Access security apparatus and method for wireless communication networks

Abstract

Aspects of the present disclosure relate to performing security monitoring and trust evaluation of network and application functions as well as network slices, creating access control security policies based on trust data from the trust evaluation, and enforcing access control security policies for service providers and consumers. The access control security policy may be continuously updated and executed.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to U.S. Provisional Patent Application No. 63 / 353,465, filed on June 17, 2022, entitled “Access Security Device and Method for Wireless Communication Networks,” the entire text of which is incorporated herein by reference. Technical Field

[0003] The present disclosure relates to wireless communications, and more particularly, to a method for providing security in a wireless communication system, and a secure wireless communication system. Background Art

[0004] A wireless communication system may include one or more network communication devices, such as a base station, which may also be referred to as an eNodeB (eNB), a next generation NodeB (gNB), or other suitable terms. Each network communication device (such as a base station) may support wireless communication for one or more user communication devices, which may also be referred to as a user equipment (UE), or other suitable terms. A wireless communication system may support wireless communication with one or more user communication devices by utilizing resources of a wireless communication system (e.g., time resources (e.g., symbols, time slots, subframes, frames, etc.) or frequency resources (e.g., subcarriers, carriers)). Additionally, a wireless communication system may support wireless communication across various wireless access technologies, including: the Third Generation (3G) wireless access technology, the Fourth Generation (4G) wireless access technology, the Fifth Generation (5G) wireless access technology, and other suitable wireless access technologies other than 5G.

[0005] Traditional wireless communication systems are designed to protect against potential threats from outside the network. Internal network elements often have implicit trust, so when external security is breached, threats can propagate within the network. Therefore, wireless communication networks can benefit from systems that limit the ability of threats to propagate within the network. Summary of the invention

[0006] The present disclosure relates to methods, apparatus, and systems for supporting access security for wireless communication networks. Access security policies negotiated between network elements can limit the extent to which threats can propagate within a wireless network.

[0007] Some implementations of the methods and devices described herein may also include a method comprising: receiving a subscription request for an access control security policy from a first network function, sending a subscription response to the first network function in response to the subscription request, the subscription response indicating that a policy subscription has been initiated, generating access control security policies for multiple network functions based on trust data obtained from monitoring each network function, applying validity parameters to the generated access control security policies, receiving an access control security policy creation request, the access control security policy creation request including at least one of the following items: a network function ID, a network function instance ID, an application function ID, and a network slice ID, and sending a response to the access control security policy request, the response including at least one of the following items: a list of access control security policies for an identified network function, an identified network function instance, an identified application function, an identified network slice, and validity information, wherein the validity parameter is based on one or more of the following items: security monitoring data analysis validity, trust data analysis validity, and local policy.

[0008] In some implementations of the methods and apparatus described herein, the method may further include: sending a trust assessment request to a second network function, the trust assessment request including at least one of the following: a trust data analysis indication, a network function indicator, a network function instance ID, an application function indicator, and a network slice indicator, sending a trust assessment request to the second network function, the trust assessment request including at least one of the following: a trust data analysis indication, a network function ID, a network function instance ID, an application function ID, and a network slice ID, and receiving a response to the trust assessment request from the first network function, the response including: trust data associated with the identified network function, the identified network function instance, the identified application function, and the identified network slice. The second network function may be a trust assessment function, and the first network function may be a network repository function.

[0009] In some implementations of the methods and apparatus described herein, the method may further include: before initiating policy subscription, comparing the trust level of the first network function with a threshold value, wherein the policy subscription is initiated only when the trust level of the first network function exceeds the threshold value.

[0010] In some implementations of the methods and apparatus described herein, the method may further include receiving new trust data from the second network function, and sending an access control security policy request trigger message to the first network function in response to the new trust information.

[0011] In some implementations of the methods and apparatus described herein, the access control security policy includes one or more of the following items: a network slice restriction list of network slices that can be provided as services, a network slice prohibition list of network slices that cannot be provided as services, a network service consumer restriction information list including: one or more network functions or application functions that are allowed to consume services after authentication and authorization, and a network service consumer prohibition list including: one or more network functions or application functions that are prohibited from consuming services.

[0012] In some implementations of the methods and apparatus described herein, the access control security policy includes one or more of the following items: a trust data threshold for network service consumer authentication, a trust data threshold for network service consumer authorization, a trust data threshold for network producer authentication, a trust data threshold for network service discovery, a trust data threshold for network registration, a trust data threshold for network registration update, a network function service consumer authentication lifecycle, a network function service consumer authorization lifecycle, and a network function service producer authentication lifecycle.

[0013] In some implementations of the methods and apparatus described herein, the access control security policy includes one or more of the following items: a service operation restriction list, including: service names that can be provided as a network function service producer, and a service operation prohibition list, including: service names that are not allowed to be provided as an NF service producer.

[0014] In some implementations of the methods and apparatus described herein, the access control security policy includes one or more of: permitted UE context sharing, prohibited UE context sharing, restricted authentication lifecycle, re-authentication periodicity, immediate connection termination recommendation, and least privilege authorization. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 According to aspects of the present disclosure, an example of a wireless communication system supporting access security is shown.

[0016] Figure 2 An example of a block diagram of a device supporting access security is shown according to aspects of the present disclosure.

[0017] Figure 3 According to aspects of the present disclosure, a flow chart of a method for supporting access security is shown.

[0018] Figure 4 A signal diagram is shown in accordance with aspects of the present disclosure to support access security.

[0019] Figure 5 According to aspects of the present disclosure, a flow chart of a method for supporting access security is shown.

[0020] Figure 6 A signal diagram is shown in accordance with aspects of the present disclosure to support access security.

[0021] Figure 7 A signal diagram is shown in accordance with aspects of the present disclosure to support access security. DETAILED DESCRIPTION

[0022] The various network functions (NFs) involved in the network (particularly the access network and the core network) are allowed to communicate with each other after mutual authentication and authorization (e.g., through OAuth) based on Transport Layer Security (TLS) or Network Domain Security (NDS / IP). The network functions involved in cellular systems (such as 5G systems) are implicitly trusted, so there is a potential risk that if the network functions are attacked, or have been compromised or hijacked, even after successful mutual authentication and authorization, the compromised NF can still remain malicious and cannot be identified.

[0023] Since authentication and authorization of NFs and application functions (AFs) are usually performed based on identities and pre-shared credentials, when an NF requests a connection or service, it is impossible to obtain the trustworthiness or security status of any NF, nor to apply appropriate policies and access controls based on real-time trust evaluation information. Therefore, existing security procedures (such as authentication and authorization) are insufficient to: identify compromised NFs, apply appropriate access control policies to restrict compromised NF forms from accessing services, and restrict service access to trusted NFs.

[0024] A compromised NF can affect other communicating NFs (such as consumers of the compromised NF services) by allowing attacks to move laterally, which can lead to network service failures. If services are allowed to be provided to UEs and other NFs in the network, a compromised NF can cause various problems in the network, such as data theft, service failure, denial of service, resource hijacking, etc.

[0025] Embodiments of the present disclosure mitigate threat propagation and related hazards by providing trust-based access security policies to service / consumer relationships between NFs operating on wireless communication networks. NFs can be continuously monitored, and trust levels can be assigned to each NF on the network based on the monitoring results. When an NF attempts to initiate a service / consumer relationship with another NF, the network can apply a security policy to the relationship based on one or both of the trust levels of the NFs involved in the relationship. Security policies can be replaced or updated over time so that security policies address threats as they arise.

[0026] Compared to traditional networks, embodiments of the present disclosure provide improved security. NFs in traditional networks typically use an authentication process to establish service relationships, which can reduce the possibility of malicious service requests. However, it is possible to authenticate a compromised NF, so traditional networks have limited protection against the spread of internal threats after the NF has been compromised. Embodiments of the present disclosure address this shortcoming by providing continuous trust evaluation of NFs and providing dynamic security policies that can react to changes in the trust state of NFs. Therefore, embodiments of the present disclosure provide a higher level of security than traditional networks.

[0027] Aspects of the present disclosure are described in the context of a wireless communication system. Aspects of the present disclosure are also illustrated and described with reference to device diagrams, flow charts, and related to access security within a communication network.

[0028] Figure 1 An example of a wireless communication system 100 supporting access security is shown according to aspects of the present disclosure. The wireless communication system 100 may include: one or more base stations 102, one or more UEs 104, and a core network 106. The wireless communication system 100 may support various radio access technologies. In some implementations, the wireless communication system 100 may be a 4G network, such as an LTE network or an advanced LTE (LTE-Advanced, LTE-A) network. In some other implementations, the wireless communication system 100 may be a 5G network, such as an NR network. In other implementations, the wireless communication system 100 may be a combination of a 4G network and a 5G network. The wireless communication system 100 may support radio access technologies other than 5G. Additionally, the wireless communication system 100 may support technologies such as time division multiple access (Time Division Multiple Access, TDMA), frequency division multiple access (Frequency Division Multiple Access, FDMA), or code division multiple access (Code Division Multiple Access, CDMA).

[0029] One or more base stations 102 may be dispersed throughout a geographic area to form a wireless communication system 100. The one or more base stations 102 described herein may be, include, or may be referred to as a base transceiver station, an access point, a NodeB, an eNodeB (eNB), a next generation NodeB (gNB), or other suitable terms. The base station 102 and the UE 104 may communicate via a communication link 108, which may be a wireless or wired connection. For example, the base station 102 and the UE 104 may wirelessly communicate via a Uu interface.

[0030] The base station 102 may provide a geographic coverage area 110, and the base station 102 may support services (e.g., voice, video, packet data, message, broadcast, etc.) for one or more UEs 104 within the geographic coverage area 110. For example, the base station 102 and the UE 104 may support wireless communications of signals related to services (e.g., voice, video, packet data, message, broadcast, etc.) according to one or more radio access technologies. In some implementations, the base station 102 may be mobile, for example, a satellite associated with a non-terrestrial network. In some implementations, different geographic coverage areas 110 associated with the same or different radio access technologies may overlap, but different geographic coverage areas 110 may be associated with different base stations 102. The information and signals described herein may be represented using any of a variety of different technologies and methods. For example, data, instructions, commands, information, signals, bits, symbols, and chips that may be referenced throughout the description may be represented by voltage, current, electromagnetic waves, magnetic fields or particles, light fields or particles, or any combination thereof.

[0031] One or more UEs 104 may be dispersed throughout the geographic area of ​​the wireless communication system 100. UE 104 may include, or may be referred to as, a mobile device, a wireless device, a remote device, a handheld device, or a user device, or some other suitable term. In some implementations, UE 104 may be referred to as a unit, a station, a terminal, or a client, etc. Additionally or alternatively, UE 104 may be referred to as an Internet of Things (IoT) device, an Internet of Everything (IoE) device, or a Machine Type Communication (MTC) device, etc. In some implementations, UE 104 may be stationary in the wireless communication system 100. In some other implementations, UE 104 may move in the wireless communication system 100.

[0032] One or more UEs 104 may be devices of different forms or with different capabilities. Figure 1 Some examples of UE 104 are shown. Figure 1 As shown, UE 104 may be able to communicate with various types of devices, such as base station 102, other UE 104, or network devices (e.g., core network 106, relay device, Integrated Access and Backhaul (IAB) node, or another network device). Additionally or alternatively, UE 104 may support communication with other base stations 102 or UE 104, which may act as relays in the wireless communication system 100.

[0033] UE 104 may also support direct wireless communication with other UE 104 via communication link 112. For example, UE 104 may support direct wireless communication with another UE 104 via a device-to-device (D2D) communication link. In some implementations, such as vehicle-to-vehicle (V2V) deployment, vehicle-to-everything (V2X) deployment, or cellular-to-V2X deployment, communication link 112 may be referred to as a side link. For example, UE 104 may support direct wireless communication with another UE 104 via a PC5 interface.

[0034] The base station 102 may support communication with the core network 106, or with another base station 102, or with both. For example, the base station 102 may be connected to the core network 106 via one or more backhaul links 114 (e.g., via S1, N2, N2, or another network interface). The base stations 102 may communicate with each other via the backhaul links 114 (e.g., via X2, Xn, or another network interface). In some implementations, the base stations 102 may communicate with each other directly (e.g., between the base stations 102). In some other implementations, the base stations 102 may communicate with each other or indirectly (e.g., via the core network 106). In some implementations, one or more base stations 102 may include a subcomponent (such as an access network entity), which may be an example of an access node controller (Access Node Controller, ANC). The ANC may communicate with one or more UEs 104 via one or more other access network transmission entities, which may be referred to as radio heads, smart radio heads, or transmission-reception points (Transmission-Reception Point, TRP).

[0035] The core network 106 may support user authentication, access authorization, tracking, connectivity, and other access, routing, or mobility functions. The core network 106 may be an Evolved Packet Core (EPC) or a 5G Core (5GC), and may include control plane entities that manage access and mobility (e.g., Mobility Management Entity (MME), Access and Mobility Management Function (AMF)), and user plane entities that route or interconnect data packets to external networks (e.g., Serving Gateway (S-GW), Packet Data Network (PDN) Gateway (P-Gateway, P-GW), or User Plane Function (UPF)). In some implementations, the control plane entity may manage non-access stratum (NAS) functions, such as mobility, authentication, and bearer management for one or more UEs 104 served by one or more base stations 102 associated with the core network 106.

[0036] Figure 2 An example of a block diagram of a device 200 supporting access security is shown according to aspects of the present disclosure. The device 202 may be an example of a computer in a core network 106, a base station 102, or a UE 104 as described herein. The device 202 may support wireless communications with one or more base stations 102, UEs 104, or any combination thereof. The device 202 may include components for two-way communications, including components for sending and receiving communications, such as a communication manager 204, a processor 206, a memory 208, a receiver 210, a transmitter 212, and an I / O controller 214. These components may be in electronic communication or otherwise coupled (e.g., operationally, communicatively, functionally, electronically, electrically) via one or more interfaces (e.g., a bus).

[0037] The communication manager 204, the receiver 210, the transmitter 212, or various combinations thereof or various components thereof may be examples of means for performing various aspects of the disclosure described herein. For example, the communication manager 204, the receiver 210, the transmitter 212, or various combinations thereof or components thereof may support methods for performing one or more functions described herein.

[0038] In some implementations, the communication manager 204, the receiver 210, the transmitter 212, or various combinations or components thereof may be implemented in hardware (e.g., in a communication management circuit system). The hardware may include: a processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination of components configured or otherwise supported for performing the functions described in the present disclosure. In some implementations, the processor 206, and the memory 208 coupled to the processor 206, may be configured to perform one or more functions described herein (e.g., by executing instructions stored in the memory 208 by the processor 206).

[0039] Additionally or alternatively, in some implementations, the communication manager 204, the receiver 210, the transmitter 212, or various combinations or components thereof may be implemented in code (e.g., as communication management software or firmware) executed by the processor 206. If implemented in code executed by the processor 206, the functionality of the communication manager 204, the receiver 210, the transmitter 212, or various combinations or components thereof may be performed by a general purpose processor, a DSP, a central processing unit (CPU), an ASIC, an FPGA, or any combination of these or other programmable logic devices (e.g., components configured or otherwise supported for performing the functions described in the present disclosure).

[0040] In some implementations, the communication manager 204 may be configured to perform various operations (e.g., receive, monitor, transmit) using the receiver 210, the transmitter 212, or both, or in other ways in combination with the receiver 210, the transmitter 212, or both. For example, the communication manager 204 may receive information from the receiver 210, send information to the transmitter 212, or be integrated with the receiver 210, the transmitter 212, or both to receive information, send information, or perform various other operations described herein. Although the communication manager 204 is shown as a separate component, in some implementations, one or more functions described with reference to the communication manager 204 may be supported or performed by the processor 206, the memory 208, or any combination thereof. For example, the memory 208 may store code that may include instructions executable by the processor 206 to cause the device 202 to perform various aspects of the present disclosure described herein, or the processor 206 and the memory 208 may be otherwise configured to perform or support such operations.

[0041] For example, access security manager 204 can support wireless communications at a first device (eg, device 202) according to examples disclosed herein. Communications manager 204 can be configured to, or otherwise support, access control security for a wireless communications network.

[0042] The processor 206 may include an intelligent hardware device (e.g., a general purpose processor, a DSP, a CPU, a microcontroller, an ASIC, an FPGA, a programmable logic device, a discrete gate or transistor logic component, a discrete hardware component, or any combination thereof). In some implementations, the processor 206 may be configured to operate a memory array using a memory controller. In some other implementations, the memory controller may be integrated into the processor 206. The processor 206 may be configured to execute computer-readable instructions stored in a memory (e.g., memory 208) to cause the device 202 to perform various functions of the present disclosure.

[0043] The memory 208 may include random access memory (RAM) and read-only memory (ROM). The memory 208 may store computer-readable, computer-executable code including instructions that, when executed by the processor 206, cause the device 202 to perform various functions described herein. The code may be stored in a non-transitory computer-readable medium, such as a system memory or another type of memory. In some implementations, the code may not be directly executable by the processor 206, but may cause the computer (e.g., when compiled and executed) to perform the functions described herein. In some implementations, the memory 208 may include a basic I / O system (BIOS), etc., which may control basic hardware or software operations, such as interaction with peripheral components or devices.

[0044] I / O controller 214 can manage input and output signals for device 202. I / O controller 214 can also manage peripherals that are not integrated into device 202. In some implementations, I / O controller 214 can represent a physical connection or port to an external peripheral. In some implementations, I / O controller 214 can utilize an operating system, such as or another known operating system. In some implementations, the I / O controller 214 can be implemented as part of a processor, such as the processor 206. In some implementations, a user can interact with the device 202 through the I / O controller 214 or through a hardware component controlled by the I / O controller 214.

[0045] In some implementations, the device 202 may include a single antenna 216. However, in some other implementations, the device 202 may have multiple antennas 216 capable of simultaneously sending or receiving multiple wireless transmissions. As described herein, the receiver 210 and the transmitter 212 may communicate bidirectionally via one or more antennas 216, wired or wireless links. For example, the receiver 210 and the transmitter 212 may represent a wireless transceiver and may communicate bidirectionally with another wireless transceiver. The transceiver may also include a modem to modulate data packets, provide modulated data packets to one or more antennas 216 for transmission, and demodulate data packets received from one or more antennas 216.

[0046] Embodiments of the present disclosure relate to a system, apparatus, and method to set and configure dynamic access and security control policies based on real-time dynamic trust assessment information that can be used to perform actions within a network. Exemplary actions include: service consumption and provision restrictions, registration acceptance or rejection, registration with reduced permissions, authentication acceptance or rejection, authentication with limited access time, authorization acceptance, rejection, or authorization with minimum permissions, more fine-grained authorization, re-authentication, etc. Embodiments can restrict network communications to allow only communications between explicitly trusted NFs in the network, and to limit or prevent service access to compromised or less trusted NFs.

[0047] NF can be any network function in the core network, a network function in the access network, etc. NF can be a network node or a physical device. In some examples, NF can be virtualized. NF can be a core network function within the 5G system architecture.

[0048] A non-limiting list of some specific NFs within the scope of the present disclosure is:

[0049] -Authentication Server Function (AUSF),

[0050] - Access and Mobility Management Function (AMF),

[0051] -Data Network (DN), such as operator services, Internet access, or third-party services,

[0052] - Unstructured Data Storage Function (UDSF),

[0053] -Network Exposure Function (NEF),

[0054] - Network Repository Function (NRF),

[0055] - Network Slice Admission Control Function (NSACF),

[0056] - Network Slice-specific and SNPN Authentication and Authorization Function (NSSAAF),

[0057] - Network Slice Selection Function (NSSF),

[0058] - Policy Control Function (PCF),

[0059] -Session Management Function (SMF),

[0060] - Unified Data Management (UDM),

[0061] - Unified Data Repository (UDR),

[0062] -User Plane Function (UPF),

[0063] -UE radio capability management function (UEradio Capability Management Function, UCMF),

[0064] - Application Function (AF),

[0065] - User Equipment (UE),

[0066] - (Radio) Access Network (R)AN),

[0067] -5G-Equipment Identity Register (5G-EIR),

[0068] -Network Data Analytics Function (NWDAF),

[0069] -Charging Function (CHF),

[0070] -Time Sensitive Networking AF (TSN AF),

[0071] -Time Sensitive Communication and Time Synchronization Function (TSCTSF),

[0072] -Data Collection Coordination Function (DCCF),

[0073] -Analytics Data Repository Function (ADRF),

[0074] -Messaging Framework Adaptor Function (MFAF),

[0075] - Non-Seamless WLAN Offload Function (NSWOF),

[0076] -Edge Application Server Discovery Function (EASDF),

[0077] - Non-3GPP InterWorking Function (N3IWF),

[0078] -Trusted Non-3GPP Gateway Function (TNGF),

[0079] -Wireline Access Gateway Function (W-AGF), and

[0080] -Trusted WLAN Interworking Function (TWIF).

[0081] The 5G system architecture also includes the following network elements that may be within the scope of the element to which the security policy is applied:

[0082] - Service Communication Proxy (SCP), and

[0083] -Security Edge Protection Proxy (SEPP).

[0084] In an embodiment, the access security method supports confidence or trust evaluation values ​​generated based on real-time, continuously updated trust evaluation information to be used to generate access control policies and security policies at a policy control function (PCF). The access control policies and security policies generated at the PCF can be used to perform dynamic access control at various NFs and AFs in the network during one or more of the following: authentication, authorization, discovery, registration, service access requests, data access, connection establishment, etc., to allow only explicitly trusted NFs and AFs to request and provide services in the network.

[0085] Trust assessment information related to NF or AF may be analysis information related to one or more of the following: the security status of the network function, the behavior of the network function, the service operation of the network function, and the environmental attributes of the network function, and may be any information related to the security of the network function or operation.

[0086] Examples of security status include observable status, such as installed software version, network or NF location, time or date of request, certificate status (e.g., expiration, renewal, revocation, etc.), lack of configured credential rotation (e.g., if credential refresh is not performed within a certain life cycle of the NF, the trust level may be affected), previously observed behavior, installed credentials, telemetry data, data about events occurring inside the NF (which may affect business goals and service experience), network function / network status, device status, interface status, application operation, open port information, closed port information, access or configuration violation information, expected configuration information, etc.

[0087] Behavioral attributes may include: automated subject analysis, device analysis, log analysis, measured deviations from observed usage patterns, etc. Service operations may include: any deviations from normal and specified service operations. Environmental attributes may include: factors such as requester network location, time of day, reported active attacks, etc.

[0088] Figure 3 According to aspects of the present disclosure, a flow chart of a method 300 for supporting access security is shown. The operations of the method 300 may be implemented by the device or components thereof described herein. For example, as shown in FIG. Figure 1 and Figure 2The operations of method 300 may be performed by components of core network 106, base station 102, or UE 104. In some implementations, a device may execute a set of instructions to control a functional unit of the device to perform the functions. Additionally or alternatively, the device may use dedicated hardware to perform aspects of the functions.

[0089] At 305, the method may include: monitoring security and performing trust assessment. The operations of 305 may be performed according to the examples described herein. In some implementations, aspects of the operations of 305 may be described in detail in the context of FIG. Figure 1 The security monitoring and trust evaluation 305 may be performed by the device described in the embodiment of the present invention. The security monitoring and trust evaluation 305 may be performed continuously for all NFs operating in the wireless network. The security monitoring and trust evaluation 305 may be initiated when the NF in the network is installed or activated.

[0090] In an embodiment, the method 300 is performed by a NF communicating with another NF within the same wireless communication network. Figure 4 An example of communication between two NFs performing an embodiment of method 300 is provided. In an embodiment, method 300 may be performed by NF 404, which may be a policy control function (PCF), or may be some other NF configured to perform the steps of method 300. For ease of description, NF 404 will be referred to as PCF in subsequent discussions, but embodiments are not limited to such implementations.

[0091] PCF 402 may communicate with NF 404, which may be, for example, a Trust valuation service and Enabler Service Function (TESF), a Network Data Analytics Function (NWDAF), or a NF that performs continuous dynamic security monitoring, trust assessment, and trust-related analysis of various network functions, application functions, or devices. NF 404 may collect information about the observable state of network or application functions, and assess the security posture and associated trustworthiness of these functions. For ease of description, NF 404 will be referred to as TESF 404 in the following discussion.

[0092] In some embodiments, TESF 404 may apply artificial intelligence (AI)-based analysis operations to the trust assessment information and generate one or more security confidence levels, metrics, or ranges to classify the trustworthiness of a specific function's security posture, operational behavior, service level, reliability, etc. The AI-based analysis operation may be an operator-specific trust assessment algorithm, or other trust algorithms known in the art.

[0093] At 305, examples of security confidence levels that may result from the assessment are: critical (e.g., 0-10%), very low (e.g., 11-20%), low (e.g., 21-40%), medium (e.g., 41-60%), high (e.g., 61-80%), and very high (e.g., 81-100%). The exact number of intervals, and the values ​​of the metrics or ranges associated with these levels may vary between different embodiments. These ranges may be referred to as: trust data analysis information, security monitoring data analysis, or trust scores.

[0094] At 310, the method may include establishing a trust assessment data subscription between the PCF 402 and the TESF 404. The operations of 310 may be performed according to the examples described herein. In some implementations, aspects of the operations of 310 may be described with reference to Figure 1 The device described is used to perform the

[0095] PCF 402 may subscribe to TESF 404 to receive trust assessment information, specific trust and / or security confidence, metrics, or scopes for one or more NFs or AFs. Establishing a trust data subscription at 310 may include sending a trust assessment data subscription request message from PCF 402 to TESF 404. The request message may include one or more NF IDs or AF IDs, and network slice identification information (e.g., NSSAI / S-NSSAI).

[0096] TESF 404 may process the request based on local policy, and if PCF 402 is evaluated and identified as a trusted NF, TESF 404 may allow the subscription.TESF 404 may then send a trust evaluation data subscription response including a success indication to PCF 402.

[0097] Alternatively, if TESF 404 evaluates PCF 402 and determines that PCF 402 is a less trusted or untrusted function, TESF 404 may reject the subscription. In this case, TESF 404 may send a trust evaluation data subscription response message with a rejection and trust verification failure indication to PCF 402.

[0098] At 315, the method may include requesting trust assessment data. The operations of 315 may be performed according to the examples described herein. In some implementations, aspects of the operations of 315 may be described in detail in the context of FIG. Figure 1 The device described is used to perform the

[0099] After successful subscription, PCF 402 may send a trust assessment data request message to TESF 404 to obtain trust assessment information, including: specific trust and / or security confidence levels for various NFs, AFs, and network slices. The data request message may include: identifiers of one or more NFs, AFs, or network slices for which trust assessment is sought. The timing of this message is not particularly limited, but it may be executed periodically when an NF appears in the network, when verification of current data expires, etc. In an embodiment, this message may be sent based on local policy.

[0100] At 320, the method may include receiving trust assessment data. The operations of 320 may be performed according to the examples described herein. In some implementations, aspects of the operations of 320 may be described in detail in the context of FIG. Figure 1 The device described is used to perform the

[0101] In response to the request at 315, PCF 402 may receive trust assessment data from TESF 404. The trust assessment data may be included in a notification message (e.g., a trust assessment data notification) having trust assessment information (such as a specific trust and / or security confidence level, metric, or scope), and an identifier of a NF, AF, or network slice associated with the trust assessment information. In addition, the trust assessment data received at 320 may include: validity information for the trust data analysis information. The validity information may provide a time for which the trust data is valid. The validity information may include: an expiration time or deadline set for the use of the trust assessment data (e.g., x seconds / x minutes / x hours / x days / x years, etc.). The same validity information may be considered for the validity of an access security policy derived based on the trust assessment data.

[0102] At 325, the method may include: creating a security policy. The operations of 325 may be performed according to the examples described herein. In some implementations, aspects of the operations of 325 may be described by reference to Figure 1 The device described is used to perform the

[0103] After receiving the trust evaluation data at 320, PCF 402 may generate an access control security policy for each NF or AF based on the local policy. PCF 402 may set the validity of each access control security policy based on the trust data analysis, security monitoring data analysis, and the validity of the local policy. The access control security policy created at 325 may include, for example, one or more of the following information:

[0104] Policy ID, which can identify a unique access control security policy;

[0105] A policy subscription ID, which may indicate a unique policy subscription;

[0106] Types of NF;

[0107] The ID of the associated NF or AF;

[0108] The ID of the network slice associated with the NF (e.g., Network Slice Selection Assistance Information (NSSAI), Single Network Slice Selection Assistance Information (S-NSSAI));

[0109] a service operation restriction list, which may include: a list of service names that can be provided as a NF service producer based on the trust assessment data;

[0110] A service operation prohibition list, which may include: a list of service names that are not allowed to be NF service producers based on the trust assessment data;

[0111] A network slice restriction list, which may include: a list of SNSSAIs or NSSAIs that can be provided as service producers based on trust assessment data;

[0112] A network slice prohibition list, which may include: a list of SNSSAIs or NSSAIs that are not allowed to be provided as service producers based on trust assessment data;

[0113] A network service consumer restriction list, which may include a list of one or more of the following: NF type, NFID, AF ID, and service name that is allowed to consume services after authentication and authorization;

[0114] A network service consumer prohibition list, which may include a list of one or more of the following items: NF type, NFID, AF ID, and service name of services that are not allowed to be consumed;

[0115] Trust data analysis / trust level thresholds for network service consumer authentication;

[0116] Trust data analysis / trust level thresholds for network service consumer authorization;

[0117] Trust data analysis / trust level thresholds for network producer authentication;

[0118] NF service consumer authentication lifecycle, after which re-authentication is required;

[0119] NF service consumer authorization lifecycle, after which re-authorization is required;

[0120] NF service producer certification lifecycle, after which re-certification is required;

[0121] UE context sharing restrictions, which may include a list of UE contexts that are allowed to be shared and may be specific to: UE ID, security context, local information, subscription data, UE-related analytics, or UE data;

[0122] Prohibit UE context sharing, which may include a list of UE contexts that are prohibited from sharing and may be specific to: UE ID, security context, local information, subscription data, UE-related analysis, or UE data;

[0123] A restricted authentication validity list, which may include various allowed authentications, such as NF Service Producer Authentication, NF Service Consumer Authentication, NRF Authentication, and AF Authentication;

[0124] Re-authentication periodicity;

[0125] Immediate connection termination advice; and

[0126] Least privilege authorization for network service consumers to restrict those consumers to a restricted set of services based on the trust level associated with the services, and the potential security sensitivity of the services.

[0127] This list of information is not exclusive, and only a portion of the items in the list may be present in various embodiments. For example, access security policies may be NF-specific, network slice-specific, or service operation-specific. Thus, multiple security policies may be implemented for a given network, and policies may change over time.

[0128] Figure 5 According to aspects of the present disclosure, a flowchart of a method 500 for supporting access security is shown. The operations of the method 500 may be implemented by the device or components thereof described herein. For example, as shown in FIG. Figure 1 and Figure 2The operations of method 500 may be performed by components of core network 106, base station 102, or UE 114. In some implementations, a device may execute a set of instructions to control functional elements of the device to perform the functions. Additionally or alternatively, the device may use dedicated hardware to perform aspects of the functions.

[0129] Elements of method 500 involve configuration and execution of dynamic access control security policies to allow only trusted NFs and AFs to participate in any service provision or consumption within the network. Method 500 may be performed in conjunction with one or more elements of method 300. For example, in method 500, NRF 406 may execute the security policy from PCF 402 created at 325 in method 300. Figure 6 A signal diagram illustrating an embodiment of method 500 performed by PCF 402 and NRF 406 .

[0130] At 505, the method may include receiving and processing an access security policy subscription request. The operations of 505 may be performed according to the examples described herein. In some implementations, aspects of the operations of 505 may be described by reference to Figure 1 The device described is used to perform the

[0131] For example, the entity that receives and executes the access control security policy from PCF 402 may be NF 406. For ease of description, element 406 will be referred to as a network repository function (NRF), but the embodiment is not limited thereto. In various embodiments, the element that receives and executes the access control security policy may be a service communication proxy (SCP), or another NF or AF.

[0132] NRF 406 may send a dynamic access control security policy subscription request message to PCF 402. The subscription request may include, for example, the IDs of one or more NFs, AFs, or network slices that need to be monitored, and the service operation name for the service of interest. Additionally, NRF 406 may request to unsubscribe from the dynamic access control security policy subscription by sending a dynamic access control security policy unsubscription request with the policy subscription ID to PCF 402.

[0133] At 510, the method may include sending an access security policy subscription response message. The operations of 510 may be performed according to the examples described herein. In some implementations, aspects of the operations of 510 may be described by reference to Figure 1 The device described is used to perform the

[0134] Upon receiving the dynamic access control security policy subscription request, PCF 402 may determine whether the requested NF is trusted based on the latest trust scope value or trust data analysis and local policy. Based on the local policy, if the requested NF meets the trust requirements, PCF 402 may accept the subscription request. PCF 402 may then send a dynamic access control security policy subscription response message, which may include one or more of the following: a success indication, and a confirmation and policy subscription ID.

[0135] Alternatively, based on local policy, if the trust scope value or trust data analysis for the NF requesting access does not meet the trust requirement, the PCF 402 determines to reject the subscription request at 505. In this case, at 510, the PCF 402 may send a dynamic access control security policy subscription response message with one or more of the following items: a rejection indication, a negative confirmation, and a trust verification failure indication.

[0136] In an embodiment, if PCF 402 receives an unsubscribe request, which may be a dynamic access control security policy unsubscribe request with a policy subscription ID, PCF 402 may delete the subscription and may send a dynamic access control security policy unsubscribe response message with a success indication / confirmation.

[0137] At 515, the method may include sending a security policy request trigger. The operations of 515 may be performed according to the examples described herein. In some implementations, aspects of the operations of 515 may be described by reference to Figure 1 The device described is used to perform the

[0138] At any time, PCF 402 can receive the latest trust assessment information specific trust data analysis. That is, security monitoring can be performed continuously at 305, and PCF 402 can process the trust data when it is available. If PCF402 creates a new access control security policy, at 515, PCF can send a dynamic access control security policy request trigger message to NRF 406. The trigger message can be sent periodically, at any time based on local policy, or when the trust state changes. The trigger message may include one or more of the following items associated with the policy: policy subscription ID, NF ID, AF ID, slice ID, and service operation name.

[0139] At 520, the method may include: receiving a dynamic access control security policy creation request message. The operations of 520 may be performed according to the examples described herein. In some implementations, aspects of the operations of 520 may be described by reference to Figure 1 The device described is used to perform the

[0140] At 520, NRF 406 may send a dynamic access control security policy creation request message to PCF 402. The creation request message may include one or more of the following: NF ID, network function instance ID, AF ID, network slice ID, and service operation name. If there are multiple instances of NF in the network, each NF instance may be identified using the NF instance ID, so the NF instance ID for the affected NF instance may be provided in the creation request message. In an embodiment, if the request message is sent as a policy request, the message may include an access control security policy request indication to indicate that the request is for an access control access security policy.

[0141] The create request message may be sent periodically, when the validity of an existing policy expires, after receiving a trigger message at 515, or at a time based on local policy. In some embodiments, the create request message may be sent when a NF service producer or consumer related decision is made, for example, during NF registration, authentication, authorization, etc.

[0142] At 525, the method may include sending a dynamic access control security policy creation response message. The operations of 525 may be performed according to the examples described herein. In some implementations, aspects of the operations of 525 may be described by reference to Figure 1 The device described is used to perform the

[0143] At 525, PCF 402 may send a dynamic access control security policy create response message to NRF 406. The response message may include: an updated list of access control security policies specific to the policy requested at 520. For example, the response message may include: an identification of a policy for one or more NFs, AFs, or network slices, the policy itself, an NF instance ID, an ID for each NF, AF, or slice, and validity data for the relevant policy. If there are multiple instances of a NF in the network, each NF instance is identified using an NF instance ID, and the ID of the affected instance may be provided in the create response message.

[0144] In some embodiments, PCF 402 and NRF 406 may exchange messages related to access control security policies (rather than policy creation). For example, PCF 402 and NRF 406 may exchange messages for updates, notifications, update notifications, and deletion operations for dynamic access control security policies. For example, when NF is deactivated or the service relationship with NF is terminated, at 520, NRF 406 may send a dynamic access control security policy deletion message to PCF 402. PCF 402 may delete the relevant policies and send an ACK notification message to NRF 406 at 525. Therefore, the message exchange described in connection with 520 and 525 is not limited to messages for policy creation. In some embodiments, messages for security policies may be initiated by NRF.

[0145] At 530, the method may include: executing the access control security policy. The operations of 530 may be performed according to the examples described herein. In some implementations, aspects of the operations of 530 may be described by reference to Figure 1 The device described is used to perform the

[0146] NRF 406 can store active dynamic access control security policies and related NF IDs, AF IDs, or slice IDs. NRF 406 can use the received dynamic access control security policies to perform various access control related operations for any NF service consumer or NF service producer to allow or deny various operations such as NF service registration, NF discovery, NF authentication, NF service authorization, AF authentication, AF authorization, UE context sharing, etc.

[0147] In an embodiment, Figure 7 As shown, at 305, TESF 404 may perform ongoing security monitoring and trust assessment, and use the data from the monitoring to create security policies at 325. In such an embodiment, a trust assessment data subscription with PCF 402 may not be performed. Figure 7 In the illustrated embodiment, TESF 404 cooperates with NRF 406 to perform Figure 6 The steps of method 500 are performed by PCF 402 in the illustrated embodiment.

[0148] It should be emphasized that Figures 3 to 7 The operations described are not limited to being performed by TESF, PCF, or NRF. In alternative embodiments, these operations may be performed by different NFs configured to: generate or set access control policies and security policies related to monitored security information, evaluate trust data, and enforce security policies for various trusted network operations. In addition, embodiments of the present disclosure are applicable to both roaming and non-roaming scenarios.

[0149] It should be noted that the methods described herein describe possible implementations, that operations and steps may be rearranged or otherwise modified, and that other implementations are possible. Furthermore, aspects from two or more methods may be combined.

[0150] The various illustrative blocks and components described in connection with the disclosure herein may be implemented or performed using a general purpose processor, a DSP, an ASIC, a CPU, an FPGA or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general purpose processor may be a microprocessor, but alternatively, the processor may be any processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of computing devices (e.g., a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in combination with a DSP core, or any other such configuration).

[0151] The functions described herein may be implemented in hardware, software executed by a processor, firmware, or any combination thereof. If implemented in software executed by a processor, the functions may be stored as one or more sets of instructions or codes on a computer-readable medium, or sent via a computer-readable medium. Other examples and implementations are within the scope of this disclosure and the appended claims. For example, due to the nature of software, the functions described herein may be implemented using software executed by a processor, hardware, firmware, hard wiring, or any combination thereof. Features that implement the functions may also be physically (including distributedly) located in various locations, so that parts of the functions are implemented in different physical locations.

[0152] Computer-readable media include non-transient computer storage media and communication media, including any medium that is convenient for transferring a computer program from one place to another. Non-transient storage media can be any available medium that can be accessed by a general-purpose or special-purpose computer. As an example, and not by way of limitation, non-transient computer-readable media may include RAM, ROM, electrically erasable programmable ROM (Electrically Erasable Programmable ROM, EEPROM), flash memory, compact disk (Compact Disk, CD) ROM or other optical disk storage, disk storage or other magnetic storage device, or may be used to carry or store required program code components in the form of instructions or data structures and any other non-transient medium that can be accessed by a general-purpose or special-purpose computer or a general-purpose or special-purpose processor.

[0153] Any connection may be appropriately referred to as a computer-readable medium. For example, if a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technology (such as infrared, wireless, and microwave) is used to send software from a website, server, or other remote source, the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technology (such as infrared, wireless, and microwave) are included in the definition of computer-readable medium. Disks and optical disks as used herein include CDs, laser optical disks, optical disks, digital versatile disks (DVDs), floppy disks, and Blu-ray disks, where disks typically reproduce data magnetically, while optical disks reproduce data optically using lasers. Combinations of the above are also included within the scope of computer-readable media.

[0154] As used herein, including in the claims, "or" used in a list of items (e.g., a list of items preceded by a phrase such as "at least one" or "one or more") indicates an inclusive list, for example, a list of at least one of A, B, or C means A or B or C or AB or AC or BC or ABC (i.e., A and B and C). In addition, as used herein, the phrase "based on" should not be interpreted as a reference to a closed set of conditions. For example, an example step described as "based on condition A" can be based on both condition A and condition B without departing from the scope of the present disclosure. In other words, as used herein, the phrase "based on" should be interpreted in the same manner as the phrase "based at least in part on". In addition, as used herein, including in the claims, a "set" may include one or more elements.

[0155] The description set forth herein in conjunction with the accompanying drawings describes example configurations and does not represent all examples that may be implemented or within the scope of the claims. The term "example" as used herein means "as an example, instance, or illustration," rather than "preferred" or "superior to other examples." For the purpose of providing an understanding of the described technology, the detailed description includes specific details. However, these technologies can be practiced without these specific details. In some examples, known structures and devices are shown in block diagram form to avoid obscuring the concepts of the described examples.

[0156] The description herein is provided to enable one of ordinary skill in the art to make or use the present disclosure. Various modifications of the present disclosure are apparent to one of ordinary skill in the art, and the general principles defined herein may be applied to other variations without departing from the scope of the present disclosure. Therefore, the present disclosure is not limited to the examples and designs described herein, but should be given the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An apparatus for wireless communication in a wireless network, the apparatus comprising: processor; as well as A memory is coupled to the processor, wherein the processor is configured to: receiving a subscription request for an access control security policy from a first network function; In response to the subscription request, sending a subscription response to the first network function, the subscription response indicating that a policy subscription has been initiated; generating access control security policies for a plurality of said network functions based on trust data obtained from monitoring the corresponding network functions; Applying a validity parameter to the generated access control security policy, the validity parameter indicating: a time for which each access control security policy is valid; Receive an access control security policy creation request, the access control security policy creation request including at least one of the following items: a network function ID, a network function instance ID, an application function ID, and a network slice ID; as well as sending a response to the access control security policy request, the response comprising at least one of the following: an access control security policy list for the identified network function, the identified network function instance, the identified application function, the identified network slice, and validity information, The validity parameter is based on one or more of the following: security monitoring data analysis validity, trust data analysis validity, and local policy.

2. The apparatus according to claim 1, wherein the apparatus is further configured to: sending a trust assessment request to a second network function, the trust assessment request comprising at least one of the following: a trust data analysis indication, the network function ID, the network function instance ID, the application function ID, and the network slice ID; and Receive a response to the trust assessment request from the first network function, the response including trust data associated with the identified network function, the identified network function instance, the identified application function, and the identified network slice. The apparatus of claim 2 , wherein the second network function is a trust assessment function. The apparatus of claim 1 , wherein the first network function is a network repository function.

5. The apparatus according to claim 1, wherein the apparatus is further configured to: Before initiating the policy subscription, comparing the trust level of the first network function with a threshold value, The policy subscription is initiated only when the trust level of the first network function exceeds the threshold value.

6. The apparatus according to claim 1, wherein the apparatus is further configured to: receiving new trust data from the second network function; and In response to the new trust information, an access control security policy request trigger message is sent to the first network function.

7. The apparatus according to claim 1, wherein the access control security policy comprises one or more of the following: A list of network slice restrictions for network slices that can be provided as a service, A network slice banlist of network slices that cannot be provided as a service, List of restricted information for network service consumers, including: One or more network functions or application functions that are permitted to consume the service after authentication and authorization, and The prohibited list of network service consumers includes: one or more network functions or application functions that are prohibited from consuming services.

8. The apparatus according to claim 1, wherein the access control security policy comprises one or more of the following: Trust data thresholds for network service consumer authentication, Trust data thresholds for network service consumer authorization, Trust data threshold for network producer authentication, Trust data thresholds for network service discovery, Trust data thresholds for network registration, Trust data threshold for network registration updates, Network Function Service Consumer Authentication Lifecycle, The network function service consumer authorization lifecycle, and Network function service producer certification lifecycle.

9. The apparatus according to claim 1, wherein the access control security policy comprises one or more of the following: A list of service operation restrictions, including: The name of the service that can be provided as a network function service producer, and The service operation prohibition list includes: service names that are not allowed to be provided by NF service producers.

10. The apparatus according to claim 1, wherein the access control security policy comprises one or more of the following: Permitted UE context sharing, UE context sharing is prohibited, Limited authentication lifecycle, Re-authentication periodicity, Immediate connection termination advice, and Least privilege authorization.

11. A method comprising: receiving a subscription request for an access control security policy from a first network function; In response to the subscription request, sending a subscription response to the first network function, the subscription response indicating that a policy subscription has been initiated; generating access control security policies for a plurality of said network functions based on trust data obtained from monitoring the corresponding network functions; Applying a validity parameter to the generated access control security policy; Receive an access control security policy creation request, the access control security policy creation request including at least one of the following items: a network function ID, a network function instance ID, an application function ID, and a network slice ID; as well as sending a response to the access control security policy request, the response comprising at least one of the following: an access control security policy list for the identified network function, the identified network function instance, the identified application function, the identified network slice, and validity information, The validity parameter is based on one or more of the following: security monitoring data analysis validity, trust data analysis validity, and local policy.

12. The method according to claim 11, further comprising: Sending a trust assessment request to a second network function, the trust assessment request comprising at least one of the following: a trust data analysis indication, the network function ID, the network function instance ID, the application function ID, and the network slice ID; as well as Receive a response to the trust assessment request from the first network function, the response including trust data associated with the identified network function, the identified network function instance, the identified application function, and the identified network slice. The method of claim 12 , wherein the second network function is a trust assessment function. The method of claim 11 , wherein the first network function is a network repository function.

15. The method according to claim 11, further comprising: Before initiating the policy subscription, comparing the trust level of the first network function with a threshold value, The policy subscription is initiated only when the trust level of the first network function exceeds the threshold value.

16. The method according to claim 11, further comprising: receiving new trust data from the second network function; as well as In response to the new trust information, an access control security policy request trigger message is sent to the first network function.

17. The method of claim 11, wherein the access control security policy comprises one or more of the following: A list of network slice restrictions for network slices that can be provided as a service, A network slice banlist of network slices that cannot be provided as a service, List of restricted information for network service consumers, including: One or more network functions or application functions that are permitted to consume the service after authentication and authorization, and The prohibited list of network service consumers includes: one or more network functions or application functions that are prohibited from consuming services.

18. The method of claim 11, wherein the access control security policy comprises one or more of the following: Trust data thresholds for network service consumer authentication, Trust data thresholds for network service consumer authorization, Trust data threshold for network producer authentication, Trust data thresholds for network service discovery, Trust data thresholds for network registration, Trust data threshold for network registration updates, Network Function Service Consumer Authentication Lifecycle, The network function service consumer authorization lifecycle, and Network function service producer certification lifecycle.

19. The method of claim 11, wherein the access control security policy comprises one or more of the following: A list of service operation restrictions, including: The name of the service that can be provided as a network function service producer, and The service operation prohibition list includes: service names that are not allowed to be provided by NF service producers.

20. The method of claim 11, wherein the access control security policy comprises one or more of the following: Permitted UE context sharing, UE context sharing is prohibited, Limited authentication lifecycle, Re-authentication periodicity, Immediate connection termination advice, and Least privilege authorization.

Images