Data security for network slice management

Abstract

The embodiment of the invention relates to data security equipment, method and device for network slice management and a computer readable storage medium. The method includes transmitting, to a second device, at least one entry associated with an attribute of data generated by a first device; in response to a request for accessing the data received from the third device, determining whether the third device has a permission for accessing the data based on the request; and in response to determining that the third device has the authority for accessing the data, enabling the third device to check the integrity of the data based on the attribute of the data acquired from the second device. In this manner, a service consumer may detect data tampering. In addition, it can be ensured that only authorized data users can access the original performance data, the original fault data or the configuration data.

Description

[0001] This application is a divisional application of the patent application with application number 201980099250.6, application date August 13, 2019, and invention name “Data Security for Network Slice Management”. Technical Field

[0002] Embodiments of the present disclosure generally relate to the field of telecommunications, and more particularly to devices, methods, apparatuses, and computer-readable storage media for data security of network slice management. Background Art

[0003] According to the specifications of the Third Generation Partnership Project (3GPP) and the International Telecommunication Union - Telecommunication Standardization Sector (ITU-T) on network slicing management and organization, network slicing management mainly includes configuration management, fault management, performance management, billing management, security management and template management (for example, communication service templates, network slice templates and network slice subnet templates).

[0004] Typically, configuration data, fault data, and performance data will be shared or accessed by some participants, such as communication service management on behalf of the communication service provider, network slice management on behalf of the network slice provider, and network slice subnet management on behalf of the network slice subnet provider. Summary of the Invention

[0005] In summary, example embodiments of the present disclosure provide a data security solution for network slice management.

[0006] In a first aspect, a first device is provided. The first device includes: at least one processor; and at least one memory including computer program code, wherein the at least one memory and the computer program code are configured to, together with the at least one processor, cause the first device to at least: send at least one entry associated with an attribute of data generated by the first device to a second device; in response to a request for accessing the data received from a third device, determine, based on the request, whether the third device has permission to access the data; and, in response to determining that the third device has permission to access the data, cause the third device to check the integrity of the data based on the attribute of the data obtained from the second device.

[0007] In a second aspect, a second device is provided. The second device includes: at least one processor; and at least one memory including computer program code, wherein the at least one memory and the computer program code are configured to, together with the at least one processor, cause the second device to at least: receive at least one entry associated with an attribute of data from a first device; store the attribute of the data in a blockchain; receive a request for access to the attribute of the data from a third device; and, in response to determining, based on the request, that the third device has permission to access the attribute of the data, send the attribute of the data from the blockchain to the third device.

[0008] In a third aspect, a third device is provided. The third device includes: at least one processor; and at least one memory including computer program code, wherein the at least one memory and the computer program code are configured to, together with the at least one processor, cause the third device to at least: send a request to a second device to access attributes of data; generate a request to access the data based on at least the attributes of the data; send the request to a first device to access the data; and, in response to receiving the data from the first device, check the integrity of the data based on the attributes.

[0009] In a fourth aspect, a method is provided, comprising: sending at least one entry associated with an attribute of data generated by the first device to a second device; in response to a request for accessing the data received from a third device, determining, based on the request, whether the third device has permission to access the data; and in response to determining that the third device has permission to access the data, causing the third device to check the integrity of the data based on the attribute of the data obtained from the second device.

[0010] In a fifth aspect, a method is provided, comprising: receiving at least one entry associated with an attribute of data from a first device; storing the attribute of the data in a blockchain; receiving a request for access to the attribute of the data from a third device; and in response to determining that the third device has permission to access the attribute of the data based on the request, sending the attribute of the data from the blockchain to the third device.

[0011] In a sixth aspect, a method is provided, comprising: sending a request to a second device to access attributes of data; generating a request to access the data based at least on the attributes of the data; sending the request to access the data to a first device; and, in response to receiving the data from the first device, checking integrity of the data based on the attributes.

[0012] In a seventh aspect, an apparatus is provided. The apparatus includes: means for sending at least one entry associated with an attribute of data generated by a first device to a second device; means for, in response to a request for accessing the data received from a third device, determining, based on the request, whether the third device has permission to access the data; and means for, in response to determining that the third device has permission to access the data, causing the third device to check integrity of the data based on the attribute of the data obtained from the second device.

[0013] In an eighth aspect, an apparatus is provided. The apparatus includes: means for receiving at least one entry associated with an attribute of data from a first device; means for storing the attribute of the data in a blockchain; means for receiving a request to access the attribute of the data from a third device; and means for sending the attribute of the data from the blockchain to the third device in response to determining, based on the request, that the third device has permission to access the attribute of the data.

[0014] In a ninth aspect, an apparatus is provided, comprising: means for sending a request to access attributes of data to a second device; means for generating a request to access the data based at least on the attributes of the data; means for sending the request to access the data to a first device; and means for checking integrity of the data based on the attributes in response to receiving the data from the first device.

[0015] In a tenth aspect, there is provided a computer readable medium having stored thereon computer program instructions which, when executed by at least one processor of a device, cause the device to perform the method according to the fourth aspect.

[0016] In an eleventh aspect, there is provided a computer readable medium having stored thereon computer program instructions which, when executed by at least one processor of a device, cause the device to perform the method according to the fifth aspect.

[0017] In a twelfth aspect, there is provided a computer readable medium having stored thereon computer program instructions which, when executed by at least one processor of a device, cause the device to perform the method according to the sixth aspect.

[0018] Other features and advantages of embodiments of the present disclosure will become apparent from the following detailed description of embodiments when read in conjunction with the accompanying drawings, which illustrate, by way of example, the principles of the disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Embodiments of the present disclosure are presented by way of example, and their advantages are explained in more detail below with reference to the accompanying drawings, in which:

[0020] Figure 1An example system is shown in which example embodiments of the present disclosure may be implemented;

[0021] Figure 2 A schematic diagram illustrating a process 200 for data security for network slice management according to an example embodiment of the present disclosure is shown;

[0022] Figure 3 A schematic diagram illustrating an example structure of one block of a blockchain according to some example embodiments of the present disclosure is shown;

[0023] Figure 4 A flowchart illustrating an example method 400 for data security for network slice management according to some example embodiments of the present disclosure is shown;

[0024] Figure 5 A flowchart illustrating an example method 500 for data security for network slice management according to some example embodiments of the present disclosure is shown;

[0025] Figure 6 A flowchart illustrating an example method 600 for data security for network slice management according to some example embodiments of the present disclosure is shown;

[0026] Figure 7 shows a simplified block diagram of a device suitable for implementing an example embodiment of the present disclosure; and

[0027] Figure 8 A block diagram illustrating an example computer-readable medium according to some embodiments of the present disclosure is shown.

[0028] Throughout the drawings, the same or similar reference numerals denote the same or similar elements. DETAILED DESCRIPTION

[0029] The subject matter described herein will now be discussed with reference to a number of example embodiments. It should be understood that these embodiments are discussed only to enable those skilled in the art to better understand and thereby implement the subject matter described herein, and do not imply any limitation on the scope of the subject matter.

[0030] The terms used herein are for the purpose of describing particular embodiments only and are not intended to limit the example embodiments. As used herein, unless the context clearly indicates otherwise, the singular forms "a," "an," and "the" are intended to include the plural forms as well. It should also be understood that when the terms "comprise," "include," "include," and / or "comprising" are used herein, the presence of a claimed feature, whole, step, operation, element, and / or component is specified, but the presence or addition of one or more other features, wholes, steps, operations, elements, components, and / or combinations thereof is not precluded.

[0031] It should also be noted that in some alternative implementations, the functions / actions indicated may not occur in the order indicated in the figures. For example, depending on the functions / actions involved, two functions or actions shown in succession may actually be performed simultaneously, or may sometimes be performed in the reverse order.

[0032] As used herein, the term "communication network" refers to a network that complies with any suitable communication standard, such as Long Term Evolution (LTE), Advanced LTE (LTE-A), Wideband Code Division Multiple Access (WCDMA), High Speed ​​Packet Access (HSPA), etc. In addition, communication between terminal devices and network devices in the communication network can be performed according to any suitable generation of communication protocols, including but not limited to first generation (1G), second generation (2G), 2.5G, 2.75G, third generation (3G), fourth generation (4G), 4.5G, future fifth generation (5G) communication protocols, and / or any other protocols currently known or to be developed in the future.

[0033] The embodiments of the present disclosure can be applied to various communication systems. Given the rapid development of communications, there are certainly future types of communication technologies and systems that can be used to implement the present disclosure. This should not be construed as limiting the scope of the present disclosure to only the aforementioned systems. For illustrative purposes, the embodiments of the present disclosure will be described with reference to a 5G communication system.

[0034] The term "network device" as used herein includes, but is not limited to, a base station (BS), a gateway, a registration management entity, and other appropriate equipment in a communication system. The term "base station" or "BS" refers to a Node B (Node B or NB), an evolved Node B (eNodeB or eNB), a NR (New Radio) NB (also known as a gNB), a remote radio unit (RRU), a radio head (RH), a remote radio head (RRH), a relay, a low-power node such as a femto, a pico, etc.

[0035] The term "terminal device" as used herein includes, but is not limited to, "user equipment (UE)" and other suitable terminal devices capable of communicating with network devices. For example, "terminal device" may refer to a terminal, a mobile terminal (MT), a subscriber station (SS), a portable subscriber station, a mobile station (MS), or an access terminal (AT).

[0036] The term "circuitry" as used herein may refer to one, more, or all of the following:

[0037] (a) pure hardware circuit implementation (such as implementation in analog and / or digital circuitry only) and

[0038] (b) a combination of hardware circuitry and software such as (if applicable):

[0039] (i) Analog and / or digital hardware circuit(s)

[0040] in combination with software / firmware, and

[0041] (ii) any portion of hardware processor(s) with software (including digital signal processor(s), software and memory(s) that work together to enable a device such as a mobile phone or server to perform various functions) and

[0042] (c) Hardware circuit(s) and / or processor(s) (such as microprocessor(s) or portion(s) of microprocessor(s)) that require software (e.g., firmware) to operate, but which may not be present when the software is not required for operation.

[0043] This definition of circuitry applies to all uses of this term in this application, including in any claims. As another example, as used in this application, the term circuitry also covers an implementation of merely a hardware circuit or processor (or multiple processors) or a portion of a hardware circuit or processor and its (or its) accompanying software and / or firmware. The term circuitry also covers (for example, and if applicable to a particular claim element) a baseband integrated circuit or processor integrated circuit for a mobile device or a similar integrated circuit in a server, a cellular network device, or other computing or network device.

[0044] Communications in network 100 may conform to any suitable standard, including but not limited to Long Term Evolution (LTE), LTE Evolution, LTE-Advanced (LTE-A), Wideband Code Division Multiple Access (WCDMA), Code Division Multiple Access (CDMA), and Global System for Mobile Communications (GSM). Furthermore, communications may be performed according to any generation of communication protocols currently known or to be developed in the future. Examples of communication protocols include but are not limited to first generation (1G), second generation (2G), 2.5G, 2.75G, third generation (3G), fourth generation (4G), 4.5G, and fifth generation (5G) communication protocols.

[0045] As mentioned above, according to the 3GPP and ITU-T specifications on network slicing management and orchestration, network slicing management mainly includes configuration management, fault management, performance management, billing management, security management and template management (for example, communication service templates, network slice templates and network slice subnet templates).

[0046] Typically, configuration data, fault data, and performance data will be shared or accessed by some participants, such as communication service management on behalf of the communication service provider, network slice management on behalf of the network slice provider, and network slice subnet management on behalf of the network slice subnet provider.

[0047] Figure 1An example system 100 is shown in which example embodiments of the present disclosure may be implemented. System 100 may include vertical market applications 110, which may provide specific requirements for services. Communication service providers 120 may collect the requirements provided by the vertical market applications and organize at least one network slice provider 130 to provide the required services. Network slice providers 130 may also be associated with network slice subnet providers 140.

[0048] The communication service provider 120 may include a management entity referred to as a communication service management function (CSMF) 121. The network slice provider 130 may include a management entity referred to as a network slice management function (NSMF) 131. The network slice subnet provider 140 may include a management entity referred to as a network slice subnet management function (NSSMF) 141.

[0049] In addition, the system may also include network function management entities, such as a network function management function (NFMF) 150 and a virtual network function management (VNFM) 182. NFMF 150 may be associated with virtual network functions (VNFs) 170 and physical network functions (PNFs) 160. VNFM 182 may be associated with a virtual infrastructure management (VIM) 183.

[0050] refer to Figure 1 , an example data flow can be further described as follows. For example, the data is fault management data. The VIM 183 reports virtualized resource alarm data to the VNFM 182. The VNFM sends 182 VNF 170 alarm data related to virtualized resources (mapped to VNF instances, related or not) to the NFMF 150.

[0051] VNF 170 reports virtualization-specific alarm data to VNFM 182. VNF 170 instances report VNF ​​instance application alarm data and virtualization-specific alarm data to NFMF 150. PNF 160 may report alarm data to NFMF 150.

[0052] NFMF 150 sends the following alarm data to NSSMF 140: VNF instance application alarm data and virtualization-specific alarm data, VNF alarm data related to virtualized resources, PNF alarm data, and / or related VNF instance alarm data. NFMF 150 can perform alarm correlation based on the VNF instance alarm data related to virtualized resources and the VNF instance application alarm data, using the same VNF instance identifier. NFMF 150 can report the related VNF instance alarm data to NSSMF 141.

[0053] NSSMF 141 sends the alarm data to NSMF 131. NSSMF 141 may perform alarm correlation based on the network subnet instance alarm data that is correlated with the VNF instance alarm data, using the same network slice subnet instance identifier. NSSMF 141 may report the correlated network slice subnet alarm data to NSMF 131.

[0054] NSMF 131 then sends the alarm data to CSMF 121. NSMF 131 may perform alarm correlation based on the network instance alarm data correlated with the network slice subnet instance alarm data using the same network slice instance identifier. NSMF 131 may report the correlated network slice alarm data to CSMF 121.

[0055] The data flow of fault data is similar to that of performance data, and the data flow of configuration data is the opposite. The description of the data flow of performance data and configuration data is omitted.

[0056] According to the reference Figure 1 In the example described, a communication service instance may include one or more active network slice instances; a network slice instance may include one or more active network slice subnet instances; and a network slice subnet instance may include a set of managed runtime network functions. This means that there are several participants (e.g., communication service providers, network slice providers, network slice subnet providers, software providers, hardware providers) collaborating and working together to provide customized communication services for various vertical market users.

[0057] First, during the operation of a vertical market application, vertical market users can periodically check network slice management data (e.g., performance data, fault data, configuration data) to ensure that the performance and / or availability of communication services meet service level agreements. If service performance is suboptimal or communication services are unavailable, all participants can turn to the network slice management data to find out what happened, how it happened, and who is responsible for the problem. The participant at the fault site may be motivated to tamper with the network slice management data (by adding, removing, or manipulating part or all of the network slice management data) in order to hide its fault. Even worse, the participant at the fault site may attempt to tamper with the network slice management data and create a scenario in which another participant is the primary cause behind the fault and, therefore, responsible for the damage caused. Assuming that network slice management data is generated and stored in each participant's own data center, there are many possibilities for tampering. Therefore, there is a new requirement for all participants to work together and share network management data, especially fault data, to track down the participant responsible when a communication service is unavailable or performing suboptimally.

[0058] Secondly, according to the existing 3GPP & ITU-T specifications on network slice management and organization, it is mentioned that only authorized consumers who can act as NFMF, NSSMF, NSMF or CSMF can access the corresponding network slice management data (for example, fault / performance data). However, these specifications do not specify any security countermeasures to address this issue.

[0059] Third, configuration data is sensitive because a skilled attacker can use it to penetrate the network slicing system. In addition, it is very important to verify that the configuration data is defined / created by a trusted party and is not modified or eavesdropped during transportation.

[0060] Some schemes have been proposed to detect data tampering. However, such schemes may not ensure that network slice management data is tamper-proof. These schemes may require an intermediary, known as a third-party auditor, to verify the integrity of the data and send an integrity report to the user. This means that trust in a third party or central authority is still required.

[0061] Therefore, embodiments of the present disclosure propose a data security method for network slice management. Once data is generated by a data generator, its attributes can be recorded / published in the blockchain-based management entity. If a data user wishes to inspect the data, they may request the data attributes from the management entity and the data from the data generator. Based on the data attributes, the data user can verify the integrity of the data.

[0062] As used herein, the term "management entity" refers to any component, module, or node in the network management side, which can be referred to as a management function, element manager, network manager, or domain manager as defined in 3GPP SA5. The management entity can define managed service information object classes (managed service IOCs) and establish associations between managed service IOCs and network function (NF) services on the network side. Alternatively, the term "management entity" can also refer to a service module embedded in the network side that can manage the network.

[0063] As used herein, the term "service provider" can refer to a network operator or a network entity. For example, for a communication service provider, a network slice provider, a network slice subnet provider, and a network infrastructure provider, the term "service provider" can be a network operator. For network slice management, the NSMF serves as an example of a network slice management service provider, while the CSMF serves as an example of a network slice management service consumer. In this context, the term "service provider" can be a network entity.

[0064] The following will refer to Figure 2Describe the principles and implementation of the present disclosure in detail. Figure 2 A schematic diagram of a data security process 200 for network slice management is shown. For the purpose of discussion, reference will be made to Figure 1 Process 200 is described.

[0065] exist Figure 2 In the example, service providers 210 and service consumers 230 may be referred to as Figure 1 The service provider 210 and the service consumer 230 may be multiple functions or entities in the service provider 210, depending on the type of data and the corresponding direction of data flow. For example, if the data is performance data or fault data, the service provider 210 and the service consumer 230 may be the NSMF 131 and the CSMF 121, the NSSMF 141 and the NSMF 131, and the NFMF 150 and the NSSMF 141, respectively. If the data is configuration data, the service provider 210 and the service consumer 230 may be the CSMF 121 and the NSMF 131, the NSMF 131 and the NSSMF 141, and the NSSMF 141 and the NFMF 150, respectively.

[0066] Hereinafter, the service provider 210 may also be referred to as a first device 210 or a data generator, and the service consumer 230 may also be referred to as a third device 230 or a data user. The plurality of functions or entities described above may include corresponding modules that generate / operate various types of data.

[0067] As described above, management entity 220 can be a management node on the network management side. Hereinafter, management entity 220 may also be referred to as second device 220. The logical function "blockchain-based fault / performance / configuration data management" is introduced into management entity 220. Because the amount of fault / performance data managed by network slices is too large to be stored in the ledger / blockchain, and because configuration data / parameters are sensitive and should not be publicly stored in the ledger / blockchain, some attributes of the fault / performance / configuration data can be collected and stored in the ledger / blockchain, while the original fault / performance / configuration data can be collected and stored in other data entities. If the original fault / performance / configuration data is modified intentionally or unintentionally, the modification will be detected using the corresponding attributes stored in the ledger / blockchain.

[0068] This logical function, "blockchain-based fault / performance / configuration data management," can be deployed on the server side. It can be deployed on the same host as communication service management or network slice management. This logical function manages the registration of fault / performance / configuration data generators and data users. The unique identifier of a data generator or data user includes their public key and other parameters. Data generators and data users should maintain their own private keys.

[0069] This logical function can store a ledger / block containing attributes of fault / performance / configuration data. This logical function, "Blockchain-based Fault / Performance / Configuration Data Management," has the capabilities of a full node that maintains a complete copy of the blockchain. Furthermore, this logical function, "Blockchain-based PM / FM / CM Data Management," can act as a blockchain node and create new blocks / ledgers.

[0070] Furthermore, this logic function can authorize a data user to access the requested fault / performance / configuration data. This logic function has the ability to authenticate a data user requesting access to fault / performance / configuration data. This logic function can check whether the data user is authorized to access the requested fault / performance / configuration data. This logic function also has the ability to generate an "access token" that the data user can use to access the requested fault / performance / configuration data.

[0071] Accordingly, some logical functions are introduced into the service provider 210 and the service consumer 230. For example, the logical function "data attributes published to the chain" and the logical function "data access control" can be introduced into the service provider 210.

[0072] The "Publish Data Attributes to Chain" logic function collects attributes of performance, fault, and configuration data and sends these attributes to a blockchain node, which then generates a new block or ledger. The blockchain node aggregates the attributes, creates a new block or ledger, and then publishes the new block or ledger to the chain. How to build a blockchain node is beyond the scope of this document.

[0073] The "Data Access Control" logic function verifies the "Access Token" generated by the "Blockchain-based Fault / Performance / Configuration Data Management" logic function. If the verification is successful, the requested data will be sent to the data user.

[0074] For example, a logic function "data integrity check" may be introduced into the service consumer 230, and the service consumer 230 may use the value of data hash (data_hash) to check whether fault / performance / configuration data has been tampered with.

[0075] Furthermore, to ensure the security of configuration data during transmission, a "data encryption" logic function can be introduced into the service provider 210, and a "data decryption" logic function can be introduced into the service consumer 230. The "data encryption" logic function can encrypt configuration data before sending it to the data user. The "data decryption" logic function can decrypt the ciphertext configuration data after receiving it from the data generator.

[0076] Hereinafter, an example of a process 200 for data security will be described in detail below. Figure 2 As shown, the service provider 210 may generate 202 data associated with the service provided by the service provider 210 and, at the same time, generate entries of attributes of the data. The entries of the data attributes may have a predefined format. For example, an example of attributes for inputting fault / performance data may be represented as follows.

[0077] Table 1: Attributes of fault / performance data generated by NSMF 131 and used by CSMF 121

[0078]

[0079]

[0080] The attributes in Table 1 are defined as follows:

[0081] Data index (data_index): an identifier indicating the index of the fault / performance / configuration data attribute. Fault / performance / configuration data is used for fault / performance / configuration management in CSMF (Communication Service Management Function).

[0082] Data type (data_type): A flag indicating the data type of fault / performance / configuration data used for performance management, fault management (eg, alarm data), and configuration management.

[0083] Data Generator (data_generator): includes the public key of the network slice provider and the identity of the corresponding / serving network slice instance. This means that the fault / performance data is generated by and / or collected from the corresponding / serving network slice instance. This field data_generator can be divided into two subfields, namely the public key of the network slice provider and the identity of the corresponding / serving network slice instance.

[0084] Data user (data_user): an identifier including the public key of the communication service provider and the identifier of the corresponding / serving communication service instance. The field data user can be divided into two subfields, namely the public key of the communication service provider and the identifier of the corresponding / serving communication service instance. For configuration management, the above two field data generators and data users exchange roles. That is, the field data generator of the configuration data is an identifier including the public key of the communication service provider and the identifier of the corresponding / serving communication service instance; and the file data user of the configuration data is an identifier including the public key of the network slice provider and the identifier of the corresponding / serving network slice instance. In addition, the data user can be a group of network slice instances. This means that the configuration data can be applied to one or more collaborative network slice instances.

[0085] Timestamp: The time when the fault / performance / configuration data attribute is collected or generated.

[0086] Data storage location (data_storage_location): The location where fault / performance / configuration data is stored, which can be a file, a database table, or an entry in a table.

[0087] Data hash (data_hash): The hash value of the fault / performance / configuration data and its corresponding attributes.

[0088] Signature: This signature is generated using the attribute generator's private key. This means that for fault / performance data, the signature is generated using the network slice provider's private key. For configuration data, the signature is generated using the communication service provider's private key.

[0089] Furthermore, another example of attributes for inputting fault / performance data can be expressed as follows.

[0090] Table 2: Properties of fault / performance data generated by NSSMF141 and used by NSMF131

[0091]

[0092] The attributes in Table 2 are defined as follows:

[0093] Data index (data_index): indicates the index of the fault / performance / configuration data attribute. The fault / performance / configuration data is used for fault / performance / configuration management in the NSMF (Network Slice Management Function).

[0094] Data type (data_type): A flag indicating the data type of fault / performance / configuration data used for performance management, fault management (eg, alarm data), and configuration management.

[0095] Data Generator (data_generator): includes the public key of the network slice subnet provider and the identity of the corresponding / serving network slice subnet instance. This means that the fault / performance data is generated by and / or collected from the corresponding / serving network slice subnet instance. The field data_generator can be divided into two subfields, namely the public key of the network slice subnet provider and the identity of the corresponding / serving network slice subnet instance.

[0096] Data user (data_user): an identifier including the public key of the network slice provider and the identifier of the corresponding / serving network slice instance. The field data user can be divided into two subfields, namely the public key of the network slice provider and the identifier of the corresponding / serving network slice instance. For configuration management, the above two field data generators and data users exchange roles. That is, the field data generator of the configuration data is an identifier including the public key of the network slice provider and the identifier of the corresponding / serving network slice instance; and the file data user of the configuration data is an identifier including the public key of the network slice subnet provider and the identifier of the corresponding / serving network slice subnet instance. In addition, the data user can be a group of network slice subnet instances. This means that the configuration data can be applied to one or more collaborative network slice subnet instances.

[0097] Timestamp: The time when the fault / performance / configuration data attributes are collected.

[0098] Data storage location (data_storage_location): The location where fault / performance / configuration data is stored, which can be a file, a database table, or an entry in a table.

[0099] Data hash (data_hash): The hash value of the fault / performance / configuration data and its corresponding attributes.

[0100] Signature: This signature is generated using the attribute generator's private key. This means that for fault / performance data, the signature is generated using the network slice subnet provider's private key. For configuration data, the signature is generated using the network slice provider's private key.

[0101] It should be understood that the attributes of fault / performance / configuration data operated and managed in NSSMF / NFMF may also be defined in the same manner as the attributes defined in Table 1 and Table 2, which will not be shown in this specification.

[0102] Return Reference Figure 2 , the logical function “Publish Data Attributes to Chain” of the service provider 210 publishes 204 at least one entry of the data attributes to the management entity 220. The service provider 210 may send the at least one entry periodically or a predetermined number of entries to the management entity 220.

[0103] The logical function "Blockchain-based PM / FM / CM Data Management" of management entity 220 may collect data attributes from at least one entry and store 206 the attributes in the blockchain. For example, management entity 220 may receive entry 1 and entry 2, each representing attributes of data 1 and data 2, respectively. Management entity 220 may aggregate the attributes of data 1 and data 2 and create a block to store the attributes of data 1 and data 2. Management entity 220 may also publish the new block to the blockchain.

[0104] Figure 3 A schematic diagram illustrating an example structure of a block in a blockchain according to some example embodiments of the present disclosure is shown. Block 300 may include a header 310 and a transaction 320. Header 310 may indicate some attributes associated with block 300, such as the hash of the previous block and the hash of the current block. As described above, transaction 320 may store attributes of data, such as attributes of data 1 and attributes of data 2.

[0105] Reference again Figure 2 If the service becomes worse or the operation of the service fails, the service consumer 230 may be triggered to check the data provided by the service provider 210. The service consumer 230 may send 208 a request for accessing data attributes, ie, an "attribute access request" message, to the management entity 220.

[0106] The request for accessing data may include the public key of the service consumer 230 and the public key of the service provider 210. In addition, the request for accessing data may also include the type of data that the service consumer 230 desires to inspect and the time when the data was generated or collected.

[0107] The "Blockchain-Based PM / FM / CM Data Management" logical function of management entity 220 may authenticate service consumer 230 using its public key and then check whether the data user list includes the requested service consumer 230. If the requested service consumer 230 is successfully authenticated and is in the data user list, the "Blockchain-Based PM / FM / CM Data Management" logical function of management entity 220 may generate an "Access Token." The "Blockchain-Based PM / FM / CM Data Management" logical function of management entity 220 then sends 212 an "Attribute Access Response" message to service consumer 230. This response message may include the data storage location "Data Storage Location," a hash value of the original data "Data Hash," and the access token "Access Token."

[0108] After receiving the "attribute access response" message from the management entity 220, the service consumer 230 sends 214 a request for accessing the data, i.e., a "data access request" message, to the service provider 210 in order to access the data. The request message may include the public key of the service consumer 230, the data storage location "data storage location" at the service provider 210, and the access token "access token".

[0109] After receiving the "Data Access Request" message from service consumer 230, service provider 210 may verify the "Access Token." If the "Access Token" is valid, the "Data Access Control" logic function of service provider 210 may cause service provider 210 to send a "Data Access Response" message back to service consumer 230. Service provider 210 then sends 216 a response message including the requested data. Here, the data may refer to performance data or fault data. Requesting configuration data will be described later.

[0110] After receiving the requested raw performance data or raw fault data, the logic function "Data Integrity Check" of the service consumer 230 may check 218 the integrity of the data. The service consumer 230 may calculate a hash value of the received raw data and compare the calculated hash value with the hash value "Data Hash" received from the management entity 220. If the two hash values ​​are equal, the raw performance data or fault data has not been tampered with.

[0111] As described above, to ensure the security of configuration data in transit, a logical function "data encryption" can be introduced into the service provider 210, and a logical function "data decryption" can be introduced into the service consumer 230. In some example embodiments, the service provider 210 notifies the service consumer 230 to obtain new and / or updated configuration data to be set / configured into the network slice instance. In this way, the network slice instance can provide communication services according to the requirements from the communication service provider. The notification message includes the location of the attributes of the configuration data in the chain.

[0112] When requesting configuration data, if the service provider 210 determines that the "access token" is valid, the service provider 210 sends a "data access response" message back to the service consumer 230. This response message includes the encrypted raw configuration data and the encrypted session key. The raw configuration data is encrypted using the session key by the "data encryption" logic function of the service provider 210. The session key is generated by the "data encryption" logic function and encrypted by the "data encryption" logic function using the public key of the service consumer 230.

[0113] After receiving the "Data Access Response" message, the "Data Decryption" logic function of Service Consumer 230 uses the public key of Service Consumer 230 to obtain the plaintext session key (session_key). It then uses the session key to retrieve the plaintext original configuration data. The "Data Integrity Check" logic function of Service Consumer 230 calculates a hash value for the obtained original configuration data and compares the calculated hash value with the hash value "Data Hash." If the two hash values ​​are equal, the original configuration has not been tampered with.

[0114] In this way, service consumers can detect data tampering. In addition, it can be guaranteed that only authorized data users can access raw performance data, raw fault data, or configuration data.

[0115] Figure 4 A flow chart of an example method 400 for data security for network slice management according to some example embodiments of the present disclosure is shown. The method 400 may be used in Figure 2 For the purpose of discussion, reference will be made to the service provider 210. Figure 2 Method 400 is described.

[0116] like Figure 4 As shown, at 410 , the service provider 210 sends at least one entry associated with attributes of data generated by the service provider 210 to the service consumer 230 .

[0117] In some example embodiments, these attributes include at least one of the following: an index of the data, a type of the data, an identifier of the service provider 210 , an identifier of the service consumer 230 , a timestamp of the generation of the entry, a storage location of the data, an original hash value of the data, or a signature of the service provider 210 .

[0118] At 420 , if a request for accessing data is received from the service consumer 230 , the service provider 210 determines whether the service consumer has authority for accessing the data based on the request.

[0119] In some example embodiments, the request for accessing the data includes at least one of: a public key of the service consumer 230 , a storage location of the data at the service provider 210 , and an access token for accessing the service provider's data.

[0120] In some example embodiments, the service provider 210 may obtain an access token for accessing the data from the request. The service provider 210 may determine the validity of the access token. Based on the determined validity of the access token, the service provider 210 may determine that the service consumer has permission to access the data.

[0121] At 430 , if the service provider 210 determines that the service consumer has the authority for accessing the data, the service consumer 230 is caused to check the integrity of the data based on the attributes of the data obtained from the management entity 220 .

[0122] In some example embodiments, if the data is associated with a configuration of a network slice provided by the service provider 210, the service provider 210 may obtain the public key of the service consumer 230 from the request, encrypt a session key for data access using the public key, and encrypt the data using the session key. The service provider 210 may also send the encrypted data to the service consumer 230.

[0123] In some example embodiments, the service provider 210 may send data to the service consumer 230 if the data is associated with one of performance and failure of the network slice.

[0124] In some example embodiments, the service provider 210 may generate at least one entry associated with an attribute of the data while generating the data.

[0125] Figure 5 A flow chart of an example method 500 for data security for network slice management according to some example embodiments of the present disclosure is shown. The method 500 may be used in Figure 2 For the purpose of discussion, reference will be made to the management entity 220. Figure 2 Method 500 is described.

[0126] like Figure 5 As shown, at 510 , the management entity 220 receives at least one entry associated with an attribute of data from the service provider 210 .

[0127] In some example embodiments, the attributes include at least one of the following: an index of the data, a type of the data, an identifier of the service provider 210 , an identifier of the service consumer 230 , a timestamp of the generation of the entry, a storage location of the data, an original hash value of the data, or a signature of the service provider 210 .

[0128] At 520 , the management entity 220 stores the attributes of the data in the blockchain.

[0129] In some example embodiments, the management entity 220 may extract the plurality of first attributes of the data from the first entry and extract the plurality of second attributes of the data from the second entry; and aggregate the plurality of first attributes of the data and the plurality of second attributes of the data into at least one block in the blockchain.

[0130] At 530 , the management entity 220 receives a request from the service consumer 230 to access a data attribute.

[0131] In some example embodiments, the management entity 220 may receive at least one of the following: a public key of the service consumer 230 , a public key of the service provider 210 , a type of data, and a time for generating attributes of the data.

[0132] At 540 , if the service consumer 230 has the authority to access the data attribute based on the request, the management entity 220 sends the data attribute from the blockchain to the service consumer 230 .

[0133] In some example embodiments, the management entity 220 may obtain the public key of the service consumer 230 from the request and determine whether the public key of the service consumer 230 is included in the authorized access list at the management entity 220. If the public key of the service consumer 230 is included in the authorized access list, the management entity 220 may also determine the right to access the data attributes of the service consumer 230.

[0134] In some example embodiments, the management entity 220 may send at least one of the following: an access token for accessing data of the service provider 210 , a storage location of the data at the service provider 210 , and an original hash value of the data.

[0135] Figure 6 A flow chart of an example method 600 for data security for network slice management according to some example embodiments of the present disclosure is shown. The method 600 may be used in Figure 2 The service consumer 230 is shown as being implemented. For the purpose of discussion, reference will be made to Figure 2 Method 600 is described.

[0136] like Figure 6 As shown, at 610 , the service consumer 230 sends a request to the management entity 220 to access data attributes.

[0137] In some example embodiments, the service consumer 230 may send at least one of the following: a public key of the service consumer 230 , a public key of the service provider 210 , a type of data, and a time for generating the data.

[0138] In some example embodiments, the service consumer 230 may receive at least one of the following: an access token for accessing data of the service provider 210 , a storage location of the data at the service provider 210 , and an original hash value of the data.

[0139] At 620 , the service consumer 230 generates a request to access the data based at least on the attributes of the data.

[0140] At 630 , the service consumer 230 sends a request to the service provider 210 for access to data.

[0141] In some example embodiments, the service consumer 230 may send at least one of the following: a public key of the service consumer 230 , a storage location of the data at the service provider 210 , and an access token for accessing the data of the service provider 210 .

[0142] At 640 , if the service consumer 230 receives data from the service provider 210 , the service consumer 230 checks integrity of the data based on the attributes.

[0143] In some example embodiments, service consumer 230 may determine a calculated hash value of the data, obtain the original hash value of the data from the attribute, and compare the calculated hash value of the data with the original hash value of the data. If the calculated hash value is equal to the original hash value, service consumer 230 may determine that the data is unmodified.

[0144] In some example embodiments, a device capable of performing method 400 (e.g., implemented at service provider 210) may include means for performing the steps of method 400. The means may be implemented in any suitable form. For example, the means may be implemented in a circuit or a software module.

[0145] In some example embodiments, the device includes: a device for sending at least one entry associated with an attribute of data generated by the first device to a second device; a device for determining, in response to a request for accessing the data received from a third device, whether the third device has permission to access the data based on the request; and a device for causing the third device to check the integrity of the data based on the attribute of the data obtained from the second device in response to determining that the third device has permission to access the data.

[0146] In some example embodiments, a device capable of performing method 500 (e.g., implemented at management entity 220) may include means for performing the corresponding steps of method 500. The means may be implemented in any suitable form. For example, the means may be implemented in a circuit or a software module.

[0147] In some example embodiments, the apparatus includes: means for receiving at least one entry associated with an attribute of the data from a first device; means for storing the attribute of the data in a blockchain; means for receiving a request for access to the attribute of the data from a third device; and means for sending the attribute of the data from the blockchain to the third device in response to determining, based on the request, that the third device has permission to access the attribute of the data.

[0148] In some example embodiments, a device capable of performing method 600 (e.g., implemented at service consumer 230) may include means for performing the corresponding steps of method 600. The means may be implemented in any suitable form. For example, the means may be implemented in a circuit or a software module.

[0149] In some example embodiments, the apparatus includes: means for sending a request for accessing attributes of data to a second device; means for generating a request for accessing the data based at least on the attributes of the data; means for sending a request for accessing the data to a first device; and means for checking the integrity of the data based on the attributes in response to receiving the data from the first device.

[0150] Figure 7 is a simplified block diagram of a device 700 suitable for implementing embodiments of the present disclosure. The device 700 may be provided to implement a communication device, such as Figure 2 Shown are a service provider 210, a management entity 220, and a service consumer 230. As shown, the device 700 includes one or more processors 710, one or more memories 740 coupled to the processor 710, and one or more transmitters and / or receivers (TX / RX) 740 coupled to the processor 710.

[0151] The TX / RX 740 is used for bidirectional communication. The TX / RX 740 has at least one antenna to facilitate communication. The communication interface may represent any interface required to communicate with other network elements.

[0152] Processor 710 may be of any type suitable for the local technology network and may include, by way of non-limiting example, one or more of the following: a general purpose computer, a special purpose computer, a microprocessor, a digital signal processor (DSP), and a processor based on a multi-core processor architecture. Device 700 may have multiple processors, such as application specific integrated circuit chips that are time-slave to a clock that synchronizes a main processor.

[0153] Memory 720 may include one or more non-volatile memories and one or more volatile memories. Examples of non-volatile memories include, but are not limited to, read-only memory (ROM) 724, electrically programmable read-only memory (EPROM), flash memory, hard disks, compact discs (CDs), digital video discs (DVDs), and other magnetic and / or optical storage devices. Examples of volatile memories include, but are not limited to, random access memory (RAM) 722 and other volatile memories that do not persist during a power outage.

[0154] Computer program 730 includes computer-executable instructions executed by associated processor 710. Program 730 may be stored in ROM 720. Processor 710 may perform any suitable actions and processes by loading program 730 into RAM 720.

[0155] The embodiment of the present invention can be implemented with the help of program 730 so that the device 700 can execute the Figures 2 to 6 Any process of the present invention discussed. The embodiments of the present disclosure may also be implemented by hardware or a combination of software and hardware.

[0156] In some embodiments, the program 730 may be tangibly embodied in a computer-readable medium that may be included in the device 700 (such as in the memory 720) or in other storage devices accessible by the device 700. The device 700 may load the program 730 from the computer-readable medium into the RAM 722 for execution. The computer-readable medium may include any type of tangible non-volatile memory, such as ROM, EPROM, flash memory, hard disk, CD, DVD, etc. Figure 8 An example of a computer readable medium 800 in the form of a CD or DVD is shown. The computer readable medium has a program 730 stored thereon.

[0157] In general, various embodiments of the present disclosure may be implemented in hardware or dedicated circuits, software, logic, or any combination thereof. Some aspects may be implemented in hardware, while other aspects may be implemented in firmware or software, which may be executed by a controller, microprocessor, or other computing device. Although various aspects of the embodiments of the present disclosure are shown and described as block diagrams, flow charts, or using some other graphical representations, it should be understood that the blocks, devices, systems, techniques, or methods described herein may be implemented in hardware, software, firmware, dedicated circuits or logic, general-purpose hardware or a controller or other computing device, or some combination thereof, as non-limiting examples.

[0158] The present disclosure also provides at least one computer program product tangibly stored on a non-transitory computer readable storage medium. The computer program product includes computer executable instructions, such as those included in program modules, executed in a device on a target real or virtual processor to perform the above-referenced Figure 2-6 Methods 400-600 are described. Generally speaking, program modules include routines, programs, libraries, objects, classes, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The functionality of program modules can be combined or separated between program modules as needed in various implementations. The machine-executable instructions of program modules can be executed on local or distributed devices. In distributed devices, program modules can be located in local and remote storage media.

[0159] The program code for executing the method of the present disclosure may be written in any combination of one or more programming languages. Such program code may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device so that when the program code is executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are implemented. The program code may be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine, partially on a remote machine, or entirely on a remote machine or server.

[0160] In the context of the present disclosure, computer program codes or related data may be carried by any suitable carrier to enable a device, apparatus or processor to perform various processes and operations as described above. Examples of carriers include signals, computer-readable media, etc.

[0161] The computer readable medium can be a computer readable signal medium or a computer readable storage medium. The computer readable medium can include, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared or semiconductor system, device or apparatus, or any suitable combination of the foregoing. More specific examples of computer readable storage media will include an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0162] In addition, although operations are described in a particular order, this should not be understood as requiring that the operations be performed in the particular order shown or in sequence, or that all of the operations shown be performed, to achieve the desired result. In some cases, multitasking and parallel processing may be advantageous. Similarly, although several specific implementation details have been included in the above discussion, these details should not be interpreted as limiting the scope of this disclosure, but rather as describing features specific to a particular embodiment. Certain features described in the context of a separate embodiment may also be implemented in combination in a single embodiment. On the contrary, the various features described in the context of a single embodiment may also be implemented individually or in any suitable subcombination in multiple embodiments.

[0163] Although the present disclosure has been described in language specific to structural features and / or methodological acts, it should be understood that the present disclosure defined in the appended claims is not necessarily limited to the specific features or acts described above. Instead, the specific features and acts described above are disclosed as example forms of implementing the claims.

Claims

1. A second device, comprising: at least one processor; as well as at least one memory including computer program code; The at least one memory and the computer program code are configured to, together with the at least one processor, cause the second device to at least: receiving, from the first device, at least one entry associated with an attribute of data; Storing the attributes of the data in a blockchain; receiving, from a third device, a request to access the attribute of the data; as well as In response to determining that the third device has permission to access the attribute of the data based on the request, sending the attribute of the data from the blockchain to the third device.

2. The second device according to claim 1, wherein the attribute comprises at least one of the following: The index of the data, the type of data, an identification of the first device, an identification of the third device, a timestamp of the creation of the entry, the storage location of said data, the original hash value of said data, or A signature of the first device.

3. The second device of claim 1 , wherein the at least one entry comprises a first entry and a second entry, and wherein the second device being caused to store the attribute of the data in the blockchain further comprises: extracting a plurality of first attributes of the data from the first entry, and extracting a plurality of second attributes of the data from the second entry; as well as Aggregating the plurality of first attributes of the data and the plurality of second attributes of the data into at least one block in the blockchain.

4. The second device of claim 1 , wherein the second device is caused to receive the request for accessing the attribute of the data by receiving at least one of: the public key of the third device, a public key of the first device, the type of data in question, and The time when the data was generated.

5. The second device according to claim 1, wherein the second device is further configured to: obtaining a public key of the third device from the request; determining whether the public key of the third device is included in an authorized access list at the second device; and Responsive to the public key of the third device being included in the authorized access list, permissions for the third device to access the attribute of the data are determined.

6. The second device of claim 1 , wherein the second device is caused to send the attribute of the data by sending at least one of: an access token for accessing said data of said first device, the storage location of the data at the first device, and The original hash value of the data. 7 . The second device of claim 1 , wherein the first device is a service provider, the second device is a management entity, and the third device is a service consumer.

8. A first device, comprising: at least one processor; as well as at least one memory including computer program code; The at least one memory and the computer program code are configured to, together with the at least one processor, cause the first device to at least: sending at least one entry to a second device, the at least one entry being associated with an attribute of data generated by the first device; In response to a request for accessing the data received from a third device, determining whether the third device has permission to access the data based on the request; as well as In response to determining that the third device has the authority to access the data, causing the third device to check integrity of the data based on the attribute of the data obtained from the second device.

9. The first device according to claim 8, wherein the attribute comprises at least one of the following: The index of the data, the type of data, an identification of the first device, an identification of the third device, a timestamp of the creation of the entry, the storage location of said data, the original hash value of said data, or A signature of the first device.

10. The first device of claim 8, wherein the request for access to the data comprises at least one of: the public key of the third device, the storage location of the data at the first device, and An access token for accessing the data of the first device.

11. The first device of claim 8, wherein the first device being caused to determine whether the third device has authority to access the data further comprises: obtaining from the request an access token for accessing the data; as well as In response to determining the validity of the access token, it is determined that the third device has permission to access the data.

12. The first device of claim 8, wherein the data is associated with a configuration of a service provided by the first device, wherein the first device being caused to cause the third device to check the integrity of the data further comprises: obtaining a public key of the third device from the request; encrypting a session key for accessing the data using the public key; encrypting the data using the session key; as well as The encrypted data is sent to the third device.

13. The first device of claim 8, wherein the data is associated with one of a performance and a failure of a service provided by the first device, wherein the first device being caused to cause the third device to check integrity of the data further comprises: The data is sent to the third device.

14. The first device according to claim 8, wherein the first device is further caused to: The at least one entry associated with the attribute of the data is generated while the data is being generated.

15. The first device of claim 8, wherein the first device is a service provider, the second device is a management entity, and the third device is a service consumer.

16. A third device, comprising: at least one processor; as well as at least one memory including computer program code; The at least one memory and the computer program code are configured to, together with the at least one processor, cause the third device to at least: sending a request to the second device to access the attribute of the data; generating a request for access to the data based at least on the attribute of the data; sending the request for accessing the data to the first device; as well as In response to receiving the data from the first device, integrity of the data is checked based on the attribute.

17. The third device of claim 16, wherein the third device is caused to send the request for accessing the attribute of the data by sending at least one of: the public key of the third device, a public key of the first device, the type of data in question, and The time when the data was generated.

18. The third device of claim 16, wherein the third device is further caused to receive at least one of the following from the second device: an access token for accessing said data of said first device, the storage location of the data at the first device, and The original hash value of the data.

19. The third device of claim 16, wherein the third device is caused to send the request for access to the data by sending at least one of: the public key of the third device, the storage location of the data at the first device, and An access token for accessing the data of the first device.

20. The third device according to claim 16, wherein the third device being caused to check the integrity of the data further comprises: determining a calculated hash value of the data; Obtaining a raw hash value of the data from the attribute; comparing the calculated hash value of the data with the original hash value of the data; as well as In response to determining that the calculated hash value is equal to the original hash value, it is determined that the data has not been modified.

21. The third device of claim 16, wherein the first device is a service provider, the second device is a management entity, and the third device is a service consumer.

Images