Method and apparatus for mitigating service unavailability risk during CA migration

Abstract

Methods and apparatus for mitigating the risk of service unavailability during migration of a certificate authority (CA) for a communication network are disclosed. In one embodiment, a method includes causing creation of a first set of network function instances using a new root certificate updated in a migration of a certificate authority (CA), the first set of network function instances being redundant for a second set of network function instances in which respective certificates for the second set of network function instances are to be updated in the migration of the CA; and causing a service served by the second set of network function instances to be transferred to the first set of network function instances.

Description

Technical Field

[0001] Embodiments of the present disclosure relate generally to security and availability of communication networks, and more particularly, to methods and apparatus for mitigating the risk of service unavailability during Certificate Authority (CA) migration for a communication network. Background Art

[0002] In order to ensure secure communication between various network functions of a communication network, protocols for security are used, such as TLS, IPSEC, SSH, etc. The establishment of a secure connection for many of these protocols requires the exchange of digital certificates between the network entities involved in the communication.

[0003] Digital certificates are used worldwide to establish trust and optionally for authentication between various network entities. Certificate authorities provide these certificates with specific expiration dates. Also, various encryption and hashing algorithms are used for secure connection establishment. Digital certificates include information about these algorithms to be used, as well as a public key used by peer entities to verify the authenticity of the certificate.

[0004] Public Key Infrastructure (PKI) manages the issuance of digital certificates, provides unique digital identities for users, devices, and applications, and protects communications between various network entities. For example, a PKI migration may be required due to a change in the CA of the PKI, or the expiration / revocation of the CA's root certificate(s).

[0005] During the PKI migration process, especially the CA migration process, the applications or services protected by the PKI may be affected. For example, since the old digital certificates used for these applications or services need to be updated with the new CA root certificate, these applications or services may be interrupted or unavailable. Summary of the invention

[0006] This summary is provided to introduce a simplified concept of methods and apparatus for mitigating the risk of service unavailability during PKI migration. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

[0007] According to a first aspect of the present disclosure, a first device is provided. The first device includes: at least one processor; and at least one memory storing instructions, which, when executed by one or more processors, cause the device to at least: cause creation of a first group of network function instances using a new root certificate updated in a migration of a certificate authority (CA), the first group of network function instances being redundant for a second group of network function instances, wherein corresponding certificates for the second group of network function instances will be updated in the migration of the CA; and cause services served by the second group of network function instances to be transferred to the first group of network function instances.

[0008] According to a second aspect of the present disclosure, a method is provided. The method includes: causing creation of a first set of network function instances using a new root certificate updated in a CA migration, the first set of new network function instances being redundant for a second set of network function instances, wherein corresponding certificates for the second set of network function instances will be updated in the CA migration; and causing services served by the second set of network function instances to be transferred to the first set of network function instances.

[0009] According to a third aspect of the present disclosure, a device implemented at a network slice management function (NSMF) is provided. A first device includes: at least one processor; and at least one memory storing instructions, which, when executed by one or more processors, cause the device to at least: send a request to a network slice subnet management function (NSSMF) for creating a first network slice subnet instance using a new root certificate updated in a CA migration, the first network slice subnet instance being redundant for a second network slice subnet instance, wherein a corresponding certificate for a second group of network function instances deployed in the second network slice subnet instance will be updated in the CA migration.

[0010] According to a fourth aspect of the present disclosure, a method performed by an NSMF is provided. The method includes: sending a request to the NSSMF for creating a first network slice subnet instance using a new root certificate updated in a CA migration, the first network slice subnet instance being redundant for a second network slice subnet instance, wherein corresponding certificates for a second group of network function instances deployed in the second network slice subnet instance will be updated in the CA migration.

[0011] According to a fifth aspect of the present disclosure, a device implemented at a network slice subnet management function (NSSMF) is provided. The first device includes: at least one processor; and at least one memory storing instructions, which, when executed by one or more processors, cause the device to at least: receive a request from the NSMF to create a first network slice subnet instance, the first network slice subnet instance being redundant for a second network slice subnet instance, wherein the corresponding certificates of the second group of network function instances deployed in the second network slice subnet instance will be updated in the migration of the CA; in response to the request, create the first network slice subnet instance using the new root certificate updated in the migration of the CA; and cause the services served by the second group of network function instances to be transferred to the first group of network function instances deployed in the first network slice subnet instance.

[0012] According to a sixth aspect of the present disclosure, a method performed by NSSMF is provided. The method includes: receiving a request from NSMF to create a first network slice subnet instance, the first network slice subnet instance is redundant for a second network slice subnet instance, wherein the corresponding certificate of the second group of network function instances deployed in the second network slice subnet instance will be updated in the migration of CA; in response to the request, creating the first network slice subnet instance using the new root certificate updated in the migration of CA; and causing the service served by the second group of network function instances to be transferred to the first group of network function instances deployed in the first network slice subnet instance.

[0013] According to a seventh aspect of the present disclosure, a computer-readable storage medium is provided, on which instructions are stored. When executed by a device, the instructions cause the device to execute any one of the methods according to the second aspect, the fourth aspect and the sixth aspect. According to a fourth aspect of the present disclosure, a computer program product is provided, comprising instructions, which, when executed by a device, cause the device to perform any one of the methods according to the second aspect, the fourth aspect and the sixth aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Some example embodiments will now be described with reference to the accompanying drawings, in which:

[0015] Figure 1 A high-level view of an exemplary system protected by PKI is shown;

[0016] Figure 2 is a logic flow diagram depicting a method according to an embodiment of the present disclosure;

[0017] Figure 3 shows an end-to-end message flow of an exemplary process according to an embodiment of the present disclosure;

[0018] Figure 4 is a logic flow diagram depicting a method according to an embodiment of the present disclosure;

[0019] Figure 5 is a logic flow diagram depicting a method according to an embodiment of the present disclosure; and

[0020] Figure 6 A simplified block diagram of an apparatus according to an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0021] Some example embodiments will now be described more fully hereinafter with reference to the accompanying drawings, in which some but not all embodiments are shown. Indeed, example embodiments may take many different forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided so that this disclosure will satisfy applicable legal requirements. Like reference numerals refer to like elements throughout.

[0022] Abbreviations that may be found in the specification and / or drawings are defined at the end of the following detailed description section.

[0023] In the following description and claims, unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs.

[0024] References in this disclosure to "one embodiment," "an embodiment," "an example embodiment," etc. indicate that the described embodiment may include a particular feature, structure, or characteristic, but not every embodiment necessarily includes the particular feature, structure, or characteristic. Furthermore, such phrases do not necessarily refer to the same embodiment. Furthermore, when a particular feature, structure, or characteristic is described in conjunction with an example embodiment, it is claimed that it is within the knowledge of those skilled in the art to affect such feature, structure, or characteristic in relation to other embodiments, whether or not explicitly described.

[0025] It should be understood that, although the terms "first" and "second" etc. may be used herein to describe various elements, these elements should not be limited to these terms. These terms are only used to distinguish one element from another element. For example, a first element may be referred to as a second element, and similarly, a second element may be referred to as a first element without departing from the scope of the exemplary embodiments. As used herein, the term "and / or" includes any and all combinations of one or more of the listed terms.

[0026] As used herein, the phrase "at least one of A and B" or "at least one of A or B" should be understood to mean "only A, only B, or both A and B". The phrase "A and / or B" should be understood to mean "only A, only B, or both A and B".

[0027] The terms used herein are only used for the purpose of describing specific embodiments and are not intended to limit the exemplary embodiments. As used herein, the singular forms "a", "an" and "the" are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the terms "include", "comprises", "has", "has", "includes" and / or "comprising" are used herein to indicate the presence of the features, elements and / or components, etc., but do not exclude the presence or addition of one or more other features, elements, components and / or combinations thereof.

[0028] As used in this application, the term "circuitry" may refer to one, more, or all of the following: (a) hardware circuit implementation only (such as implementation only in analog and / or digital circuits), and (b) a combination of hardware circuitry and software such as (if applicable): (i) a combination of analog and / or digital hardware circuitry and software / firmware, and (ii) any portion of a hardware processor with software (including a digital signal processor, software and memory that work together to enable a device such as a mobile phone or server to perform to perform various functions); and (c) Hardware circuits and / or processors, such as a microprocessor or portion of a microprocessor, that require software (e.g., firmware) for operation, but the software may not be present when not required for operation.

[0029] This definition of "circuitry" applies to all uses of the term in this application, including any claims. As another example, as used in this application, the term "circuitry" also covers an implementation of only a hardware circuit or processor (or multiple processors) or a portion of a hardware circuit or processor and its (or its) accompanying software and / or firmware. The term "circuitry" also covers, for example and if applicable to a particular claim element, a baseband integrated circuit or processor integrated circuit for a mobile device or a similar integrated circuit in a server, cellular network device, or other computing or network device.

[0030] As used herein, the term "communication network" refers to a network that complies with any suitable communication standard, such as Long Term Evolution (LTE), Advanced LTE (LTE-A), Wideband Code Division Multiple Access (WCDMA), High Speed ​​Packet Access (HSPA), Narrowband Internet of Things (NB-IoT), New Radio (NR), etc. In addition, the communication between two communication entities in one or more communication networks can be performed according to any suitable generation communication protocol, including but not limited to the fifth generation (5G), the future sixth generation (6G) communication protocol and / or any other protocol currently known or developed in the future. The embodiments of the present disclosure can be applied to various communication systems. In view of the rapid development of communication, there will certainly be future types of communication technologies and systems that can embody the present disclosure. It should not be considered that the scope of the present disclosure is limited to the aforementioned system.

[0031] As described above, during the PKI migration process, especially the CA migration process, the applications or services protected by the PKI (or CA) may be affected. As used herein, "PKI migration", "PKI migration", "CA migration" or "CA migration" refers to any change in the CA that causes a change or update of the root certificate of the CA in the PKI system. For example, the change of the CA may be a change in the root CA that provides the root certificate of the root CA, a change in the sub-CA that provides the certificate of the sub-CA, the expiration / revocation of the root certificate, or other CA changes in the PKI system.

[0032] A root certificate is a public key certificate belonging to a root CA and is the starting point of the trust chain in a PKI system. The root certificate is used to issue and verify one or more CA certificates. The CA certificate is then used to issue or sign other certificates (such as X.509 certificates), thereby forming a trusted trust chain. When the root certificate needs to be updated, all certificates issued or signed by the root certificate (directly or indirectly) also need to be updated accordingly with the updated root certificate (also called the new root certificate). Then, the applications or services protected by these certificates may be interrupted or unavailable.

[0033] In some PKI systems, there are one or more sub-CAs signed with the root certificate of the root CA. The sub-CA certificates are in turn used to issue or sign other certificates for various applications and services. In this scenario, during the renewal of the sub-CA certificates, the applications or services protected by the sub-CA certificates may be interrupted or unavailable. From the perspective of the trust chain for these applications or services, the certificates of the sub-CAs can also be regarded as "root certificates".

[0034] Figure 1 A high-level view of an exemplary system protected by PKI is shown. For example, one or more root CAs may be deployed in a platform that hosts one or more network functions (NFs), such as a Kubernetes platform or a cloud computing system (e.g., a cloud hosting environment). The NF may be a containerized network function (CNF), a virtualized network function (VNF), etc. Figure 1 As shown, two root CAs (represented as root CA1 and root CA2, respectively) are deployed in the Kubernetes platform or cloud host environment 110. The root certificates provided by the corresponding root CAs can be used to issue or sign certificates for various application groups.

[0035] An application group may include a collection of one or more network functions (or NF instances) supported / hosted by a Kubernetes platform or cloud host environment 110, for example, to provide a specific type of application or service. For example, an application group (denoted as 120) may be used to provide video communications, while another application group (denoted as 130) may be used to provide non-real-time communications. In some embodiments, an application group may be a network slice, such as a core network slice of a 5GC SBA. In 5GC SBA, digital certificates are used for mutual authentication between NF service producers and consumers. Figure 1 In the example of FIG. 1 , the digital certificate used for application group 1 120 is directly issued or signed by root CA1 112, or indirectly issued or signed by a certificate issued or signed by root CA1 112. The digital certificate used for application group 1 120 is a certificate of the corresponding NF instance, collectively referred to as 122. Similarly, the digital certificate used for application group 2 130 is directly issued or signed by root CA2 114, or indirectly issued or signed by a certificate issued or signed by root CA2 114.

[0036] exist Figure 1 In the example of , during the PKI migration process, if the root certificate of root CA1 112 needs to be updated, the applications or services in application group 1 120 will be affected. For example, the certificates issued or signed by root CA1 112 (directly or indirectly) to the NF of application group 1 120 will need to be signed by using the new root certificate of root CA1. If the root certificate of root CA2 114 needs to be updated, the applications or services in application group 2 130 will be affected. For example, the certificates issued or signed by root CA2 114 (directly or indirectly) to the NF of application group 2 130 will need to be signed by using the new root certificate of root CA2. If the root certificates of both root CA1 112 and root CA2 114 need to be updated, all applications or services in application group 1 120 and application group 2 130 will be affected.

[0037] This may result in unavailability of applications or services provided by the corresponding application group. For example, in the case where the application group is a network slice, this may result in unavailability of the slice. During the CA migration process, some CNFs may be processing user plane functions and some CNFs may be processing various control plane functions. If all CNFs and / or VNFs serving a network slice use the same root CA, there is a risk of unavailability of the entire slice. In addition, partial unavailability of a service may still appear as network unavailability for end users.

[0038] To address these and other issues, and as an overview, the present disclosure proposes a method for mitigating the risk of service unavailability during CA migration. The exemplary proposal herein includes: creating a new instance of the affected NF by using the updated root certificate, and transferring the service to the new instance. In this way, the service can be seamlessly transferred to the new instance without being affected by the CA migration (change of the root certificate). When the service is successfully transferred to the new instance, the old instance of the affected NF can be terminated.

[0039] Figure 2 is a logic flow diagram depicting a method according to an embodiment of the present disclosure. Figure 2 The operations of one or more exemplary methods according to exemplary embodiments, the results of execution of computer program instructions embodied on a computer readable memory, functions performed by logic implemented in hardware, and / or interconnected components for performing functions are shown.

[0040] In some embodiments, assuming Figure 2 The boxes in are executed by a functional entity for managing network functions deployed in a communication network according to the present disclosure. In an example, the functional entity may be a network management function, such as a network slice management function (NSMF) or a network slice subnet management function (NSSMF), which is extended with new capabilities to provide functions for mitigating the risk of service unavailability during the CA migration process, as disclosed in the present disclosure. The functions of the functional entity may be discretely distributed in the NSMF and the NSSMF. In another example, the functional entity may be a separate network security entity, which is introduced to be responsible for mitigating the risk of service unavailability during the CA migration process as disclosed in the present disclosure. The functional entity may rely on the network slice management capabilities of the NSMF and the network slice subnet management capabilities of the NSSMF.

[0041] In block 210, the functional entity causes the creation of a first set of network function (NF) instances using a new root certificate updated in a migration of the CA, the first set of NF instances being redundant for a second set of NF instances. Wherein the corresponding certificates for the second set of network function instances will be updated in the migration of the CA. The NF instances of the second set are old instances of NFs that have been deployed and used. The corresponding certificates for the second set of NF instances will be updated in the CA migration. The CA migration includes the update of the root certificate used to sign each old NF instance. Therefore, these old NF instances will be affected by the CA migration. The redundant first set of NF instances can serve as a backup for the second set of NF instances. In this regard, for each old NF instance, there is a corresponding redundant NF instance to be created.

[0042] In some embodiments, causing the creation of a first set of network function instances may include sending a request to another functional entity to create a first set of NF instances. For example, the request may be sent from a network slice selection function (NSMF) to a network slice subnet management function (NSSMF). In other embodiments, causing the creation of a first set of new network function instances may include creating a first set of network function instances.

[0043] In some embodiments, causing the creation of the first set of new network function instances may include causing each network function instance in the first set of network function instances to be signed using a corresponding new certificate. The new certificate is a certificate generated or updated based on the new root certificate. The new certificate may be the new root certificate itself, or other certificates to be issued or signed by the new root certificate to the corresponding NF instance.

[0044] In block 220, the functional entity causes the services served by the second set of NF instances to be transferred to the first set of NF instances. The functional entity may activate each NF instance in the newly created first set of NF instances. The activated new NF instances are ready to support the services transferred to the second set of NF instances. The activated new NF instances may also be used to provide other communication services. In some embodiments, the functional entity may configure the first set of network function instances so that the first set of network function instances are dedicated to the migration of the CA.

[0045] The functional entity may determine whether migration of the CA is about to occur. There may be mechanisms to detect or anticipate the need for CA migration. In an example, the anticipation of the need for CA migration (e.g., a change in the root CA) may come from operator or customer input. In another example, CA migration may be triggered by the recent expiration or revocation of a root certificate or a sub-CA certificate. Thus, the determination may be made automatically based on the validity of the root certificate or the sub-CA certificate.

[0046] In an exemplary embodiment, the functional entity may receive a notification, for example, from a platform hosting the NF, that CA migration is about to occur. Then, the creation of a first set of network function instances may be triggered in response to the notification. In this way, the creation of a new set of network function instances may occur immediately when the migration of the CA begins, so that the relevant services may be transferred to the new network function instances in a timely manner, thereby mitigating the risk of service unavailability.

[0047] Optionally, the NF registration may be utilized to update the Network Repository Function (NRF) so that the new NF instance is reflected in subsequent system-level functions that require the use of the new NF instance. In some embodiments, each new NF instance may be registered with the NRF, for example, with an indicator indicating that each new network function instance has a high priority, and / or each new network function instance is dedicated to the migration of the CA. The registration information (e.g., status or priority) of the old NF instance in the NRF may also be further updated. For example, the priority of the old NF instance may be lowered.

[0048] After successfully completing the above process of creating a new NF instance, transferring services, and optionally registering the new NF instance and the old NF instance, the functional entity may deactivate the old NF instance, as shown in block 230. In one embodiment, the functional entity may deregister each NF instance in the second set of NF instances from the NRF. In this regard, the status of the old NF instance may be updated to deactivated. Then, the second set of NF instances may be deleted or locked.

[0049] The NF instances affected by CA migration can be a group of NF instances, such as Figure 1 Application group 1 120 and application group 2 130 are shown. In some embodiments, the set of NF instances may be a set of NFs deployed in a network slice subnet instance (e.g., a CN slice subnet instance). A redundant set of NF instances may then be created and processed based on the network slice subnet instance.

[0050] Reference above Figure 2 In some embodiments discussed, the second group of NF instances is deployed in a second network slice subnet instance, for example, an old network slice subnet instance currently in use. The functional entity may cause the creation of a first network slice subnet instance, which is redundant for the second network slice subnet instance. The newly created redundant network slice subnet instance may serve as a backup for the second network slice subnet instance. In some scenarios, the second group of NF instances may be only a part of the NF instances deployed in the second network slice subnet instance. This means that some NF instances deployed in the old network slice subnet instance may not be affected by the CA migration. In this case, the NF instances that are not affected by the CA migration will be reused for the new network slice subnet instance.

[0051] When all new NF instances in the first set of NF instances are activated, the first network slice subnet instance can be activated. In the example, after all new NF instances are signed with corresponding new certificates, a new network slice subnet instance with these new NF instances can be activated.

[0052] In some embodiments, the functional entity may also update the network slice selection function (NSSF) with the network slice instance for the first network slice subnet instance. In an exemplary embodiment, once the CA migration process is completed, the old network slice subnet instance may be deactivated or deleted.

[0053] The method is now described in more detail. Figure 3 , which is an end-to-end message flow of an exemplary process according to an embodiment of the present disclosure. The message sequence in the figure shows "K8S" 303 for a "Kubernetes platform". However, this can be any platform or virtualization environment that hosts NFs (such as CNFs or VNFs) and a certificate management system. For example, the platform or virtualization environment can be implemented as Figure 1 In this embodiment, it is assumed that the root certificate of the root CA or the sub-CA is installed in the platform hosting the CNF and VNF.

[0054] The platform may have mechanisms to detect or anticipate the need to migrate the PKI. This may be due to the recent expiration or revocation of the root certificate of the root CA or sub-CA installed in the platform and used to sign the certificates of the CNF / VNF hosted in the virtualized environment.

[0055] When the platform 303 detects or anticipates the need for such a CA migration, it may send a notification to the network slice management function 301 (such as the NSMF of the 5GC), as shown in 310. For example, the notification may contain information about the planned CA migration, such as the identity of the root CA or sub-CA changed in the CA migration, the identity of the root certificate to be updated in the CA migration, etc.

[0056] When NSMF 301 receives a notification about CA migration from platform 303, it may request NSSMF 302 (such as NSSMF of 5GC) to create a new core network slice subnet instance that is redundant for the old core network slice subnet instance. In an example, NSMF 301 may determine the old core network slice subnet instance that will be affected by the planned CA migration, for example based on the received identification of the root CA or sub CA and / or the identification of the received root certificate. As shown in 315, NSMF 301 sends a request to NSSMF 302. In some embodiments, the request may include information about the old core network slice subnet instance, such as a network slice instance (NSI) identification (ID) identifying the old core network slice subnet instance, a profile or configuration of the old core network slice subnet instance, or other associated parameters. In the case where all NFs of the platform use the same CA, NSMF 301 may request NSSMF 302 to create redundant core network slice subnet instances for all core network slice subnet instances of the platform. In some embodiments, the request in step 315 may include an indicator indicating that the new network slice subnet instance to be created is dedicated to the migration of the CA.

[0057] In response to the request from NSMF 301, NSSMF 302 creates a new core network slice subnet instance. The new core network slice subnet instance may be created based on information about the old core network slice subnet instance to facilitate backup of the old core network slice subnet instance. The new core network slice subnet instance is assigned a new NSI, but may be configured with the same profile parameters as the old core network slice subnet instance to support services to be transferred from the old core network slice subnet instance.

[0058] The creation of a new core network slice subnet instance will trigger the creation of an NF instance deployed in the new core network slice subnet instance. In the example, the NSSMF 302 may request the platform 303 to deploy a new instance of the CNF / VNF for the new network slice subnet instance, as shown in 320. In some embodiments, the request may contain information about the old NF instance, such as a profile or configuration of the old instance of the corresponding CNF / VNF, and other associated parameters. Then, as shown in 325, the platform 303 creates and issues a new certificate for each new instance of the CNF / VNF, for example using a traditional automatic certificate management process, and deploys the new instance of the CNF / VNF in the new core network slice subnet instance. These new certificates are created by using a new root certificate. The new certificate may be created before or after the NSSMF 302 triggers the platform 303 to deploy the new instance of the VNF / CNF. This ensures that the new instance of the CNF / VNF has been migrated to the new CA. After the new NF instance with the new certificate is deployed, the platform 303 may confirm the successful deployment of the new NF instance by sending a deployment response to the NSSMF 302, as shown in 330.

[0059] Upon receiving a successful confirmation from the platform, the NSSMF 302 may configure and trigger the activation process of the newly created NF instances for the new CN slice subnet instances, as shown in 335. In some embodiments, the NSSMF 302 may configure these new NF instances so that they are dedicated to CA migration. The new NF instances may then be ready to support services in place of the corresponding old NF instances.

[0060] When a registration process is triggered for a new NF instance, NF 304 may register the new NF instance with NRF 306, as shown in 340. In some embodiments, these new NF instances may be configured with a highest priority. Alternatively, an indication may be provided to indicate that these new NF instances are for a use case of CA migration. During the registration process, an indicator indicating the highest priority and / or specifying a use case of PKI migration may be sent to NRF 306.

[0061] In some embodiments, NSSMF 302 may also update the status and priority of the old NF instance (signed or issued using the old certificate) to NRF 306, as shown in 345. In this regard, NSSMF 302 may notify NRF 306 of the updated status and priority of the corresponding old NF instance. For example, the priority of the old NF instance may be updated to a lower priority. In some embodiments, NSSMF 302 may also notify NRF 306 that the update is due to the migration of the CA. The status of the old NF instance may be updated to deactivated, for example, after the CA migration is completed. NRF 306 may use the status and priority information to effectively process the service discovery request received during the transition period of the service from the old NF instance to the corresponding new NF instance. In such a scenario, after receiving the update from NSSMF 302, if the discovery request is for a high priority service, NRF 306 may include a "safe" status for the new NF instance with the new certificate instead of the old NF instance.

[0062] In some embodiments, the NSSMF 302 may also update one or more network slice selection functions (NSSFs) 305 (such as the 5GC NSSF) with a new NSI for the newly created core network slice subnet slice, as shown at 350. In this way, if necessary, the NSSF will select the new core network slice subnet slice instance (rather than the old core network slice subnet slice instance) to provide services.

[0063] Steps 340, 345, and 350 may enable the NRF 306 to complete the registration process. The NRF 306 responds (confirms) the NSSMF 302 with the updated status of the old NF instance and the new NF instance, as shown at 355. At this point, the new NF instance with the migrated CA (i.e., with the new certificate generated or updated in the CA migration) is active and registered, while the old NF instance may be unregistered and deactivated.

[0064] After receiving a successful confirmation from NRF 306, NSSMF 302 completes the cycle with NSMF 301 (i.e., completes the creation of redundant new network slice subnet instances, activates the new network slice subnet instances and the corresponding new NF instances, and registers the NFs in the new network slice subnet instances with NRF), for example by notifying about the completion of the CA migration process (such as the certificate migration process), as shown in 360.

[0065] In some embodiments, in response to receiving a notification sent from NSSMF 302 at 360, NSMF 301 365 may notify NSSMF 302 to deactivate the old core network slice subnet instance having the deregistered old NF instance, so that the old core network slice subnet instance and the old NF instance are prohibited from working. In this regard, the old core network slice subnet instance and the old NF instance may be deleted or locked.

[0066] Will refer to Figure 4 and Figure 5 More details of example embodiments according to the present disclosure are described. Figure 4 400 according to an embodiment of the present disclosure. The method 400 may be implemented at any suitable device. For example, the method 400 may be implemented at a second device, which is configured to implement the following Figure 3 NSMF 301 shown.

[0067] As shown in block 420, the method 400 includes sending a request to a network slice subnet management function (such as the NSSMF 302) to create a first network slice subnet instance using a new root certificate updated in the migration of the CA, the first network slice subnet instance being redundant for a second network slice subnet instance. Corresponding certificates for a second set of network function instances deployed in the second network slice subnet instance are to be updated in the migration of the CA.

[0068] The request may include at least one of the following information: an identifier of the second network slice subnet instance; and an indicator indicating that the first network slice subnet instance is dedicated to the migration of the CA.

[0069] The request may be triggered by determining that certificates of a second set of network function instances deployed in a second network slice subnet instance are to be updated in a planned migration of the CA. In some embodiments, method 400 may optionally include, for example, receiving a notification from a platform hosting a management system for CA certificates (such as platform 110, 303) that a migration of the CA is about to occur, as shown in block 410. The request of block 420 may be sent in response to receiving the notification.

[0070] In some embodiments, method 400 may also optionally include: receiving a notification from the NSSMF that the migration of the CA is completed and the first network slice subnet instance has been created, as shown in box 430; and then, sending a request to the NSSMF to deactivate the second network slice subnet instance, as shown in box 440.

[0071] Figure 5 5 is a flow chart of a method 500 according to an embodiment of the present disclosure. The method 500 may be implemented at any suitable device. For example, the method 500 may be implemented at a third device, which is configured to implement the following Figure 3 NSSMF 302 shown.

[0072] As shown in box 510, the method 500 includes: receiving a request from a network slice management function (such as NSMF 301) to create a first network slice subnet instance that is redundant for a second network slice subnet instance. The corresponding certificates for the second set of network function instances deployed in the second network slice subnet instance will be updated in the migration of the CA. At box 520, the method 500 includes: in response to the request, creating the first network slice subnet instance using the new root certificate updated in the migration of the CA. At box 530, the method 500 includes: causing the service served by the second set of network function instances to be transferred to the first set of network function instances deployed in the first network slice subnet instance.

[0073] In some embodiments, method 500 may further include: in response to creating a first network slice subnet instance, triggering the creation of a first group of network function instances, the first group of network function instances being redundant for a second group of network function instances. Each network function instance in the first group of network function instances will be signed with a corresponding new certificate generated or updated based on a new root certificate. Method 500 may further include: activating the first group of network function instances; and configuring the first group of network function instances. Each network function instance in the first group of network function instances may be configured to be dedicated to CA migration, so that these new network function instances can be registered with an NRF (such as NRF 306) using their indicators that are different from normal NF instances. In this regard, method 500 may further include: causing each network function instance in the first group of network function instances to be registered with the NRF, wherein the indicator indicates at least one of the following information: each network function instance in the first group of network function instances has a high priority; or each network function instance in the first group of network function instances is dedicated to CA migration.

[0074] In some embodiments, the method 500 may further include: activating the first network slice subnet instance when the first set of network function instances are activated. Then, the method 500 may further include: updating the network slice selection function (such as NSSF 305) with the network slice instance for the first network slice subnet instance.

[0075] In some embodiments, the method 500 may further include updating, for each network function instance in the second set of network function instances, a status and priority maintained in a network repository function, such as the NRF 306 .

[0076] In some embodiments, method 500 may further include: sending a notification to NSMF that the migration of CA is complete and the first network slice subnet instance has been created; and receiving a request from NSMF to deactivate the second network slice subnet instance. In response to the request, method 500 may further include: deactivating the second network slice subnet instance. The second group of network function instances may also be deactivated. In this regard, method 500 may further include: unregistering each network function instance in the second group of network function instances from the NRF; and deleting or locking the second group of network function instances.

[0077] Reference now Figure 6, which shows a simplified block diagram of an apparatus 600 that may be embodied in / embodied as a network entity (such as NSMF, NSSMF). The apparatus 600 may include: at least one processor 601 (such as a data processor (DP)), and at least one memory (MEM) 602 coupled to the at least one processor 601. The apparatus 600 may also include one or more transmitters TX, one or more receivers RX 603, or one or more transceivers coupled to the one or more processors 601 to communicate wirelessly and / or by wire.

[0078] Although not shown, the apparatus 600 may have at least one communication interface, for example, the communication interface may be at least one antenna or a transceiver, such as Figure 6 The communication interface may represent any interface necessary for communicating with other network entities.

[0079] As non-limiting examples, processor 601 may be of any type suitable for the local technical environment, and may include one or more of the following: a general purpose computer, a special purpose computer, a microprocessor, a digital signal processor (DSP), and a processor based on a multi-core processor architecture.

[0080] As non-limiting examples, MEM 602 may be of any type suitable to the local technical environment and may be implemented using any suitable data storage technology, such as semiconductor-based memory devices, magnetic memory devices and systems, optical memory devices and systems, fixed memory, and removable memory.

[0081] The MEM 602 stores a program (PROG) 604. The PROG 604 may include instructions that, when executed on an associated processor 601, enable the apparatus 600 to operate according to embodiments of the present disclosure, for example to perform one of the methods 200, 400, and 500. The combination of at least one processor 601 and at least one MEM 602 may form a processing circuit or component 605 suitable for implementing various embodiments of the present disclosure.

[0082] Various embodiments of the present disclosure may be implemented by a computer program executable by one or more processors 601 , software, firmware, hardware, or a combination thereof.

[0083] In general, various exemplary embodiments may be implemented in hardware or dedicated circuits, software, logic, or any combination thereof. For example, some aspects may be implemented in hardware, while other aspects may be implemented in firmware or software that may be executed by a controller, microprocessor, or other computing device, but the invention is not limited thereto. Although various aspects of the exemplary embodiments of the present disclosure may be shown and described as block diagrams, flow charts, or using some other graphical representation, it is well understood that, as non-limiting examples, these blocks, devices, systems, techniques, or methods described herein may be implemented in hardware, software, firmware, dedicated circuits or logic, general-purpose hardware or controllers or other computing devices, or some combination thereof.

[0084] It should therefore be understood that at least some aspects of the exemplary embodiments of the present disclosure may be practiced in various components such as integrated circuit chips and modules. It should therefore be understood that the exemplary embodiments of the present disclosure may be implemented in a device embodied as an integrated circuit, wherein the integrated circuit may include circuits (and possible firmware) for embodying at least one or more of a data processor, a digital signal processor, a baseband circuit, and a radio frequency circuit that are configurable to operate according to the exemplary embodiments of the present disclosure.

[0085] It should be understood that at least some aspects of the exemplary embodiments of the present disclosure may be embodied in computer executable instructions executed by one or more computers or other devices, such as in one or more program modules. Typically, program modules include routines, programs, objects, components, data structures, etc., which perform specific tasks or implement specific abstract data types when executed by a processor in a computer or other device. Computer executable instructions can be stored on a computer readable medium, such as a non-transient computer readable medium, such as a hard disk, an optical disk, a removable storage medium, a solid-state memory, a RAM, etc. As will be understood by those skilled in the art, the functions of the program modules can be combined or distributed in various embodiments as needed. In addition, the functions may be embodied in firmware or hardware equivalents, such as integrated circuits, field programmable gate arrays (FPGAs), etc. As used herein, the term "non-transient" is a limitation of the medium itself (i.e., tangible, not a signal), rather than a limitation of data storage persistence (e.g., RAM to ROM).

[0086] In addition, although the operation is described in a specific order, this should not be understood as requiring to perform such operation in the specific order shown or in a sequential order, or to perform all the operations shown to achieve the desired result. In some cases, multitasking and parallel processing may be advantageous. Similarly, although several specific implementation details are included in the above discussion, these should not be interpreted as limitations on the scope of the present disclosure, but should be interpreted as descriptions of features that can be dedicated to a specific embodiment. Some features described in the context of a separate embodiment may also be combined in a single embodiment. On the contrary, the various features described in the context of a single embodiment may also be realized in multiple embodiments individually or in any suitable sub-combination.

[0087] The present disclosure includes any novel feature or combination of features explicitly disclosed herein or any generalization thereof. When read in conjunction with the accompanying drawings, various modifications and adaptations to the aforementioned exemplary embodiments of the present disclosure may become apparent to those skilled in the relevant art in view of the foregoing description. However, any and all modifications will still fall within the scope of the non-limiting and exemplary embodiments of the present disclosure.

[0088] The following abbreviations that may be found in the specification and / or drawings are defined as follows: 3GPP Third Generation Partnership Project 5G Fifth Generation 5GC Fifth Generation Core (Network) AN Access Network CA Certificate Authority CN Core Network CNF containerized network functions CRL Certificate Revocation List IPSEC Internet Protocol Security K8S Kubernetes (Platform) NF Network Function NRF Network Repository Features NSI Network Slice Identifier NSSF network slice selection function NSMF Network Slice Management Function NSSMF Network Slicing Subnet Management Function NW Network OCSP Online Certificate Status Protocol RA Registration Authority SBA Service-Based Architecture S-NSSAI Single-Network Slice Selection Auxiliary Information SSH Secure Shell TLS Transport Layer Security TN transmission network VNF Virtualized Network Function

Claims

1. A device comprising: one or more processors; as well as one or more memories storing instructions that, when executed by the one or more processors, cause the apparatus to at least: causing creation of a first set of network function instances using a new root certificate updated in a migration of a certificate authority (CA), the first set of network function instances being redundant for a second set of network function instances, wherein corresponding certificates for the second set of network function instances are to be updated in the migration of the CA; as well as Causing services served by the second set of network function instances to be transferred to the first set of network function instances.

2. The apparatus of claim 1 , wherein the instructions, when executed by the one or more processors, further cause the apparatus to at least: receiving notification that a migration of the CA is about to occur, and Wherein causing said creation of said first set of network function instances is performed in response to said receiving of said notification.

3. The apparatus according to any one of claims 1 to 2, wherein said causing said creation of said first set of network function instances comprises: Causing each network function instance in the first set of network function instances to be signed using a corresponding new certificate, the corresponding new certificate being generated or updated based on the new root certificate.

4. The apparatus according to any one of claims 1 to 3, wherein the instructions, when executed by the one or more processors, further cause the apparatus to at least: activating the first set of network function instances; and The first group of network function instances is configured such that the first group of network function instances is dedicated to the migration of the CA.

5. The apparatus according to any one of claims 1 to 4, wherein the instructions, when executed by the one or more processors, further cause the apparatus to at least: causing each network function instance in the first set of network function instances to be registered with a network repository function (NRF), using an indicator to indicate at least one of the following information: Each network function instance in the first group of network function instances has a high priority; or Each network function instance in the first group of network function instances is dedicated to migration of the CA.

6. The apparatus according to any one of claims 1 to 5, wherein the instructions, when executed by the one or more processors, further cause the apparatus to at least: For each network function instance in the second set of network function instances, a status and priority maintained in a network repository function (NRF) is updated.

7. The apparatus according to any one of claims 1 to 6, wherein the instructions, when executed by the one or more processors, further cause the apparatus to at least: Deactivate the second set of network function instances.

8. The apparatus of claim 7, wherein deactivating the second set of network function instances comprises: unregistering each network function instance in the second set of network function instances from a network repository function (NRF); as well as The second group of network function instances is deleted or locked.

9. An apparatus according to any one of claims 1 to 8, wherein the second group of network function instances are deployed in a network slice subnet instance.

10. The apparatus according to any one of claims 1 to 9, wherein the instructions, when executed by the one or more processors, further cause the apparatus to at least: causing creation of a first network slice subnet instance, the first network slice subnet instance being redundant with a second network slice subnet instance, wherein the second set of network function instances are deployed in the second network slice subnet instance; The creation of the first group of network function instances is triggered by the creation of the first network slice subnet instance.

11. The apparatus of claim 10, wherein causing the creation of the first network slice subnet instance comprises: A request for creating the first network slice subnet instance is sent from the Network Slice Management Function (NSMF) to the Network Slice Subnet Management Function (NSSMF).

12. The apparatus of claim 11, wherein the request comprises at least one of: an identifier of the second network slice subnet instance; and An indicator indicating that the first network slice subnet instance is dedicated to the migration of the CA.

13. The apparatus of any one of claims 10 to 12, wherein the instructions, when executed by the one or more processors, further cause the apparatus to at least: When the first group of network function instances is activated, the first network slice subnet instance is activated.

14. The apparatus of any one of claims 10 to 13, wherein the instructions, when executed by the one or more processors, further cause the apparatus to at least: The network slice selection function (NSSF) is updated using the network slice instance for the first network slice subnet instance.

15. The apparatus of any one of claims 10 to 14, wherein the instructions, when executed by the one or more processors, further cause the apparatus to at least: Delete the second network slice subnet instance.

16. An apparatus according to any one of claims 10 to 15, wherein the first network slice subnet instance is a core network slice subnet instance.

17. A method comprising: causing creation of a first set of new network function instances using a new root certificate updated in a migration of a certificate authority (CA), the first set of new network function instances being redundant with a second set of old network function instances, wherein corresponding certificates for the second set of network function instances are to be updated in the migration of the CA; as well as Causing services served by the second set of network function instances to be transferred to the first set of network function instances.

18. The method according to claim 17, further comprising: receiving notification that a migration of the CA is about to occur, and Wherein causing said creation of said first set of network function instances is performed in response to said receiving of said notification.

19. The method of claim 17 or 18, wherein causing the creation of the first set of network function instances comprises: Causing each new network function instance in the first set of network function instances to be signed using a corresponding new certificate, the corresponding new certificate being generated or updated based on the new root certificate.

20. The method according to any one of claims 17 to 19, further comprising: activating the first group of network function instances; as well as The first group of network function instances is configured such that the first group of network function instances is dedicated to the migration of the CA.

21. The method according to any one of claims 17 to 20, further comprising: causing each network function instance in the first set of network function instances to be registered with a network repository function (NRF), using an indicator to indicate at least one of the following information: Each network function instance in the first group of network function instances has a high priority; or Each network function instance in the first set of network function instances is dedicated to the migration of the PKI.

22. The method according to any one of claims 17 to 21, further comprising: For each network function instance in the second set of network function instances, a status and priority maintained in a network repository function (NRF) is updated.

23. The method according to any one of claims 17 to 22, further comprising: Deactivate the second set of network function instances.

24. The method of claim 23, wherein deactivating the second set of network function instances comprises: unregistering each network function instance in the second set of network function instances from a network repository function (NRF); as well as The second group of network function instances is deleted or locked.

25. A method according to any one of claims 17 to 24, wherein the second set of network function instances are deployed in a network slice subnet instance.

26. The method according to any one of claims 17 to 25, further comprising: causing creation of a first network slice subnet instance, the first network slice subnet instance being redundant with a second network slice subnet instance, wherein the second set of network function instances are deployed in the second network slice subnet instance; The creation of the first group of network function instances is triggered by the creation of the first network slice subnet instance.

27. The method of claim 26, wherein said causing said creation of said first network slice subnet instance comprises: A request for creating the first network slice subnet instance is sent from the Network Slice Management Function (NSMF) to the Network Slice Subnet Management Function (NSSMF).

28. The method of claim 27, wherein the request comprises at least one of: an identifier of the second network slice subnet instance; and An indicator indicating that the first network slice subnet instance is dedicated to the migration of the CA.

29. The method according to any one of claims 26 to 28, further comprising: When the first group of network function instances is activated, the first network slice subnet instance is activated.

30. The method according to any one of claims 26 to 29, further comprising: The network slice selection function (NSSF) is updated using the network slice instance for the first network slice subnet instance.

31. The method according to any one of claims 26 to 30, further comprising: Delete the second network slice subnet instance.

32. A method according to any one of claims 26 to 31, wherein the network slice subnet instance is a core network slice subnet instance.

33. A computer readable medium having computer program code embodied thereon, which, when executed by an apparatus, causes the apparatus to perform the method according to any one of claims 17 to 32.

34. An apparatus implemented at a network slice management function (NSMF), comprising: one or more processors; as well as one or more memories storing instructions that, when executed by the one or more processors, cause the apparatus to at least: sending a request to a network slice subnet management function (NSSMF) to create a first network slice subnet instance using a new root certificate updated in a migration of a certificate authority (CA), the first network slice subnet instance being redundant for a second network slice subnet instance, The corresponding certificates for the second group of network function instances deployed in the second network slice subnet instance will be updated during the migration of the CA.

35. The apparatus of claim 34, wherein the request comprises at least one of: an identifier of the second network slice subnet instance; and An indicator indicating that the first network slice subnet instance is dedicated to the migration of the CA.

36. The apparatus of claim 34 or 35, wherein the instructions, when executed by the one or more processors, further cause the apparatus to at least: receiving notification that a migration of the CA is about to occur, and Wherein the request is sent in response to the receipt of the notification.

37. The apparatus of any one of claims 34 to 36, wherein the instructions, when executed by the one or more processors, further cause the apparatus to at least: Receiving a notification from the NSSMF that the migration of the CA is complete and the first network slice subnet instance has been created; and Send a request to the NSSMF to deactivate the second network slice subnet instance.

38. An apparatus according to any one of claims 34 to 37, wherein the first network slice subnet instance is a core network slice subnet instance.

39. A method performed by a network slice management function (NSMF), comprising: sending a request to a network slice subnet management function (NSSMF) to create a first network slice subnet instance using a new root certificate updated in a migration of a certificate authority (CA), the first network slice subnet instance being redundant for a second network slice subnet instance, The corresponding certificates for the second group of network function instances deployed in the second network slice subnet instance will be updated during the migration of the CA.

40. The method of claim 39, wherein the request comprises at least one of: an identifier of the second network slice subnet instance; and An indicator indicating that the first network slice subnet instance is dedicated to the migration of the CA.

41. The method according to claim 39 or 40, further comprising: receiving notification that a migration of the CA is about to occur, and Wherein the request is sent in response to the receipt of the notification.

42. The method according to any one of claims 39 to 41, further comprising: Receiving a notification from the NSSMF that the migration of the CA is complete and the first network slice subnet instance has been created; as well as Send a request to the NSSMF to deactivate the second network slice subnet instance.

43. A method according to any one of claims 39 to 42, wherein the first network slice subnet instance is a core network slice subnet instance.

44. A computer readable medium having computer program code embodied thereon, which, when executed by an apparatus, causes the apparatus to perform the method according to any one of claims 39 to 43.

45. An apparatus implemented at a network slice subnet management function (NSSMF), comprising: one or more processors; as well as one or more memories storing instructions that, when executed by the one or more processors, cause the apparatus to at least: receiving a request from a network slice management function (NSMF) to create a first network slice subnet instance, the first network slice subnet instance being redundant for a second network slice subnet instance, wherein corresponding certificates for a second set of network function instances deployed in the second network slice subnet instance are to be updated in a migration of a certificate authority (CA); In response to the request, creating the first network slice subnet instance using the new root certificate updated in the migration of the CA; as well as Causing the services served by the second group of network function instances to be transferred to the first group of network function instances deployed in the first network slice subnet instance.

46. ​​The apparatus of claim 45, wherein the request comprises at least one of: an identifier of the second network slice subnet instance; and An indicator indicating that the first network slice subnet instance is dedicated to the migration of the CA.

47. An apparatus according to any one of claims 45 to 46, wherein the instructions, when executed by the one or more processors, further cause the apparatus to at least: In response to the creation of the first network slice subnet instance, the creation of the first group of network function instances is triggered, and the first group of network function instances are redundant for the second group of network function instances.

48. An apparatus according to any one of claims 45 to 47, wherein each network function instance in the first set of network function instances is to be signed using a corresponding new certificate, and the corresponding new certificate is generated or updated based on the new root certificate.

49. An apparatus according to any one of claims 45 to 48, wherein the instructions, when executed by the one or more processors, further cause the apparatus to at least: activating the first set of network function instances; and The first group of network function instances is configured such that the first group of network function instances is dedicated to the migration of the CA.

50. The apparatus of any one of claims 45 to 49, wherein the instructions, when executed by the one or more processors, further cause the apparatus to at least: When the first group of network function instances is activated, the first network slice subnet instance is activated.

51. The apparatus of any one of claims 45 to 50, wherein the instructions, when executed by the one or more processors, further cause the apparatus to at least: causing each network function instance in the first set of network function instances to be registered with a network repository function (NRF), using an indicator to indicate at least one of the following information: Each network function instance in the first group of network function instances has a high priority; or Each network function instance in the first group of network function instances is dedicated to migration of the CA.

52. The apparatus of any one of claims 45 to 51, wherein the instructions, when executed by the one or more processors, further cause the apparatus to at least: For each network function instance in the second set of network function instances, a status and priority maintained in a network repository function (NRF) is updated.

53. The apparatus of any one of claims 45 to 52, wherein the instructions, when executed by the one or more processors, further cause the apparatus to at least: The network slice selection function (NSSF) is updated using the network slice instance for the first network slice subnet instance.

54. The apparatus of any one of claims 45 to 53, wherein the instructions, when executed by the one or more processors, further cause the apparatus to at least: Sending a notification to the NSMF that the migration of the CA is complete and the first network slice subnet instance has been created; and Receive a request from the NSMF to deactivate the second network slice subnet instance.

55. The apparatus of any one of claims 45 to 54, wherein the instructions, when executed by the one or more processors, further cause the apparatus to at least: Deactivate the second set of network function instances.

56. The apparatus of claim 55, wherein deactivating the second set of network function instances comprises: unregistering each network function instance in the second set of network function instances from a network repository function (NRF); as well as The second group of network function instances is deleted or locked.

57. An apparatus according to any one of claims 45 to 56, wherein the first network slice subnet instance is a core network slice subnet instance.

58. A method performed by a network slice subnet management function (NSSMF), comprising: receiving a request from a network slice management function (NSMF) to create a first network slice subnet instance, the first network slice subnet instance being redundant for a second network slice subnet instance, wherein corresponding certificates for a second set of network function instances deployed in the second network slice subnet instance are to be updated in a migration of a certificate authority (CA); In response to the request, creating the first network slice subnet instance using the new root certificate updated in the migration of the CA; as well as Causing the services served by the second group of network function instances to be transferred to the first group of network function instances deployed in the first network slice subnet instance.

59. The method of claim 58, wherein the request comprises at least one of: an identifier of the second network slice subnet instance; and An indicator indicating that the first network slice subnet instance is dedicated to the migration of the CA.

60. The method according to any one of claims 58 to 59, further comprising: In response to the creation of the first network slice subnet instance, the creation of the first group of network function instances is triggered, and the first group of network function instances are redundant for the second group of network function instances.

61. A method according to any one of claims 58 to 60, wherein each network function instance in the first group of network function instances is signed using a corresponding new certificate, and the corresponding new certificate signature is generated or updated based on the new root certificate.

62. The method according to any one of claims 58 to 61, further comprising: activating the first group of network function instances; as well as The first group of network function instances is configured such that the first group of network function instances is dedicated to the migration of the CA.

63. The method according to any one of claims 58 to 62, further comprising: When the first group of network function instances is activated, the first network slice subnet instance is activated.

64. The method according to any one of claims 58 to 63, further comprising: causing each network function instance in the first set of network function instances to be registered with a network repository function (NRF), using an indicator to indicate at least one of the following information: Each network function instance in the first group of network function instances has a high priority; or Each network function instance in the first group of network function instances is dedicated to migration of the CA.

65. The method according to any one of claims 58 to 64, further comprising: For each network function instance in the second set of network function instances, a status and priority maintained in a network repository function (NRF) is updated.

66. The method of any one of claims 58 to 65, further comprising: The network slice selection function (NSSF) is updated using the network slice instance for the first network slice subnet instance.

67. The method according to any one of claims 58 to 66, further comprising: Sending a notification to the NSMF that the migration of the CA is completed and the first network slice subnet instance has been created; as well as Receive a request from the NSMF to deactivate the second network slice subnet instance.

68. The method of any one of claims 58 to 67, further comprising: Deactivate the second set of network function instances.

69. The method of claim 68, wherein deactivating the second set of network function instances comprises: unregistering each network function instance in the second set of network function instances from a network repository function (NRF); as well as The second group of network function instances is deleted or locked.

70. A method according to any one of claims 58 to 69, wherein the first network slice subnet instance is a core network slice subnet instance.

71. A computer readable medium having computer program code embodied thereon, which, when executed by an apparatus, causes the apparatus to perform the method according to any one of claims 58 to 70.

Images