / or methods based on the description herein.

Claims

1. A method for selecting a cryptographic algorithm within a network, the method comprising: receiving network data from one or more network interfaces or network elements; analyzing the network data to identify a cryptographic algorithm from a plurality of cryptographic algorithms; as well as The cryptographic algorithm is identified from the plurality of cryptographic algorithms based on at least one of the following parameters: network security level, network criticality, or energy efficiency.

2. The method of claim 1, wherein the step of analyzing the network data to identify the cryptographic algorithm further comprises: A plurality of identifiers associated with the network data is received, wherein each of the plurality of identifiers is further associated with a level of importance related to the network security level parameter.

3. The method of claim 1 , wherein the step of analyzing the network data to identify the cryptographic algorithm further comprises: A plurality of identifiers associated with the network data are received, wherein each of the plurality of identifiers is further associated with a level of importance related to the network criticality parameter.

4. The method of claim 1, wherein the step of analyzing the network data to identify the cryptographic algorithm further comprises: A plurality of identifiers associated with the network data is received, wherein each of the plurality of identifiers is further associated with a level of importance related to the energy efficiency parameter.

5. The method of claim 1, wherein the step of receiving network data from one or more network interfaces or network elements is also based on a service management and orchestrator (SMO) framework, wherein the SMO framework includes an orchestrator module that communicates with a network infrastructure module.

6. The method of claim 5, wherein the step of analyzing the network data to identify a cryptographic algorithm from a plurality of cryptographic algorithms is performed via the orchestrator module.

7. The method according to claim 6, further comprising: The identified cryptographic algorithm is sent from the orchestrator module to the network infrastructure module.

8. The method according to claim 7, further comprising: A selection of a condition regarding the identified cryptographic algorithm is received from the network infrastructure module via the orchestrator module.

9. The method according to claim 8, further comprising: A cryptographic policy for the network is generated, via the orchestrator module, with respect to the identified cryptographic algorithm.

10. The method according to claim 9, further comprising: The cryptographic policy for the network regarding the identified cryptographic algorithm is sent to the network infrastructure module via the orchestrator module.

11. An apparatus for selecting a cryptographic algorithm within a network, comprising: a memory storage device storing computer executable instructions; as well as a processor communicatively coupled to the memory storage device, wherein the processor is configured to execute the computer-executable instructions and cause the device to: receiving network data from one or more network interfaces or network elements; analyzing the network data to identify a cryptographic algorithm from a plurality of cryptographic algorithms; and The cryptographic algorithm is identified from the plurality of cryptographic algorithms based on at least one of the following parameters: network security level, network criticality, or energy efficiency.

12. The apparatus of claim 11, wherein the computer executable instructions, when executed by the processor, further cause the apparatus to: A plurality of identifiers associated with the network data is received, wherein each of the plurality of identifiers is further associated with a level of importance related to the network security level parameter.

13. The apparatus of claim 11, wherein the computer executable instructions, when executed by the processor, further cause the apparatus to: A plurality of identifiers associated with the network data are received, wherein each of the plurality of identifiers is further associated with a level of importance related to the network criticality parameter.

14. The apparatus of claim 11, wherein the computer executable instructions, when executed by the processor, further cause the apparatus to: A plurality of identifiers associated with the network data is received, wherein each of the plurality of identifiers is further associated with a level of importance related to the energy efficiency parameter.

15. The apparatus of claim 11, wherein the step of receiving network data from one or more network interfaces or network elements is further based on a service management and orchestrator (SMO) framework, wherein the SMO framework includes an orchestrator module that communicates with a network infrastructure module.

16. The apparatus of claim 15, wherein the step of analyzing the network data to identify a cryptographic algorithm from a plurality of cryptographic algorithms is performed via the orchestrator module.

17. The apparatus of claim 16, wherein the computer executable instructions, when executed by the processor, further cause the apparatus to: The identified cryptographic algorithm is sent from the orchestrator module to the network infrastructure module.

18. The apparatus of claim 17, wherein the computer executable instructions, when executed by the processor, further cause the apparatus to: A selection of a condition regarding the identified cryptographic algorithm is received from the network infrastructure module via the orchestrator module.

19. The apparatus of claim 18, wherein the computer executable instructions, when executed by the processor, further cause the apparatus to: A cryptographic policy for the network is generated, via the orchestrator module, with respect to the identified cryptographic algorithm.

20. A non-transitory computer-readable medium comprising computer-executable instructions for selecting, by a device, a cryptographic algorithm within a network, wherein the computer-executable instructions, when executed by at least one processor of the device, cause the device to: receiving network data from one or more network interfaces or network elements; analyzing the network data to identify a cryptographic algorithm from a plurality of cryptographic algorithms; and The cryptographic algorithm is identified from the plurality of cryptographic algorithms based on at least one of the following parameters: network security level, network criticality, or energy efficiency.

Images